Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	1322389
MD5:	21c68b05ac982cff12afcb9af3a5657d
SHA1:	3651d8e4e0fdc66c1f888e34337ae2c13cb9b904
SHA256:	19a4f6df26db3df254ccf6270b2abe2ef6bcf86264cd17acaa5a46995672bbe4
Tags:	exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Tofsee

Uses netsh to modify the Windows network and firewall settings

Query firmware table information (likely to detect VMs)

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Writes to foreign memory regions

Changes security center settings (notifications, updates, antivirus, firewall)

Found API chain indicative of debugger detection

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Modifies the windows firewall

Found decision node followed by non-executed suspicious APIs

One or more processes crash

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Found evasive API chain (date check)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Modifies existing windows services

Drops PE files

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Creates files inside the system directory

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Contains functionality to communicate with device drivers

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains capabilities to detect virtual machines

Uses SMTP (mail sending)

Found evaded block containing many API calls

Found evasive API chain (may stop execution after accessing registry keys)

Queries disk information (often used to detect virtual machines)

Contains functionality to query network adapater information

Classification

Process Tree

System is w10x64

svchost.exe (PID: 5680 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5456 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5708 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6660 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 352 cmdline: "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe" -wdenable MD5: 31E905BFB19E7D184BB81F274A71B221)

conhost.exe (PID: 3320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

file.exe (PID: 7448 cmdline: C:\Users\user\Desktop\file.exe MD5: 21C68B05AC982CFF12AFCB9AF3A5657D)

cmd.exe (PID: 7624 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptlohvde\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

cmd.exe (PID: 7680 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wdkncqjt.exe" C:\Windows\SysWOW64\ptlohvde\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

sc.exe (PID: 7752 cmdline: C:\Windows\System32\sc.exe" create ptlohvde binPath= "C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe /d\"C:\Users\user\Desktop\file.exe\"" type= own start= auto DisplayName= "wifi support MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

sc.exe (PID: 7836 cmdline: C:\Windows\System32\sc.exe" description ptlohvde "wifi internet conection MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

sc.exe (PID: 7904 cmdline: "C:\Windows\System32\sc.exe" start ptlohvde MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

netsh.exe (PID: 7976 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 7366FBEFE66BA0F1F5304F7D6FEF09FE)

WerFault.exe (PID: 8124 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 632 MD5: F5210A4A7E411A1BAD3844586A74B574)

wdkncqjt.exe (PID: 7956 cmdline: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe /d"C:\Users\user\Desktop\file.exe" MD5: B11DD4A2DA4ABF719066A2DB8F95983F)

svchost.exe (PID: 6024 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 7240 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 540 MD5: F5210A4A7E411A1BAD3844586A74B574)

svchost.exe (PID: 7984 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 8060 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7448 -ip 7448 MD5: F5210A4A7E411A1BAD3844586A74B574)

WerFault.exe (PID: 6288 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7956 -ip 7956 MD5: F5210A4A7E411A1BAD3844586A74B574)

svchost.exe (PID: 3360 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5896 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000010.00000002.1575910314.0000000000619000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x499c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000004.00000002.1457392227.000000000090D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x50d4:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
Process Memory Space: file.exe PID: 7448	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: wdkncqjt.exe PID: 7956	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 6024	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.3.file.exe.720000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
4.3.file.exe.720000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.3.file.exe.720000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.3.wdkncqjt.exe.ea0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.3.wdkncqjt.exe.ea0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.3.wdkncqjt.exe.ea0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
4.2.file.exe.700e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.2.file.exe.700e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
16.2.wdkncqjt.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.wdkncqjt.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.wdkncqjt.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
23.2.svchost.exe.25a0000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
23.2.svchost.exe.25a0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
23.2.svchost.exe.25a0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.2.wdkncqjt.exe.ee0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.wdkncqjt.exe.ee0000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.wdkncqjt.exe.ee0000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
23.2.svchost.exe.25a0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
23.2.svchost.exe.25a0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
23.2.svchost.exe.25a0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.2.wdkncqjt.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.wdkncqjt.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.wdkncqjt.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
4.2.file.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
4.2.file.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.2.file.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
4.2.file.exe.700e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
4.2.file.exe.700e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.2.file.exe.700e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
4.3.file.exe.720000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.3.file.exe.720000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
16.3.wdkncqjt.exe.ea0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.3.wdkncqjt.exe.ea0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
16.2.wdkncqjt.exe.ee0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.wdkncqjt.exe.ee0000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.wdkncqjt.exe.ee0000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.2.wdkncqjt.exe.740e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.wdkncqjt.exe.740e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
16.2.wdkncqjt.exe.740e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.wdkncqjt.exe.740e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.wdkncqjt.exe.740e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
4.2.file.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
4.2.file.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
4.2.file.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: jotunheim.name:443	URL Reputation: Label: malware
Source: vanaheim.cn:443	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\wdkncqjt.exe

Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 16.3.wdkncqjt.exe.ea0000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 34%

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\wdkncqjt.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 4.2.file.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Unpacked PE file: 16.2.wdkncqjt.exe.400000.0.unpack

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: C:\busoy\jigufab zakamiwir96 vovogimiwer-m.pdb source: file.exe, wdkncqjt.exe.4.dr
Source:	Binary string: [,C:\busoy\jigufab zakamiwir96 vovogimiwer-m.pdb source: file.exe, wdkncqjt.exe.4.dr

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 193.106.174.220 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.207.5 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.207.1 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.74 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.212.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.53.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.40.29 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.74 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 80.66.75.77 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	ASN Name: IQHOSTRU IQHOSTRU
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: Joe Sandbox View	IP Address: 193.106.174.220 193.106.174.220
Source: Joe Sandbox View	IP Address: 40.93.207.5 40.93.207.5

Source: global traffic	TCP traffic: 192.168.2.3:49714 -> 40.93.207.5:25
Source: global traffic	TCP traffic: 192.168.2.3:49719 -> 40.93.207.1:25
Source: global traffic	TCP traffic: 192.168.2.3:49731 -> 40.93.212.0:25
Source: global traffic	TCP traffic: 192.168.2.3:49746 -> 104.47.54.36:25
Source: global traffic	TCP traffic: 192.168.2.3:49821 -> 52.101.40.29:25
Source: global traffic	TCP traffic: 192.168.2.3:49824 -> 98.136.96.74:25
Source: global traffic	TCP traffic: 192.168.2.3:49835 -> 67.195.204.74:25
Source: global traffic	TCP traffic: 192.168.2.3:49838 -> 104.47.53.36:25

Source: svchost.exe, 00000026.00000002.3749729471.000002C2C4D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS</ds:KeyName></ds:KeyInfo><CipherData><Ci
Source: svchost.exe, 00000026.00000003.3112243315.000002C2C5A58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750847365.000002C2C5A59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tbpose
Source: svchost.exe, 00000026.00000002.3750551269.000002C2C5A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3107442635.000002C2C5557000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750444056.000002C2C5578000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750116583.000002C2C5500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3107367797.000002C2C5554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000026.00000003.3107167741.000002C2C552D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdxmlns:
Source: svchost.exe, 00000026.00000003.3107442635.000002C2C5557000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750444056.000002C2C5578000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750116583.000002C2C5500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3107367797.000002C2C5554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000026.00000002.3750116583.000002C2C5500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdcuri
Source: svchost.exe, 00000026.00000003.3107167741.000002C2C552D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdst=
Source: svchost.exe, 00000026.00000002.3749548171.000002C2C4CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 00000026.00000002.3750116583.000002C2C5500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750338270.000002C2C555F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750217722.000002C2C5513000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750338270.000002C2C555F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000026.00000002.3750217722.000002C2C5513000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scerence
Source: svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750338270.000002C2C555F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750217722.000002C2C5513000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 00000002.00000002.3746383824.0000018D1173F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3742838049.0000018D10E88000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.2.dr	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: svchost.exe, 00000026.00000002.3750725826.000002C2C5A49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000026.00000002.3749548171.000002C2C4CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090887334.000002C2C556B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000026.00000003.3090887334.000002C2C556B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600er
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090887334.000002C2C556B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf.srf
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3749548171.000002C2C4CB0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/pps
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090887334.000002C2C556B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090887334.000002C2C556B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090887334.000002C2C556B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srfssuer
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090887334.000002C2C556B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfssuer
Source: svchost.exe, 00000026.00000002.3749729471.000002C2C4D02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 00000026.00000003.3090887334.000002C2C556B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srfueruer
Source: svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090887334.000002C2C556B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfr
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000026.00000003.3090887334.000002C2C556B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfn
Source: svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502T
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806005
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000026.00000003.3090792976.000002C2C5557000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090513626.000002C2C555A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000026.00000003.3112243315.000002C2C5A58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000026.00000002.3749548171.000002C2C4CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx

Source: unknown

DNS traffic detected: queries for: microsoft-com.mail.protection.outlook.com

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

4_2_00402A62

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 4.3.file.exe.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.wdkncqjt.exe.ea0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.25a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.ee0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.25a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.file.exe.700e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.740e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wdkncqjt.exe PID: 7956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6024, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.3.file.exe.720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.3.file.exe.720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.3.wdkncqjt.exe.ea0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.3.wdkncqjt.exe.ea0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 4.2.file.exe.700e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.2.file.exe.700e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.wdkncqjt.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.wdkncqjt.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 23.2.svchost.exe.25a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 23.2.svchost.exe.25a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.wdkncqjt.exe.ee0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.wdkncqjt.exe.ee0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 23.2.svchost.exe.25a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 23.2.svchost.exe.25a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.wdkncqjt.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.wdkncqjt.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 4.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 4.2.file.exe.700e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.2.file.exe.700e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 4.3.file.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.3.file.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.3.wdkncqjt.exe.ea0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.3.wdkncqjt.exe.ea0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.wdkncqjt.exe.ee0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.wdkncqjt.exe.ee0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.wdkncqjt.exe.740e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.wdkncqjt.exe.740e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.wdkncqjt.exe.740e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.wdkncqjt.exe.740e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 4.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 4.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000010.00000002.1575910314.0000000000619000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000004.00000002.1457392227.000000000090D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7448 -ip 7448

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0040C913	4_2_0040C913
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Code function: 16_2_0040C913	16_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 23_2_025AC913	23_2_025AC913

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

4_2_00401280

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.3.file.exe.720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.3.file.exe.720000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.3.wdkncqjt.exe.ea0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.3.wdkncqjt.exe.ea0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 4.2.file.exe.700e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.2.file.exe.700e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.wdkncqjt.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.wdkncqjt.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 23.2.svchost.exe.25a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 23.2.svchost.exe.25a0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.wdkncqjt.exe.ee0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.wdkncqjt.exe.ee0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 23.2.svchost.exe.25a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 23.2.svchost.exe.25a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.wdkncqjt.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.wdkncqjt.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 4.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 4.2.file.exe.700e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.2.file.exe.700e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 4.3.file.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.3.file.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.3.wdkncqjt.exe.ea0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.3.wdkncqjt.exe.ea0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.wdkncqjt.exe.ee0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.wdkncqjt.exe.ee0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.wdkncqjt.exe.740e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.wdkncqjt.exe.740e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.wdkncqjt.exe.740e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.wdkncqjt.exe.740e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 4.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 4.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000010.00000002.1575910314.0000000000619000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000004.00000002.1457392227.000000000090D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\ptlohvde\

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 007027AB appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

4_2_00408E26

Source: file.exe, 00000004.00000002.1457408755.0000000000922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegolfstikator.exe> vs file.exe
Source: file.exe, 00000004.00000000.1282840177.00000000005A0000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamegolfstikator.exe> vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamegolfstikator.exe> vs file.exe

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_4-14596
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_16-14693

Source: classification engine

Classification label: mal100.troj.evad.winEXE@40/5@18/10

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,HeapCreate,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	4_2_00409A6B
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Code function: 16_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,HeapCreate,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	16_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 23_2_025A9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	23_2_025A9A6B

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,HeapCreate,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

4_2_00409A6B

Source: file.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptlohvde\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wdkncqjt.exe" C:\Windows\SysWOW64\ptlohvde\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create ptlohvde binPath= "C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe /d\"C:\Users\user\Desktop\file.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description ptlohvde "wifi internet conection
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start ptlohvde
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe /d"C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7448 -ip 7448
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 632
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7956 -ip 7956
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 540
Source: C:\Windows\System32\svchost.exe	Process created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe" -wdenable
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptlohvde\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wdkncqjt.exe" C:\Windows\SysWOW64\ptlohvde\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create ptlohvde binPath= "C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe /d\"C:\Users\user\Desktop\file.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description ptlohvde "wifi internet conection	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start ptlohvde	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7448 -ip 7448	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 632	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7956 -ip 7956	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 540	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\wdkncqjt.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,DeleteFileA,GetLastError,

4_2_00406A60

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00912102 CreateToolhelp32Snapshot,Module32First,

4_2_00912102

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:8060:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3320:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6288:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\busoy\jigufab zakamiwir96 vovogimiwer-m.pdb source: file.exe, wdkncqjt.exe.4.dr
Source:	Binary string: [,C:\busoy\jigufab zakamiwir96 vovogimiwer-m.pdb source: file.exe, wdkncqjt.exe.4.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 4.2.file.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Unpacked PE file: 16.2.wdkncqjt.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 4.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Unpacked PE file: 16.2.wdkncqjt.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_00406069

Source: initial sample

Static PE information: section name: .text entropy: 7.56497347195729

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\wdkncqjt.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ptlohvde

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create ptlohvde binPath= "C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe /d\"C:\Users\user\Desktop\file.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\Desktop\file.exe

4_2_00409A6B

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_00401000

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_16-15106
Source: C:\Users\user\Desktop\file.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_4-15043
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_23-6481

Source: C:\Windows\SysWOW64\svchost.exe TID: 1548	Thread sleep count: 1127 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 1548	Thread sleep time: -1127000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 1548	Thread sleep count: 8865 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 1548	Thread sleep time: -8865000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_23-6440
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_4-15034
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_16-15077

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_23-6180
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_16-14709
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_4-14613

Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 1127			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 8865			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	API coverage: 5.0 %
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	API coverage: 3.8 %

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_23-6150

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_4-14782
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_23-7452

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

23_2_025A199C

Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	API call chain: ExitProcess graph end node	graph_16-15080
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_23-6182
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_23-6442

Source: svchost.exe, 00000000.00000002.3742954169.000001FA1D075000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: svchost.exe, 00000000.00000002.3739521061.000001FA1D013000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000000.00000002.3742954169.000001FA1D080000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000000.00000002.3741542961.000001FA1D054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000026.00000002.3746737495.000002C2C4C75000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 00000026.00000002.3749548171.000002C2C4CEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000000.00000002.3739432670.000001FA1D000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000000.00000002.3742954169.000001FA1D075000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: svchost.exe, 00000000.00000002.3744363509.000001FA1D08D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: svchost.exe, 00000017.00000002.3739603621.0000000002A00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

4_2_00401D96

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe

Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep

graph_23-7676

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

4_2_00406069

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0070092B mov eax, dword ptr fs:[00000030h]	4_2_0070092B
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00700D90 mov eax, dword ptr fs:[00000030h]	4_2_00700D90
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_009119DF push dword ptr fs:[00000030h]	4_2_009119DF
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Code function: 16_2_0061D2A7 push dword ptr fs:[00000030h]	16_2_0061D2A7
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Code function: 16_2_0074092B mov eax, dword ptr fs:[00000030h]	16_2_0074092B
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Code function: 16_2_00740D90 mov eax, dword ptr fs:[00000030h]	16_2_00740D90

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

4_2_0040EBCC

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,HeapCreate,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	4_2_00409A6B
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Code function: 16_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,HeapCreate,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	16_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 23_2_025A9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	23_2_025A9A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 193.106.174.220 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.207.5 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.207.1 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.74 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.212.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.53.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.40.29 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.74 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 80.66.75.77 443	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 25A0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 25A0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 25A0000			Jump to behavior
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2606008			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptlohvde\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wdkncqjt.exe" C:\Windows\SysWOW64\ptlohvde\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create ptlohvde binPath= "C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe /d\"C:\Users\user\Desktop\file.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description ptlohvde "wifi internet conection	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start ptlohvde	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7448 -ip 7448	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 632	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7956 -ip 7956	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 540	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

4_2_00406EDD

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

4_2_00407809

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Queries volume information: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

4_2_0040EC54

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

4_2_0040B211

Source: C:\Users\user\Desktop\file.exe

4_2_00407809

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

4_2_0040405E

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

4_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\Desktop\file.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Source: svchost.exe, 00000003.00000002.3746581915.0000028D7406E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000003.00000002.3749355979.0000028D74102000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 4.3.file.exe.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.wdkncqjt.exe.ea0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.25a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.ee0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.25a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.file.exe.700e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.740e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wdkncqjt.exe PID: 7956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6024, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 4.3.file.exe.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.wdkncqjt.exe.ea0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.25a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.ee0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.25a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.file.exe.700e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.ee0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.wdkncqjt.exe.740e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wdkncqjt.exe PID: 7956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6024, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	4_2_004088B0
Source: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe	Code function: 16_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	16_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 23_2_025A88B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	23_2_025A88B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	1 Windows Management Instrumentation	1 Valid Accounts	1 Valid Accounts	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	41 Native API	14 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	12 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	14 Windows Service	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	3 Service Execution	Logon Script (Mac)	412 Process Injection	22 Software Packing	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	112 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	12 Masquerading	Cached Domain Credentials	23 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Valid Accounts	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	23 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	412 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	HEUR/AGEN.1312677
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\wdkncqjt.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\wdkncqjt.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://schemas.mi	0%	URL Reputation	safe
jotunheim.name:443	100%	URL Reputation	malware
vanaheim.cn:443	100%	URL Reputation	malware
http://crl.ver)	0%	Avira URL Cloud	safe
http://Passport.NET/STS</ds:KeyName></ds:KeyInfo><CipherData><Ci	0%	Avira URL Cloud	safe
http://Passport.NET/tbpose	0%	Avira URL Cloud	safe
http://passport.net/tb	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mta6.am0.yahoodns.net	98.136.96.74	true	true	unknown
jotunheim.name	80.66.75.77	true	true	unknown
microsoft-com.mail.protection.outlook.com	40.93.207.5	true	false	high
vanaheim.cn	193.106.174.220	true	true	unknown
yahoo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
jotunheim.name:443	true	URL Reputation: malware	unknown
vanaheim.cn:443	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.mi	svchost.exe, 00000026.00000002.3750116583.000002C2C5500000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdst=	svchost.exe, 00000026.00000003.3107167741.000002C2C552D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750338270.000002C2C555F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750217722.000002C2C5513000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3091154069.000002C2C552A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000026.00000002.3750551269.000002C2C5A02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdcuri	svchost.exe, 00000026.00000002.3750116583.000002C2C5500000.00000004.00000020.00020000.00000000.sdmp	false		high
http://passport.net/tb	svchost.exe, 00000026.00000002.3749548171.000002C2C4CB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750338270.000002C2C555F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750217722.000002C2C5513000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf	svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS</ds:KeyName></ds:KeyInfo><CipherData><Ci	svchost.exe, 00000026.00000002.3749729471.000002C2C4D02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdxmlns:	svchost.exe, 00000026.00000003.3107167741.000002C2C552D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	svchost.exe, 00000002.00000002.3746383824.0000018D1173F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3742838049.0000018D10E88000.00000004.00000020.00020000.00000000.sdmp, regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.2.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tbpose	svchost.exe, 00000026.00000003.3112243315.000002C2C5A58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750847365.000002C2C5A59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf	svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 00000026.00000003.3091042444.000002C2C5556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090566946.000002C2C5552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750338270.000002C2C555F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 00000026.00000002.3750250625.000002C2C5537000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf	svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srf	svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/scerence	svchost.exe, 00000026.00000002.3750217722.000002C2C5513000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 00000026.00000002.3746709876.000002C2C4C45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000026.00000003.3107442635.000002C2C5557000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750444056.000002C2C5578000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750116583.000002C2C5500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3107367797.000002C2C5554000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090770009.000002C2C553B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
https://signup.live.com/signup.aspx	svchost.exe, 00000026.00000003.3090811556.000002C2C5540000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000026.00000002.3746737495.000002C2C4C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3090852640.000002C2C5563000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd	svchost.exe, 00000026.00000002.3746653183.000002C2C4C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3107442635.000002C2C5557000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750444056.000002C2C5578000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.3750116583.000002C2C5500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000026.00000003.3107367797.000002C2C5554000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.106.174.220	vanaheim.cn	Russian Federation	50465	IQHOSTRU	true
40.93.207.5	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.101.40.29	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
40.93.207.1	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
98.136.96.74	mta6.am0.yahoodns.net	United States	36646	YAHOO-NE1US	true
67.195.204.74	unknown	United States	26101	YAHOO-3US	true
80.66.75.77	jotunheim.name	Russian Federation	20803	RISS-ASRU	true
40.93.212.0	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
104.47.54.36	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
104.47.53.36	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1322389
Start date and time:	2023-10-09 21:01:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@40/5@18/10
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 62 Number of non-executed functions: 259
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, MoUsoCoreWorker.exe
Excluded IPs from analysis (whitelisted): 20.231.239.246, 20.76.201.171, 20.70.246.20, 20.236.44.162, 20.112.250.133, 20.190.151.67, 20.190.151.68, 20.190.151.134, 20.190.151.131, 20.190.151.69, 20.190.151.133, 20.190.151.8, 20.190.151.6
Excluded domains from analysis (whitelisted): www.bing.com, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.trafficmanager.net, microsoft.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
21:02:56	API Interceptor	3x Sleep call for process: MpCmdRun.exe modified
21:03:01	API Interceptor	64254x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.106.174.220	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	NkQsS8A3sk.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
40.93.207.5	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta6.am0.yahoodns.net	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.106
	file.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	.exe	Get hash	malicious	Unknown	Browse	98.136.96.91
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	file.log.exe	Get hash	malicious	Unknown	Browse	67.195.228.94
	data.log.exe	Get hash	malicious	Unknown	Browse	67.195.228.109
	message.elm.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	message.txt.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	test.dat.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	Update-KB7390-x86.exe	Get hash	malicious	Unknown	Browse	67.195.228.110
	Update-KB6734-x86.exe	Get hash	malicious	Unknown	Browse	67.195.228.111
	Update-KB5058-x86.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	file.txt.exe	Get hash	malicious	Unknown	Browse	67.195.204.72
	Update-KB250-x86.exe	Get hash	malicious	Unknown	Browse	98.136.96.74
	Update-KB2984-x86.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	doc.msg.exe	Get hash	malicious	Unknown	Browse	67.195.228.94
	3hTS09wZ7G.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee	Browse	67.195.228.110
	DUpgpAnHkq.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee	Browse	67.195.204.73
	38fd2cb3083f33b50606b7821453769103bde24335734.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse	67.195.228.94
jotunheim.name	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	NkQsS8A3sk.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
IQHOSTRU	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	NkQsS8A3sk.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
	file.exe	Get hash	malicious	Tofsee	Browse	193.106.174.220
MICROSOFT-CORP-MSN-AS-BLOCKUS	SecuriteInfo.com.Trojan.Siggen21.37922.29840.21903.exe	Get hash	malicious	DBatLoader, FormBook	Browse	20.135.6.2
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	file.exe	Get hash	malicious	Tofsee	Browse	40.93.212.0
	Important cyeager@live-quinn.com Notification 10 6 2023 9 28 38 PM.eml	Get hash	malicious	Unknown	Browse	20.246.247.192
	Important cyeager@live-quinn.com Notification 10 6 2023 9 28 38 PM.eml	Get hash	malicious	Unknown	Browse	138.91.254.96
	New VM notifcation for lnorton@carollo.com (1).eml	Get hash	malicious	Unknown	Browse	52.109.8.89
	https://decatoria.com/eutt/?48528721	Get hash	malicious	DarkGate, MailPassView	Browse	20.189.173.22
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	http://smtplink.usssa.com/ls/click?upn=WSslNwXrfTzmOiygdbhyJ6-2FBkqSXpJKBo0qDJw7VpA0ad0aSHI26IfGEk6sZrui2d7xEV5p2HM-2FZHSkpQW3xrKZ2xzIHuxwBZnLTUHDoQao-3DOa19_4QyxBKDn7-2F0P3JvMNI1lbtONQP6csqkVplPiJT7H0rK0aBI5myixuE8nacygRshTZpU4i4qksvs3n-2BEcDBmM2yFUJR82k1Ru-2FEPJKOAg7OOszgeW93ALeDKuBxAGiPIvfw8D7EcQjomFj0t57CLf96XvI108CeM67vG57aoBJEqd8x2-2Bp5TBj3q5BqNV7eOGH8ZBHg-2Fyou5DZMpzZIY89fqFOTmD-2FY6nJaVJnmEXEQs-3D	Get hash	malicious	Unknown	Browse	13.107.213.69
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	50000PCSPIC12F1501-ESN.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.69
	https://p.feedblitz.com/t3/882921/109614235/13473938/https://viewfromthewing.com/airbnb-guest-stayed-500-nights-and-demanded-100000-to-leave-because-california/	Get hash	malicious	Unknown	Browse	40.76.134.238
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	ATT80942.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.213.71
	https://ariseaustinmedicalcenter-my.sharepoint.com/:b:/g/personal/bluetters_arisemedicalcenter_com/EReXmLwb075FnWYdal5H5qkBMJXjMe9RvK0odzhjwhjxHQ?e=4%3awrVXUi&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	13.107.136.10
	payment_62_mt103_03.10.2023_PDF.exe	Get hash	malicious	DBatLoader, FormBook	Browse	20.119.0.38
	https://bitbucket.org/flctloading/flctplus/downloads/_00-59-voicemail.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	Hv-X-0008938_LOI_po.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	13.107.213.69
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	EPtVmZ90nq.elf	Get hash	malicious	Mirai	Browse	20.176.186.158
MICROSOFT-CORP-MSN-AS-BLOCKUS	SecuriteInfo.com.Trojan.Siggen21.37922.29840.21903.exe	Get hash	malicious	DBatLoader, FormBook	Browse	20.135.6.2
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	file.exe	Get hash	malicious	Tofsee	Browse	40.93.212.0
	Important cyeager@live-quinn.com Notification 10 6 2023 9 28 38 PM.eml	Get hash	malicious	Unknown	Browse	20.246.247.192
	Important cyeager@live-quinn.com Notification 10 6 2023 9 28 38 PM.eml	Get hash	malicious	Unknown	Browse	138.91.254.96
	New VM notifcation for lnorton@carollo.com (1).eml	Get hash	malicious	Unknown	Browse	52.109.8.89
	https://decatoria.com/eutt/?48528721	Get hash	malicious	DarkGate, MailPassView	Browse	20.189.173.22
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	http://smtplink.usssa.com/ls/click?upn=WSslNwXrfTzmOiygdbhyJ6-2FBkqSXpJKBo0qDJw7VpA0ad0aSHI26IfGEk6sZrui2d7xEV5p2HM-2FZHSkpQW3xrKZ2xzIHuxwBZnLTUHDoQao-3DOa19_4QyxBKDn7-2F0P3JvMNI1lbtONQP6csqkVplPiJT7H0rK0aBI5myixuE8nacygRshTZpU4i4qksvs3n-2BEcDBmM2yFUJR82k1Ru-2FEPJKOAg7OOszgeW93ALeDKuBxAGiPIvfw8D7EcQjomFj0t57CLf96XvI108CeM67vG57aoBJEqd8x2-2Bp5TBj3q5BqNV7eOGH8ZBHg-2Fyou5DZMpzZIY89fqFOTmD-2FY6nJaVJnmEXEQs-3D	Get hash	malicious	Unknown	Browse	13.107.213.69
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	50000PCSPIC12F1501-ESN.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.69
	https://p.feedblitz.com/t3/882921/109614235/13473938/https://viewfromthewing.com/airbnb-guest-stayed-500-nights-and-demanded-100000-to-leave-because-california/	Get hash	malicious	Unknown	Browse	40.76.134.238
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	ATT80942.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.213.71
	https://ariseaustinmedicalcenter-my.sharepoint.com/:b:/g/personal/bluetters_arisemedicalcenter_com/EReXmLwb075FnWYdal5H5qkBMJXjMe9RvK0odzhjwhjxHQ?e=4%3awrVXUi&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	13.107.136.10
	payment_62_mt103_03.10.2023_PDF.exe	Get hash	malicious	DBatLoader, FormBook	Browse	20.119.0.38
	https://bitbucket.org/flctloading/flctplus/downloads/_00-59-voicemail.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	Hv-X-0008938_LOI_po.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	13.107.213.69
	file.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	EPtVmZ90nq.elf	Get hash	malicious	Mirai	Browse	20.176.186.158

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966151115193747
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLnpHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGdp8HGuDyeHRuDye6MGFiP6euy
MD5:	930C5CE56CF8362E865E239EE3C1C67F
SHA1:	80E710A28E3E5D5A2C752F9565C4459405104CE5
SHA-256:	8B23DE7203E719FD08DB0B06C4A409834D6BD78467DAABDA430E6D606EB7D9DF
SHA-512:	1C992F403F6186A247E38FCFE3319D086859595C5C815907178596ADB9F5707A1967447EB4A896AF1A3531B66A237AB1B730F0AC1754996327152A03E7E7C7DB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.3393</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>3393</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\Users\user\AppData\Local\Temp\wdkncqjt.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13209600
Entropy (8bit):	2.868643584614283
Encrypted:	false
SSDEEP:	6144:xfua5zK5RPslwCxS0A5TsIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIr:xf9k5Fzsc
MD5:	B11DD4A2DA4ABF719066A2DB8F95983F
SHA1:	618AB3A3FB31B4B557485D432B6B1B08416BA96F
SHA-256:	E812FBBDF9C76527B4FCDFA37DB853F7341857228804913FFBE6631F54F4089D
SHA-512:	2F5565247A63B804CDBD3E292241AFB2B05C6C70AA76FD7ED1055881751B3D2CD1945DE62AC58EB9E0A21259DB82BD48BE342B210EC4DDF2032E39DFFA19E2CC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.%.z.K.z.K.z.K.d...f.K.d.....K.d...J.K.].0.s.K.z.J...K.d...{.K.d...{.K.d...{.K.Richz.K.................PE..L...@..b....................."......kZ............@..................................L.........................................d.......h........................... ................................H..@............................................text....~.......................... ..`.data...pb..........................@....rsrc...h...........................@..@.reloc..6).......Z...6..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe
File Type:	data
Category:	modified
Size (bytes):	2546
Entropy (8bit):	3.2785459853693073
Encrypted:	false
SSDEEP:	24:Oaq/Fa4F3r/ItW+kWReHrgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIm:Oaqdz7/Iw+AHEHdKoqKFxcxkFNIW
MD5:	390C586AF2CFA46D08D457D17A484E54
SHA1:	8F1294DE33A0011748615D3B152148D57F3F218E
SHA-256:	175776A9EB3D5DCB3531F3E4CCDFAA3E7B9278BCBC13A39115FBB4AA4CEFC42B
SHA-512:	F165C207799B312E6F51794C8EF07186E5E0BC256294F0ADEC2213BE5F59A18ADC4E843776BAC45DAD6CA1910A764B882BDD12C06F1FA877B464FAD1F1DE9661
Malicious:	false
Preview:	........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.P.l.a.t.f.o.r.m.\.4...1.8...2.3.0.9.0...2.0.0.8.-.0.\.M.p.C.m.d.R.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. M.o.n. .. O.c.t. .. 0.9. .. 2.0.2.3. .2.1.:.0.2.:.5.6.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.(.0.x.5.).:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.

C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13209600
Entropy (8bit):	2.868643584614283
Encrypted:	false
SSDEEP:	6144:xfua5zK5RPslwCxS0A5TsIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIr:xf9k5Fzsc
MD5:	B11DD4A2DA4ABF719066A2DB8F95983F
SHA1:	618AB3A3FB31B4B557485D432B6B1B08416BA96F
SHA-256:	E812FBBDF9C76527B4FCDFA37DB853F7341857228804913FFBE6631F54F4089D
SHA-512:	2F5565247A63B804CDBD3E292241AFB2B05C6C70AA76FD7ED1055881751B3D2CD1945DE62AC58EB9E0A21259DB82BD48BE342B210EC4DDF2032E39DFFA19E2CC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.%.z.K.z.K.z.K.d...f.K.d.....K.d...J.K.].0.s.K.z.J...K.d...{.K.d...{.K.d...{.K.Richz.K.................PE..L...@..b....................."......kZ............@..................................L.........................................d.......h........................... ................................H..@............................................text....~.......................... ..`.data...pb..........................@....rsrc...h...........................@..@.reloc..6).......Z...6..............@..B........................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.951067853005325
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	221'184 bytes
MD5:	21c68b05ac982cff12afcb9af3a5657d
SHA1:	3651d8e4e0fdc66c1f888e34337ae2c13cb9b904
SHA256:	19a4f6df26db3df254ccf6270b2abe2ef6bcf86264cd17acaa5a46995672bbe4
SHA512:	734382f3432b09248f02799b1ada19787fd29402164a551494c7197f3b45a2527edf1e5b44a907f7cda70b04351acbc547c309f31f8c4347cc16a059a24a8131
SSDEEP:	3072:jHXfua5zpSxP5RcWrYlwRabrTRqQxSCcSd5PYe5OT99c:rfua5zK5RPslwCxS0A5Ts
TLSH:	A424BF217442D4B2C41741748824CAF4B97A7C729B994A8737A83FBF7E3139F676A306
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.%.z.K.z.K.z.K.d...f.K.d.....K.d...J.K.].0.s.K.z.J...K.d...{.K.d...{.K.d...{.K.Richz.K.................PE..L...@..b...........

File Icon


Icon Hash:	4149495515594519

Static PE Info

General

Entrypoint:	0x405a6b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x62AAFB40 [Thu Jun 16 09:43:28 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	3237b581b15be84c5fe874ddf55fe383

Entrypoint Preview

Instruction
call 00007F30AD32064Eh
jmp 00007F30AD31C22Dh
push 00000008h
push 00428008h
call 00007F30AD31D4E0h
mov ecx, dword ptr [ebp+08h]
test ecx, ecx
je 00007F30AD31C3DCh
cmp dword ptr [ecx], E06D7363h
jne 00007F30AD31C3D4h
mov eax, dword ptr [ecx+1Ch]
test eax, eax
je 00007F30AD31C3CDh
mov eax, dword ptr [eax+04h]
test eax, eax
je 00007F30AD31C3C6h
and dword ptr [ebp-04h], 00000000h
push eax
push dword ptr [ecx+18h]
call 00007F30AD3206F6h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F30AD31D4EFh
ret
xor eax, eax
cmp byte ptr [ebp+0Ch], al
setne al
ret
mov esp, dword ptr [ebp-18h]
call 00007F30AD31C156h
int3
call 00007F30AD31E46Fh
xor ecx, ecx
cmp dword ptr [eax+00000090h], ecx
setne cl
mov al, cl
ret
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword ptr [ebp+0Ch]
push esi
call 00007F30AD31D27Bh
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [esi+0Ch]
pop ecx
test al, 82h
jne 00007F30AD31C3C9h
call 00007F30AD31C698h
mov dword ptr [eax], 00000009h
or dword ptr [esi+0Ch], 20h
or eax, FFFFFFFFh
jmp 00007F30AD31C4E4h
test al, 40h
je 00007F30AD31C3BFh
call 00007F30AD31C67Dh
mov dword ptr [eax], 00000022h
jmp 00007F30AD31C395h
push ebx
xor ebx, ebx
test al, 01h
je 00007F30AD31C3C8h
mov dword ptr [esi+04h], ebx
test al, 10h
je 00007F30AD31C43Dh

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x283e4	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a0000	0x9268	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1aa000	0xc84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1220	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4800	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1d8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x27ec2	0x28000	False	0.793011474609375	data	7.56497347195729	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x29000	0x176270	0x1e00	False	0.240234375	data	2.5028686123566812	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a0000	0x9268	0x9400	False	0.34245671452702703	data	4.357529473181734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1aa000	0x2936	0x2a00	False	0.25790550595238093	data	2.769105373898482	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1a5628	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.27238805970149255
RT_CURSOR	0x1a64d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.375
RT_CURSOR	0x1a6d78	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.5057803468208093
RT_CURSOR	0x1a7310	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.30943496801705755
RT_CURSOR	0x1a81b8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.427797833935018
RT_CURSOR	0x1a8a60	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.5469653179190751
RT_ICON	0x1a03a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.35927505330490406
RT_ICON	0x1a1248	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.4697653429602888
RT_ICON	0x1a1af0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.46431535269709545
RT_ICON	0x1a4098	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.47209193245778613
RT_ICON	0x1a5140	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.49379432624113473
RT_ACCELERATOR	0x1a55f8	0x30	data	English	United States	0.9375
RT_GROUP_CURSOR	0x1a72e0	0x30	data	English	United States	0.9166666666666666
RT_GROUP_CURSOR	0x1a8fc8	0x30	data	English	United States	0.9375
RT_GROUP_ICON	0x1a55a8	0x4c	data	English	United States	0.75
RT_VERSION	0x1a8ff8	0x270	data	English	United States	0.5208333333333334

Imports

DLL	Import
KERNEL32.dll	InterlockedCompareExchange, WriteConsoleInputA, AddConsoleAliasW, SetVolumeMountPointW, FreeEnvironmentStringsA, _lclose, GetProcessPriorityBoost, GetTickCount, GetNumberFormatA, GetWindowsDirectoryA, GetCompressedFileSizeW, GlobalAlloc, LoadLibraryW, AssignProcessToJobObject, EnumSystemCodePagesA, FindNextVolumeW, GetFileAttributesW, CreateActCtxA, GetLastError, GetProcAddress, VirtualAlloc, PeekConsoleInputW, RemoveDirectoryA, GetSystemWindowsDirectoryW, LoadLibraryA, CreateHardLinkW, BeginUpdateResourceA, GetCommMask, AddAtomA, FoldStringA, GlobalFindAtomW, GetOEMCP, OpenFileMappingW, FindNextFileW, EndUpdateResourceA, GetCurrentProcessId, ReadConsoleOutputCharacterW, LocalFree, ReadFile, GetProcessHeap, SetEndOfFile, LoadResource, PeekNamedPipe, SetComputerNameA, FillConsoleOutputCharacterA, MultiByteToWideChar, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, HeapFree, WideCharToMultiByte, SetHandleCount, GetStdHandle, GetFileType, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, IsValidCodePage, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, Sleep, HeapSize, ExitProcess, RtlUnwind, RaiseException, WriteFile, GetModuleFileNameA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapCreate, VirtualFree, QueryPerformanceCounter, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, HeapReAlloc, InitializeCriticalSectionAndSpinCount, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, CloseHandle, CreateFileA, GetModuleHandleA, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, FlushFileBuffers
USER32.dll	CharToOemBuffA, ChangeDisplaySettingsW, PostMessageW, LoadMenuA, GetWindowTextLengthW
GDI32.dll	GetCharacterPlacementA, GetPolyFillMode
ADVAPI32.dll	BackupEventLogW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2023 21:02:28.165638924 CEST	49714	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:02:28.394243002 CEST	25	49714	40.93.207.5	192.168.2.3
Oct 9, 2023 21:02:28.394440889 CEST	49714	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:02:28.394665003 CEST	49714	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:02:28.622395039 CEST	25	49714	40.93.207.5	192.168.2.3
Oct 9, 2023 21:02:28.624763012 CEST	25	49714	40.93.207.5	192.168.2.3
Oct 9, 2023 21:02:28.625319958 CEST	25	49714	40.93.207.5	192.168.2.3
Oct 9, 2023 21:02:28.625602961 CEST	49714	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:02:28.625603914 CEST	49714	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:02:31.612354040 CEST	49715	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:02:31.612406969 CEST	443	49715	193.106.174.220	192.168.2.3
Oct 9, 2023 21:02:31.612474918 CEST	49715	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:03:11.625109911 CEST	49715	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:03:11.625381947 CEST	443	49715	193.106.174.220	192.168.2.3
Oct 9, 2023 21:03:11.626451969 CEST	49715	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:03:11.735172033 CEST	49717	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:03:11.735203028 CEST	443	49717	193.106.174.220	192.168.2.3
Oct 9, 2023 21:03:11.735373974 CEST	49717	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:03:37.523569107 CEST	49719	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:37.747534037 CEST	25	49719	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:37.747839928 CEST	49719	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:37.747939110 CEST	49719	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:37.971501112 CEST	25	49719	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:37.973424911 CEST	25	49719	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:37.973515034 CEST	49719	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:37.973988056 CEST	25	49719	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:37.974050999 CEST	49719	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:38.858182907 CEST	49721	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:39.082415104 CEST	25	49721	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:39.082531929 CEST	49721	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:39.082881927 CEST	49721	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:39.306273937 CEST	25	49721	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:39.309248924 CEST	25	49721	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:39.309309959 CEST	49721	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:39.309974909 CEST	25	49721	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:39.310022116 CEST	49721	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:40.402002096 CEST	49723	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:40.630193949 CEST	25	49723	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:40.630368948 CEST	49723	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:40.630673885 CEST	49723	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:40.858059883 CEST	25	49723	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:40.860481977 CEST	25	49723	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:40.860682011 CEST	49723	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:40.860944033 CEST	25	49723	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:40.861016989 CEST	49723	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:42.967510939 CEST	49725	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:43.191179991 CEST	25	49725	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:43.191394091 CEST	49725	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:43.191526890 CEST	49725	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:43.415097952 CEST	25	49725	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:43.417088032 CEST	25	49725	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:43.417256117 CEST	49725	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:43.417668104 CEST	25	49725	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:43.417727947 CEST	49725	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:44.263802052 CEST	49727	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:44.487441063 CEST	25	49727	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:44.487620115 CEST	49727	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:44.488079071 CEST	49727	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:44.711230040 CEST	25	49727	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:44.713330030 CEST	25	49727	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:44.713396072 CEST	49727	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:44.713905096 CEST	25	49727	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:44.713953018 CEST	49727	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:45.697401047 CEST	49729	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:45.921560049 CEST	25	49729	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:45.921888113 CEST	49729	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:45.922240019 CEST	49729	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:46.146013021 CEST	25	49729	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:46.148380995 CEST	25	49729	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:46.148452997 CEST	49729	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:46.149599075 CEST	25	49729	40.93.207.1	192.168.2.3
Oct 9, 2023 21:03:46.149653912 CEST	49729	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:03:47.356520891 CEST	49731	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:47.564575911 CEST	25	49731	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:47.564946890 CEST	49731	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:47.565438986 CEST	49731	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:47.772838116 CEST	25	49731	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:47.799685955 CEST	25	49731	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:47.799911976 CEST	49731	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:47.800296068 CEST	25	49731	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:47.800357103 CEST	49731	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:48.823848963 CEST	49733	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:49.032001972 CEST	25	49733	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:49.032269001 CEST	49733	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:49.033145905 CEST	49733	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:49.240401983 CEST	25	49733	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:49.242321014 CEST	25	49733	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:49.242547989 CEST	49733	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:49.242916107 CEST	25	49733	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:49.243108988 CEST	49733	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:50.321916103 CEST	49735	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:50.529984951 CEST	25	49735	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:50.530234098 CEST	49735	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:50.531089067 CEST	49735	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:50.738662004 CEST	25	49735	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:50.740894079 CEST	25	49735	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:50.741086006 CEST	49735	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:50.741410017 CEST	25	49735	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:50.741481066 CEST	49735	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:51.749885082 CEST	49717	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:03:51.749943972 CEST	443	49717	193.106.174.220	192.168.2.3
Oct 9, 2023 21:03:51.750037909 CEST	49717	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:03:51.828109980 CEST	49737	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:51.860044003 CEST	49738	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:03:51.860116005 CEST	443	49738	193.106.174.220	192.168.2.3
Oct 9, 2023 21:03:51.860214949 CEST	49738	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:03:52.035895109 CEST	25	49737	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:52.036099911 CEST	49737	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:52.037112951 CEST	49737	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:52.245007992 CEST	25	49737	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:52.246368885 CEST	25	49737	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:52.246495008 CEST	49737	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:52.246772051 CEST	25	49737	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:52.246865988 CEST	49737	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:53.183600903 CEST	49740	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:53.391233921 CEST	25	49740	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:53.391383886 CEST	49740	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:53.392318010 CEST	49740	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:53.599447966 CEST	25	49740	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:53.601526022 CEST	25	49740	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:53.601608038 CEST	49740	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:53.602185965 CEST	25	49740	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:53.602354050 CEST	49740	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:54.660190105 CEST	49742	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:54.869772911 CEST	25	49742	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:54.870009899 CEST	49742	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:54.870973110 CEST	49742	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:55.078191996 CEST	25	49742	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:55.079722881 CEST	25	49742	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:55.079803944 CEST	49742	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:55.080598116 CEST	25	49742	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:55.080660105 CEST	49742	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:56.049245119 CEST	49744	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:56.257451057 CEST	25	49744	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:56.257608891 CEST	49744	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:56.258445024 CEST	49744	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:56.466490984 CEST	25	49744	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:56.468019962 CEST	25	49744	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:56.468110085 CEST	49744	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:56.468632936 CEST	25	49744	40.93.212.0	192.168.2.3
Oct 9, 2023 21:03:56.468694925 CEST	49744	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:03:57.940056086 CEST	49746	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:03:58.147835970 CEST	25	49746	104.47.54.36	192.168.2.3
Oct 9, 2023 21:03:58.148020983 CEST	49746	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:03:58.148968935 CEST	49746	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:03:58.356200933 CEST	25	49746	104.47.54.36	192.168.2.3
Oct 9, 2023 21:03:58.710621119 CEST	25	49746	104.47.54.36	192.168.2.3
Oct 9, 2023 21:03:58.710731983 CEST	49746	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:03:58.711529016 CEST	25	49746	104.47.54.36	192.168.2.3
Oct 9, 2023 21:03:58.711590052 CEST	49746	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:03:59.313977957 CEST	49748	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:03:59.521528006 CEST	25	49748	104.47.54.36	192.168.2.3
Oct 9, 2023 21:03:59.521724939 CEST	49748	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:03:59.521956921 CEST	49748	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:03:59.729371071 CEST	25	49748	104.47.54.36	192.168.2.3
Oct 9, 2023 21:03:59.732928038 CEST	25	49748	104.47.54.36	192.168.2.3
Oct 9, 2023 21:03:59.733019114 CEST	49748	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:03:59.734107018 CEST	25	49748	104.47.54.36	192.168.2.3
Oct 9, 2023 21:03:59.734162092 CEST	49748	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:00.545437098 CEST	49750	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:00.753427982 CEST	25	49750	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:00.753588915 CEST	49750	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:00.753899097 CEST	49750	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:00.961282969 CEST	25	49750	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:01.313339949 CEST	25	49750	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:01.313422918 CEST	49750	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:01.314342976 CEST	25	49750	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:01.314599991 CEST	49750	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:01.837402105 CEST	49752	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:02.045052052 CEST	25	49752	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:02.045273066 CEST	49752	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:02.046075106 CEST	49752	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:02.253452063 CEST	25	49752	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:02.255928040 CEST	25	49752	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:02.255976915 CEST	49752	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:02.257328987 CEST	25	49752	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:02.257375956 CEST	49752	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:03.078074932 CEST	49754	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:03.286081076 CEST	25	49754	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:03.286286116 CEST	49754	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:03.287154913 CEST	49754	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:03.495909929 CEST	25	49754	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:03.849586964 CEST	25	49754	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:03.849698067 CEST	49754	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:03.851011038 CEST	25	49754	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:03.851084948 CEST	49754	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:04.522479057 CEST	49756	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:04.730040073 CEST	25	49756	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:04.730289936 CEST	49756	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:04.730381012 CEST	49756	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:04.937789917 CEST	25	49756	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:04.940988064 CEST	25	49756	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:04.941234112 CEST	49756	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:04.942306995 CEST	25	49756	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:04.942374945 CEST	49756	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:05.785501003 CEST	49758	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:05.993303061 CEST	25	49758	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:05.993822098 CEST	49758	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:05.994527102 CEST	49758	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:06.202008963 CEST	25	49758	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:06.204778910 CEST	25	49758	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:06.204977036 CEST	49758	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:06.206151962 CEST	25	49758	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:06.206316948 CEST	49758	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:06.985426903 CEST	49760	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:07.193551064 CEST	25	49760	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:07.193634987 CEST	49760	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:07.193852901 CEST	49760	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:07.401415110 CEST	25	49760	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:07.404645920 CEST	25	49760	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:07.404711008 CEST	49760	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:07.405818939 CEST	25	49760	104.47.54.36	192.168.2.3
Oct 9, 2023 21:04:07.405869961 CEST	49760	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:04:08.450629950 CEST	49762	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:08.674782991 CEST	25	49762	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:08.674905062 CEST	49762	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:08.675267935 CEST	49762	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:08.898835897 CEST	25	49762	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:08.900469065 CEST	25	49762	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:08.900543928 CEST	49762	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:08.901074886 CEST	25	49762	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:08.901124954 CEST	49762	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:09.849863052 CEST	49764	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:10.077795982 CEST	25	49764	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:10.078011990 CEST	49764	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:10.078298092 CEST	49764	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:10.306461096 CEST	25	49764	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:10.308058023 CEST	25	49764	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:10.308128119 CEST	49764	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:10.308660030 CEST	25	49764	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:10.308713913 CEST	49764	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:11.247617960 CEST	49766	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:11.471761942 CEST	25	49766	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:11.471846104 CEST	49766	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:11.472084045 CEST	49766	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:11.695768118 CEST	25	49766	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:11.698175907 CEST	25	49766	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:11.698301077 CEST	49766	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:11.699279070 CEST	25	49766	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:11.699367046 CEST	49766	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:12.650161982 CEST	49768	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:12.873867989 CEST	25	49768	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:12.874027014 CEST	49768	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:12.874762058 CEST	49768	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:13.098664045 CEST	25	49768	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:13.099709034 CEST	25	49768	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:13.099809885 CEST	49768	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:13.100425959 CEST	25	49768	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:13.100486994 CEST	49768	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:14.008416891 CEST	49770	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:14.236382008 CEST	25	49770	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:14.236711979 CEST	49770	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:14.236979961 CEST	49770	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:14.466748953 CEST	25	49770	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:14.467812061 CEST	25	49770	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:14.468035936 CEST	49770	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:14.468359947 CEST	25	49770	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:14.468420029 CEST	49770	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:15.488415956 CEST	49772	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:15.716542959 CEST	25	49772	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:15.716953993 CEST	49772	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:15.717775106 CEST	49772	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:15.945280075 CEST	25	49772	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:15.946964979 CEST	25	49772	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:15.947093964 CEST	49772	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:15.947843075 CEST	25	49772	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:15.947926044 CEST	49772	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:16.975596905 CEST	49774	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:17.203706026 CEST	25	49774	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:17.203880072 CEST	49774	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:17.204653025 CEST	49774	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:17.432710886 CEST	25	49774	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:17.435250044 CEST	25	49774	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:17.435452938 CEST	49774	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:17.436290979 CEST	25	49774	40.93.207.1	192.168.2.3
Oct 9, 2023 21:04:17.436394930 CEST	49774	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:04:18.563113928 CEST	49776	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:18.771605015 CEST	25	49776	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:18.771747112 CEST	49776	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:18.772000074 CEST	49776	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:18.979614973 CEST	25	49776	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:18.981692076 CEST	25	49776	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:18.981796980 CEST	49776	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:18.982372046 CEST	25	49776	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:18.982448101 CEST	49776	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:19.786813974 CEST	49778	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:19.994802952 CEST	25	49778	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:19.994899988 CEST	49778	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:19.995111942 CEST	49778	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:20.203166962 CEST	25	49778	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:20.204605103 CEST	25	49778	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:20.204678059 CEST	49778	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:20.205260038 CEST	25	49778	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:20.205401897 CEST	49778	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:21.059871912 CEST	49780	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:21.268219948 CEST	25	49780	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:21.268352032 CEST	49780	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:21.268665075 CEST	49780	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:21.476824999 CEST	25	49780	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:21.478930950 CEST	25	49780	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:21.479006052 CEST	49780	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:21.479504108 CEST	25	49780	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:21.479554892 CEST	49780	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:22.275074005 CEST	49782	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:22.482856035 CEST	25	49782	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:22.483099937 CEST	49782	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:22.489255905 CEST	49782	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:22.693321943 CEST	25	49782	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:22.693546057 CEST	49782	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:22.696849108 CEST	25	49782	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:22.696909904 CEST	49782	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:22.697310925 CEST	25	49782	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:22.697350979 CEST	49782	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:23.463258028 CEST	49784	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:23.673840046 CEST	25	49784	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:23.674114943 CEST	49784	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:23.674866915 CEST	49784	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:23.882630110 CEST	25	49784	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:23.884661913 CEST	25	49784	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:23.884723902 CEST	49784	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:23.885137081 CEST	25	49784	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:23.885185003 CEST	49784	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:24.875777960 CEST	49786	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:25.084500074 CEST	25	49786	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:25.084703922 CEST	49786	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:25.085500956 CEST	49786	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:25.292848110 CEST	25	49786	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:25.295798063 CEST	25	49786	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:25.295880079 CEST	49786	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:25.295892000 CEST	25	49786	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:25.295962095 CEST	49786	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:26.272777081 CEST	49788	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:26.480968952 CEST	25	49788	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:26.481280088 CEST	49788	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:26.481369972 CEST	49788	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:26.689290047 CEST	25	49788	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:26.691509008 CEST	25	49788	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:26.691571951 CEST	49788	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:26.692019939 CEST	25	49788	40.93.212.0	192.168.2.3
Oct 9, 2023 21:04:26.692066908 CEST	49788	25	192.168.2.3	40.93.212.0
Oct 9, 2023 21:04:30.433305025 CEST	49790	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:30.657329082 CEST	25	49790	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:30.657659054 CEST	49790	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:30.658375025 CEST	49790	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:30.882040977 CEST	25	49790	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:30.883565903 CEST	25	49790	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:30.883739948 CEST	49790	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:30.884100914 CEST	25	49790	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:30.884182930 CEST	49790	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:31.679903030 CEST	49792	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:31.859193087 CEST	49738	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:04:31.859325886 CEST	443	49738	193.106.174.220	192.168.2.3
Oct 9, 2023 21:04:31.859586000 CEST	49738	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:04:31.904306889 CEST	25	49792	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:31.904401064 CEST	49792	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:31.904943943 CEST	49792	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:31.969194889 CEST	49793	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:04:31.969285965 CEST	443	49793	193.106.174.220	192.168.2.3
Oct 9, 2023 21:04:31.969393969 CEST	49793	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:04:32.130059958 CEST	25	49792	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:32.130721092 CEST	25	49792	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:32.130830050 CEST	49792	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:32.131499052 CEST	25	49792	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:32.131664991 CEST	49792	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:32.939619064 CEST	49795	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:33.168325901 CEST	25	49795	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:33.168421030 CEST	49795	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:33.168670893 CEST	49795	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:33.396204948 CEST	25	49795	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:33.398545027 CEST	25	49795	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:33.398636103 CEST	49795	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:33.399169922 CEST	25	49795	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:33.399230003 CEST	49795	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:34.168802023 CEST	49797	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:34.396637917 CEST	25	49797	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:34.396728992 CEST	49797	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:34.396951914 CEST	49797	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:34.624660015 CEST	25	49797	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:34.626475096 CEST	25	49797	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:34.626580954 CEST	49797	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:34.627053022 CEST	25	49797	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:34.627140045 CEST	49797	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:35.466730118 CEST	49799	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:35.694641113 CEST	25	49799	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:35.694725990 CEST	49799	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:35.695199966 CEST	49799	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:35.922878981 CEST	25	49799	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:35.924674034 CEST	25	49799	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:35.924736023 CEST	49799	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:35.925386906 CEST	25	49799	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:35.925436020 CEST	49799	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:36.770287037 CEST	49801	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:36.998550892 CEST	25	49801	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:36.998812914 CEST	49801	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:36.999840975 CEST	49801	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:37.227411985 CEST	25	49801	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:37.228729010 CEST	25	49801	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:37.229027987 CEST	49801	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:37.229409933 CEST	25	49801	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:37.229471922 CEST	49801	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:38.032480955 CEST	49803	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:38.256530046 CEST	25	49803	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:38.256624937 CEST	49803	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:38.256855965 CEST	49803	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:38.480377913 CEST	25	49803	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:38.483428955 CEST	25	49803	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:38.483509064 CEST	49803	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:38.487401009 CEST	25	49803	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:38.487462044 CEST	49803	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:39.308057070 CEST	49805	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:39.532669067 CEST	25	49805	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:39.532865047 CEST	49805	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:39.533163071 CEST	49805	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:39.757419109 CEST	25	49805	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:39.759342909 CEST	25	49805	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:39.759494066 CEST	49805	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:39.759815931 CEST	25	49805	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:39.759907007 CEST	49805	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:40.803009033 CEST	49807	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:41.031126022 CEST	25	49807	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:41.031328917 CEST	49807	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:41.032154083 CEST	49807	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:41.259635925 CEST	25	49807	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:41.261710882 CEST	25	49807	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:41.261790037 CEST	49807	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:41.262347937 CEST	25	49807	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:41.262501001 CEST	49807	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:42.098459005 CEST	49809	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:42.326813936 CEST	25	49809	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:42.327007055 CEST	49809	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:42.327239037 CEST	49809	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:42.554846048 CEST	25	49809	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:42.557807922 CEST	25	49809	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:42.557898045 CEST	49809	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:42.558615923 CEST	25	49809	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:42.558788061 CEST	49809	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:43.320637941 CEST	49811	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:43.548999071 CEST	25	49811	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:43.549107075 CEST	49811	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:43.549315929 CEST	49811	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:43.776928902 CEST	25	49811	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:43.779781103 CEST	25	49811	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:43.779875040 CEST	49811	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:43.780349016 CEST	25	49811	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:43.780414104 CEST	49811	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:44.523058891 CEST	49813	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:44.751136065 CEST	25	49813	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:44.751332045 CEST	49813	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:44.751851082 CEST	49813	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:44.979768038 CEST	25	49813	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:44.982021093 CEST	25	49813	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:44.982110023 CEST	49813	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:44.982610941 CEST	25	49813	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:44.982670069 CEST	49813	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:45.911843061 CEST	49815	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:46.136178017 CEST	25	49815	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:46.136285067 CEST	49815	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:46.136492014 CEST	49815	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:46.361594915 CEST	25	49815	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:46.363997936 CEST	25	49815	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:46.364196062 CEST	49815	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:46.364609003 CEST	25	49815	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:46.364775896 CEST	49815	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:48.490364075 CEST	49817	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:48.718758106 CEST	25	49817	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:48.718923092 CEST	49817	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:48.719845057 CEST	49817	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:48.948437929 CEST	25	49817	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:48.948822975 CEST	25	49817	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:48.948887110 CEST	49817	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:48.949362993 CEST	25	49817	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:48.949414968 CEST	49817	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:49.925803900 CEST	49819	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:50.154172897 CEST	25	49819	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:50.154313087 CEST	49819	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:50.155157089 CEST	49819	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:50.382572889 CEST	25	49819	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:50.384640932 CEST	25	49819	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:50.384743929 CEST	49819	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:50.385365963 CEST	25	49819	40.93.207.5	192.168.2.3
Oct 9, 2023 21:04:50.385422945 CEST	49819	25	192.168.2.3	40.93.207.5
Oct 9, 2023 21:04:51.510654926 CEST	49821	25	192.168.2.3	52.101.40.29
Oct 9, 2023 21:04:52.515161991 CEST	49821	25	192.168.2.3	52.101.40.29
Oct 9, 2023 21:04:54.530663967 CEST	49821	25	192.168.2.3	52.101.40.29
Oct 9, 2023 21:04:58.530685902 CEST	49821	25	192.168.2.3	52.101.40.29
Oct 9, 2023 21:05:06.530863047 CEST	49821	25	192.168.2.3	52.101.40.29
Oct 9, 2023 21:05:11.846960068 CEST	49824	25	192.168.2.3	98.136.96.74
Oct 9, 2023 21:05:11.984307051 CEST	49793	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:05:11.984527111 CEST	443	49793	193.106.174.220	192.168.2.3
Oct 9, 2023 21:05:11.984711885 CEST	49793	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:05:12.063853979 CEST	25	49824	98.136.96.74	192.168.2.3
Oct 9, 2023 21:05:12.063966036 CEST	49824	25	192.168.2.3	98.136.96.74
Oct 9, 2023 21:05:12.064312935 CEST	49824	25	192.168.2.3	98.136.96.74
Oct 9, 2023 21:05:12.110371113 CEST	49825	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:05:12.110471964 CEST	443	49825	193.106.174.220	192.168.2.3
Oct 9, 2023 21:05:12.110543013 CEST	49825	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:05:12.281253099 CEST	25	49824	98.136.96.74	192.168.2.3
Oct 9, 2023 21:05:12.417845011 CEST	25	49824	98.136.96.74	192.168.2.3
Oct 9, 2023 21:05:12.417897940 CEST	25	49824	98.136.96.74	192.168.2.3
Oct 9, 2023 21:05:12.418039083 CEST	49824	25	192.168.2.3	98.136.96.74
Oct 9, 2023 21:05:12.418039083 CEST	49824	25	192.168.2.3	98.136.96.74
Oct 9, 2023 21:05:13.318557978 CEST	49827	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:14.328012943 CEST	49827	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:14.556468964 CEST	25	49827	40.93.207.1	192.168.2.3
Oct 9, 2023 21:05:14.556602001 CEST	49827	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:14.556886911 CEST	49827	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:14.785638094 CEST	25	49827	40.93.207.1	192.168.2.3
Oct 9, 2023 21:05:15.593945980 CEST	49829	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:16.419312954 CEST	25	49827	40.93.207.1	192.168.2.3
Oct 9, 2023 21:05:16.419528961 CEST	49827	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:16.419728994 CEST	25	49827	40.93.207.1	192.168.2.3
Oct 9, 2023 21:05:16.419792891 CEST	49827	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:16.593126059 CEST	49829	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:18.594649076 CEST	49829	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:22.608726978 CEST	49829	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:30.608932972 CEST	49829	25	192.168.2.3	40.93.207.1
Oct 9, 2023 21:05:35.774090052 CEST	49835	25	192.168.2.3	67.195.204.74
Oct 9, 2023 21:05:36.020003080 CEST	25	49835	67.195.204.74	192.168.2.3
Oct 9, 2023 21:05:36.020226002 CEST	49835	25	192.168.2.3	67.195.204.74
Oct 9, 2023 21:05:36.020333052 CEST	49835	25	192.168.2.3	67.195.204.74
Oct 9, 2023 21:05:36.266609907 CEST	25	49835	67.195.204.74	192.168.2.3
Oct 9, 2023 21:05:36.330264091 CEST	25	49835	67.195.204.74	192.168.2.3
Oct 9, 2023 21:05:36.330282927 CEST	25	49835	67.195.204.74	192.168.2.3
Oct 9, 2023 21:05:36.330457926 CEST	49835	25	192.168.2.3	67.195.204.74
Oct 9, 2023 21:05:36.330558062 CEST	49835	25	192.168.2.3	67.195.204.74
Oct 9, 2023 21:05:37.203864098 CEST	49838	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:37.431849957 CEST	25	49838	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:37.432055950 CEST	49838	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:37.461106062 CEST	49838	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:37.663113117 CEST	25	49838	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:37.663182020 CEST	49838	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:37.689028025 CEST	25	49838	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:37.689106941 CEST	49838	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:37.689938068 CEST	25	49838	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:37.690021992 CEST	49838	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:39.903536081 CEST	49842	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:40.127516985 CEST	25	49842	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:40.127716064 CEST	49842	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:40.127943993 CEST	49842	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:40.351434946 CEST	25	49842	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:40.354428053 CEST	25	49842	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:40.354644060 CEST	49842	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:40.355633974 CEST	25	49842	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:40.355689049 CEST	49842	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:41.037071943 CEST	49844	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:41.260807991 CEST	25	49844	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:41.261023045 CEST	49844	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:41.261468887 CEST	49844	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:41.484884024 CEST	25	49844	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:41.488259077 CEST	25	49844	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:41.488454103 CEST	49844	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:41.489582062 CEST	25	49844	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:41.489639997 CEST	49844	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:42.305231094 CEST	49847	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:42.529664040 CEST	25	49847	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:42.529747963 CEST	49847	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:42.530077934 CEST	49847	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:42.753653049 CEST	25	49847	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:42.757977009 CEST	25	49847	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:42.758059978 CEST	49847	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:42.759552002 CEST	25	49847	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:42.759618998 CEST	49847	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:43.603405952 CEST	49850	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:43.831435919 CEST	25	49850	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:43.831537962 CEST	49850	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:43.831772089 CEST	49850	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:44.059098959 CEST	25	49850	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:44.062406063 CEST	25	49850	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:44.062585115 CEST	49850	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:44.063770056 CEST	25	49850	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:44.063821077 CEST	49850	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:44.847393036 CEST	49853	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:45.075284958 CEST	25	49853	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:45.075385094 CEST	49853	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:45.075618029 CEST	49853	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:45.304502010 CEST	25	49853	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:45.306204081 CEST	25	49853	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:45.306289911 CEST	49853	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:45.307538033 CEST	25	49853	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:45.307595015 CEST	49853	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:46.403316021 CEST	49856	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:46.631592035 CEST	25	49856	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:46.631753922 CEST	49856	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:46.631973028 CEST	49856	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:46.860336065 CEST	25	49856	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:47.223807096 CEST	25	49856	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:47.223892927 CEST	49856	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:47.224838972 CEST	25	49856	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:47.224895954 CEST	49856	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:47.650351048 CEST	49859	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:47.874728918 CEST	25	49859	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:47.874816895 CEST	49859	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:47.875173092 CEST	49859	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:48.098514080 CEST	25	49859	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:48.101303101 CEST	25	49859	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:48.101397991 CEST	49859	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:48.102695942 CEST	25	49859	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:48.102765083 CEST	49859	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:48.919071913 CEST	49862	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:49.146467924 CEST	25	49862	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:49.146568060 CEST	49862	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:49.146857977 CEST	49862	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:49.374346972 CEST	25	49862	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:49.377680063 CEST	25	49862	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:49.377743006 CEST	49862	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:49.379009008 CEST	25	49862	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:49.379053116 CEST	49862	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:50.148078918 CEST	49865	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:50.376245975 CEST	25	49865	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:50.376545906 CEST	49865	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:50.377291918 CEST	49865	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:50.605452061 CEST	25	49865	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:50.607858896 CEST	25	49865	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:50.608042955 CEST	49865	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:50.609086037 CEST	25	49865	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:50.609184980 CEST	49865	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:51.334201097 CEST	49868	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:51.557926893 CEST	25	49868	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:51.558130980 CEST	49868	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:51.558783054 CEST	49868	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:51.781972885 CEST	25	49868	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:51.784666061 CEST	25	49868	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:51.784826040 CEST	49868	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:51.785892963 CEST	25	49868	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:51.785958052 CEST	49868	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:52.108907938 CEST	49825	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:05:52.109064102 CEST	443	49825	193.106.174.220	192.168.2.3
Oct 9, 2023 21:05:52.109194040 CEST	49825	443	192.168.2.3	193.106.174.220
Oct 9, 2023 21:05:52.524987936 CEST	49871	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:52.730998039 CEST	49872	443	192.168.2.3	80.66.75.77
Oct 9, 2023 21:05:52.731086969 CEST	443	49872	80.66.75.77	192.168.2.3
Oct 9, 2023 21:05:52.731185913 CEST	49872	443	192.168.2.3	80.66.75.77
Oct 9, 2023 21:05:52.748789072 CEST	25	49871	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:52.748984098 CEST	49871	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:52.749401093 CEST	49871	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:52.973695993 CEST	25	49871	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:52.976387024 CEST	25	49871	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:52.976434946 CEST	49871	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:52.977953911 CEST	25	49871	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:52.977996111 CEST	49871	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:53.730804920 CEST	49875	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:53.959222078 CEST	25	49875	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:53.959286928 CEST	49875	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:53.959563971 CEST	49875	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:54.186989069 CEST	25	49875	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:54.550313950 CEST	25	49875	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:54.550417900 CEST	49875	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:54.551472902 CEST	25	49875	104.47.53.36	192.168.2.3
Oct 9, 2023 21:05:54.551523924 CEST	49875	25	192.168.2.3	104.47.53.36
Oct 9, 2023 21:05:57.300303936 CEST	49879	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:05:57.508162022 CEST	25	49879	104.47.54.36	192.168.2.3
Oct 9, 2023 21:05:57.508336067 CEST	49879	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:05:57.509145021 CEST	49879	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:05:57.716510057 CEST	25	49879	104.47.54.36	192.168.2.3
Oct 9, 2023 21:05:58.064825058 CEST	25	49879	104.47.54.36	192.168.2.3
Oct 9, 2023 21:05:58.064914942 CEST	49879	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:05:58.065921068 CEST	25	49879	104.47.54.36	192.168.2.3
Oct 9, 2023 21:05:58.065978050 CEST	49879	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:05:58.753174067 CEST	49882	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:05:58.961065054 CEST	25	49882	104.47.54.36	192.168.2.3
Oct 9, 2023 21:05:58.961165905 CEST	49882	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:05:58.961498022 CEST	49882	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:05:59.169298887 CEST	25	49882	104.47.54.36	192.168.2.3
Oct 9, 2023 21:05:59.173299074 CEST	25	49882	104.47.54.36	192.168.2.3
Oct 9, 2023 21:05:59.173389912 CEST	49882	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:05:59.174079895 CEST	25	49882	104.47.54.36	192.168.2.3
Oct 9, 2023 21:05:59.174134970 CEST	49882	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:00.119054079 CEST	49885	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:00.326945066 CEST	25	49885	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:00.327143908 CEST	49885	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:00.328166008 CEST	49885	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:00.535785913 CEST	25	49885	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:00.888798952 CEST	25	49885	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:00.888935089 CEST	49885	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:00.889831066 CEST	25	49885	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:00.889878988 CEST	49885	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:01.575120926 CEST	49888	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:01.782689095 CEST	25	49888	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:01.786657095 CEST	49888	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:01.787518978 CEST	49888	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:01.994927883 CEST	25	49888	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:02.345829010 CEST	25	49888	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:02.345901966 CEST	49888	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:02.346923113 CEST	25	49888	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:02.350163937 CEST	49888	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:02.944253922 CEST	49891	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:03.152035952 CEST	25	49891	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:03.152141094 CEST	49891	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:03.152467966 CEST	49891	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:03.360708952 CEST	25	49891	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:03.363599062 CEST	25	49891	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:03.363807917 CEST	49891	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:03.364969969 CEST	25	49891	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:03.365031004 CEST	49891	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:06.027297974 CEST	49894	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:06.235260010 CEST	25	49894	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:06.235344887 CEST	49894	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:06.235431910 CEST	49894	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:06.443794966 CEST	25	49894	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:06.446969986 CEST	25	49894	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:06.447029114 CEST	49894	25	192.168.2.3	104.47.54.36
Oct 9, 2023 21:06:06.448280096 CEST	25	49894	104.47.54.36	192.168.2.3
Oct 9, 2023 21:06:06.448323965 CEST	49894	25	192.168.2.3	104.47.54.36

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2023 21:02:27.915396929 CEST	64209	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:02:28.164201021 CEST	53	64209	1.1.1.1	192.168.2.3
Oct 9, 2023 21:02:30.360779047 CEST	60569	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:02:31.096591949 CEST	53	60569	1.1.1.1	192.168.2.3
Oct 9, 2023 21:03:37.274600029 CEST	57054	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:03:37.522793055 CEST	53	57054	1.1.1.1	192.168.2.3
Oct 9, 2023 21:03:47.107268095 CEST	52054	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:03:47.352947950 CEST	53	52054	1.1.1.1	192.168.2.3
Oct 9, 2023 21:03:57.691942930 CEST	61035	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:03:57.938350916 CEST	53	61035	1.1.1.1	192.168.2.3
Oct 9, 2023 21:04:08.138592005 CEST	57041	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:04:08.447371006 CEST	53	57041	1.1.1.1	192.168.2.3
Oct 9, 2023 21:04:18.314908981 CEST	55463	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:04:18.561786890 CEST	53	55463	1.1.1.1	192.168.2.3
Oct 9, 2023 21:04:30.184765100 CEST	62954	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:04:30.432059050 CEST	53	62954	1.1.1.1	192.168.2.3
Oct 9, 2023 21:04:40.554030895 CEST	58633	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:04:40.801038980 CEST	53	58633	1.1.1.1	192.168.2.3
Oct 9, 2023 21:04:51.257673979 CEST	52393	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:04:51.504048109 CEST	53	52393	1.1.1.1	192.168.2.3
Oct 9, 2023 21:05:11.515692949 CEST	56784	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:05:11.680250883 CEST	53	56784	1.1.1.1	192.168.2.3
Oct 9, 2023 21:05:11.681448936 CEST	64915	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:05:11.845762014 CEST	53	64915	1.1.1.1	192.168.2.3
Oct 9, 2023 21:05:13.070461988 CEST	51498	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:05:13.317194939 CEST	53	51498	1.1.1.1	192.168.2.3
Oct 9, 2023 21:05:35.609462023 CEST	55271	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:05:35.773005009 CEST	53	55271	1.1.1.1	192.168.2.3
Oct 9, 2023 21:05:36.956033945 CEST	50689	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:05:37.203006029 CEST	53	50689	1.1.1.1	192.168.2.3
Oct 9, 2023 21:05:46.155725956 CEST	50146	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:05:46.402228117 CEST	53	50146	1.1.1.1	192.168.2.3
Oct 9, 2023 21:05:52.218751907 CEST	54084	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:05:52.729968071 CEST	53	54084	1.1.1.1	192.168.2.3
Oct 9, 2023 21:05:57.050214052 CEST	52919	53	192.168.2.3	1.1.1.1
Oct 9, 2023 21:05:57.296340942 CEST	53	52919	1.1.1.1	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 9, 2023 21:02:27.915396929 CEST	192.168.2.3	1.1.1.1	0xddf4	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:02:30.360779047 CEST	192.168.2.3	1.1.1.1	0xa7a5	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:37.274600029 CEST	192.168.2.3	1.1.1.1	0xd29f	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:47.107268095 CEST	192.168.2.3	1.1.1.1	0x4001	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:57.691942930 CEST	192.168.2.3	1.1.1.1	0xf9e5	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:08.138592005 CEST	192.168.2.3	1.1.1.1	0x520d	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:18.314908981 CEST	192.168.2.3	1.1.1.1	0xd9a4	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:30.184765100 CEST	192.168.2.3	1.1.1.1	0x1d9a	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:40.554030895 CEST	192.168.2.3	1.1.1.1	0xb335	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:51.257673979 CEST	192.168.2.3	1.1.1.1	0x876e	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:11.515692949 CEST	192.168.2.3	1.1.1.1	0x9922	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Oct 9, 2023 21:05:11.681448936 CEST	192.168.2.3	1.1.1.1	0xb9c3	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:13.070461988 CEST	192.168.2.3	1.1.1.1	0x1db2	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:35.609462023 CEST	192.168.2.3	1.1.1.1	0x8291	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:36.956033945 CEST	192.168.2.3	1.1.1.1	0x23e1	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:46.155725956 CEST	192.168.2.3	1.1.1.1	0x462d	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:52.218751907 CEST	192.168.2.3	1.1.1.1	0xd0d	Standard query (0)	jotunheim.name	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:57.050214052 CEST	192.168.2.3	1.1.1.1	0x640f	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 9, 2023 21:02:28.164201021 CEST	1.1.1.1	192.168.2.3	0xddf4	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:02:28.164201021 CEST	1.1.1.1	192.168.2.3	0xddf4	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:02:28.164201021 CEST	1.1.1.1	192.168.2.3	0xddf4	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:02:28.164201021 CEST	1.1.1.1	192.168.2.3	0xddf4	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:02:28.164201021 CEST	1.1.1.1	192.168.2.3	0xddf4	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:02:28.164201021 CEST	1.1.1.1	192.168.2.3	0xddf4	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.7	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:02:31.096591949 CEST	1.1.1.1	192.168.2.3	0xa7a5	No error (0)	vanaheim.cn	193.106.174.220	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:37.522793055 CEST	1.1.1.1	192.168.2.3	0xd29f	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:37.522793055 CEST	1.1.1.1	192.168.2.3	0xd29f	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:37.522793055 CEST	1.1.1.1	192.168.2.3	0xd29f	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.7	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:37.522793055 CEST	1.1.1.1	192.168.2.3	0xd29f	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:37.522793055 CEST	1.1.1.1	192.168.2.3	0xd29f	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:37.522793055 CEST	1.1.1.1	192.168.2.3	0xd29f	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:47.352947950 CEST	1.1.1.1	192.168.2.3	0x4001	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:47.352947950 CEST	1.1.1.1	192.168.2.3	0x4001	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:47.352947950 CEST	1.1.1.1	192.168.2.3	0x4001	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:47.352947950 CEST	1.1.1.1	192.168.2.3	0x4001	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:47.352947950 CEST	1.1.1.1	192.168.2.3	0x4001	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:47.352947950 CEST	1.1.1.1	192.168.2.3	0x4001	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.7	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:57.938350916 CEST	1.1.1.1	192.168.2.3	0xf9e5	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:57.938350916 CEST	1.1.1.1	192.168.2.3	0xf9e5	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.7	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:57.938350916 CEST	1.1.1.1	192.168.2.3	0xf9e5	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:57.938350916 CEST	1.1.1.1	192.168.2.3	0xf9e5	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:57.938350916 CEST	1.1.1.1	192.168.2.3	0xf9e5	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.29	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:03:57.938350916 CEST	1.1.1.1	192.168.2.3	0xf9e5	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:08.447371006 CEST	1.1.1.1	192.168.2.3	0x520d	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:08.447371006 CEST	1.1.1.1	192.168.2.3	0x520d	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:08.447371006 CEST	1.1.1.1	192.168.2.3	0x520d	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:08.447371006 CEST	1.1.1.1	192.168.2.3	0x520d	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.29	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:08.447371006 CEST	1.1.1.1	192.168.2.3	0x520d	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:18.561786890 CEST	1.1.1.1	192.168.2.3	0xd9a4	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:18.561786890 CEST	1.1.1.1	192.168.2.3	0xd9a4	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.7	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:18.561786890 CEST	1.1.1.1	192.168.2.3	0xd9a4	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:18.561786890 CEST	1.1.1.1	192.168.2.3	0xd9a4	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:18.561786890 CEST	1.1.1.1	192.168.2.3	0xd9a4	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:18.561786890 CEST	1.1.1.1	192.168.2.3	0xd9a4	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:30.432059050 CEST	1.1.1.1	192.168.2.3	0x1d9a	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:30.432059050 CEST	1.1.1.1	192.168.2.3	0x1d9a	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:30.432059050 CEST	1.1.1.1	192.168.2.3	0x1d9a	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:30.432059050 CEST	1.1.1.1	192.168.2.3	0x1d9a	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.7	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:30.432059050 CEST	1.1.1.1	192.168.2.3	0x1d9a	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.29	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:30.432059050 CEST	1.1.1.1	192.168.2.3	0x1d9a	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:40.801038980 CEST	1.1.1.1	192.168.2.3	0xb335	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:40.801038980 CEST	1.1.1.1	192.168.2.3	0xb335	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.7	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:40.801038980 CEST	1.1.1.1	192.168.2.3	0xb335	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:40.801038980 CEST	1.1.1.1	192.168.2.3	0xb335	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:40.801038980 CEST	1.1.1.1	192.168.2.3	0xb335	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:40.801038980 CEST	1.1.1.1	192.168.2.3	0xb335	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:51.504048109 CEST	1.1.1.1	192.168.2.3	0x876e	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.29	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:51.504048109 CEST	1.1.1.1	192.168.2.3	0x876e	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:51.504048109 CEST	1.1.1.1	192.168.2.3	0x876e	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:51.504048109 CEST	1.1.1.1	192.168.2.3	0x876e	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:04:51.504048109 CEST	1.1.1.1	192.168.2.3	0x876e	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:11.680250883 CEST	1.1.1.1	192.168.2.3	0x9922	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Oct 9, 2023 21:05:11.680250883 CEST	1.1.1.1	192.168.2.3	0x9922	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Oct 9, 2023 21:05:11.680250883 CEST	1.1.1.1	192.168.2.3	0x9922	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Oct 9, 2023 21:05:11.845762014 CEST	1.1.1.1	192.168.2.3	0xb9c3	No error (0)	mta6.am0.yahoodns.net	98.136.96.74	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:11.845762014 CEST	1.1.1.1	192.168.2.3	0xb9c3	No error (0)	mta6.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:11.845762014 CEST	1.1.1.1	192.168.2.3	0xb9c3	No error (0)	mta6.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:11.845762014 CEST	1.1.1.1	192.168.2.3	0xb9c3	No error (0)	mta6.am0.yahoodns.net	67.195.204.79	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:11.845762014 CEST	1.1.1.1	192.168.2.3	0xb9c3	No error (0)	mta6.am0.yahoodns.net	67.195.228.109	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:11.845762014 CEST	1.1.1.1	192.168.2.3	0xb9c3	No error (0)	mta6.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:11.845762014 CEST	1.1.1.1	192.168.2.3	0xb9c3	No error (0)	mta6.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:11.845762014 CEST	1.1.1.1	192.168.2.3	0xb9c3	No error (0)	mta6.am0.yahoodns.net	67.195.204.72	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:13.317194939 CEST	1.1.1.1	192.168.2.3	0x1db2	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:13.317194939 CEST	1.1.1.1	192.168.2.3	0x1db2	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:13.317194939 CEST	1.1.1.1	192.168.2.3	0x1db2	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.7	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:13.317194939 CEST	1.1.1.1	192.168.2.3	0x1db2	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.29	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:13.317194939 CEST	1.1.1.1	192.168.2.3	0x1db2	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:13.317194939 CEST	1.1.1.1	192.168.2.3	0x1db2	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:35.773005009 CEST	1.1.1.1	192.168.2.3	0x8291	No error (0)	mta6.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:35.773005009 CEST	1.1.1.1	192.168.2.3	0x8291	No error (0)	mta6.am0.yahoodns.net	67.195.204.79	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:35.773005009 CEST	1.1.1.1	192.168.2.3	0x8291	No error (0)	mta6.am0.yahoodns.net	67.195.228.109	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:35.773005009 CEST	1.1.1.1	192.168.2.3	0x8291	No error (0)	mta6.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:35.773005009 CEST	1.1.1.1	192.168.2.3	0x8291	No error (0)	mta6.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:35.773005009 CEST	1.1.1.1	192.168.2.3	0x8291	No error (0)	mta6.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:35.773005009 CEST	1.1.1.1	192.168.2.3	0x8291	No error (0)	mta6.am0.yahoodns.net	98.136.96.75	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:35.773005009 CEST	1.1.1.1	192.168.2.3	0x8291	No error (0)	mta6.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:37.203006029 CEST	1.1.1.1	192.168.2.3	0x23e1	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:37.203006029 CEST	1.1.1.1	192.168.2.3	0x23e1	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:37.203006029 CEST	1.1.1.1	192.168.2.3	0x23e1	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:37.203006029 CEST	1.1.1.1	192.168.2.3	0x23e1	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:37.203006029 CEST	1.1.1.1	192.168.2.3	0x23e1	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.29	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:46.402228117 CEST	1.1.1.1	192.168.2.3	0x462d	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:46.402228117 CEST	1.1.1.1	192.168.2.3	0x462d	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:46.402228117 CEST	1.1.1.1	192.168.2.3	0x462d	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:46.402228117 CEST	1.1.1.1	192.168.2.3	0x462d	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:46.402228117 CEST	1.1.1.1	192.168.2.3	0x462d	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.29	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:52.729968071 CEST	1.1.1.1	192.168.2.3	0xd0d	No error (0)	jotunheim.name	80.66.75.77	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:57.296340942 CEST	1.1.1.1	192.168.2.3	0x640f	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:57.296340942 CEST	1.1.1.1	192.168.2.3	0x640f	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.7	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:57.296340942 CEST	1.1.1.1	192.168.2.3	0x640f	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:57.296340942 CEST	1.1.1.1	192.168.2.3	0x640f	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.5	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:57.296340942 CEST	1.1.1.1	192.168.2.3	0x640f	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.29	A (IP address)	IN (0x0001)	false
Oct 9, 2023 21:05:57.296340942 CEST	1.1.1.1	192.168.2.3	0x640f	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 9, 2023 21:02:28.624763012 CEST	25	49714	40.93.207.5	192.168.2.3	220 CB1PEPF00003D79.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:02:27 +0000
Oct 9, 2023 21:03:37.973424911 CEST	25	49719	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:37 +0000
Oct 9, 2023 21:03:39.309248924 CEST	25	49721	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:38 +0000
Oct 9, 2023 21:03:40.860481977 CEST	25	49723	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:40 +0000
Oct 9, 2023 21:03:43.417088032 CEST	25	49725	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:42 +0000
Oct 9, 2023 21:03:44.713330030 CEST	25	49727	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:43 +0000
Oct 9, 2023 21:03:46.148380995 CEST	25	49729	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:45 +0000
Oct 9, 2023 21:03:47.799685955 CEST	25	49731	40.93.212.0	192.168.2.3	220 CD1PEPF000006AE.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:47 +0000
Oct 9, 2023 21:03:49.242321014 CEST	25	49733	40.93.212.0	192.168.2.3	220 CD1PEPF000006AE.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:48 +0000
Oct 9, 2023 21:03:50.740894079 CEST	25	49735	40.93.212.0	192.168.2.3	220 CD1PEPF000006AE.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:50 +0000
Oct 9, 2023 21:03:52.246368885 CEST	25	49737	40.93.212.0	192.168.2.3	220 CD1PEPF000006AE.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:51 +0000
Oct 9, 2023 21:03:53.601526022 CEST	25	49740	40.93.212.0	192.168.2.3	220 CD1PEPF000006AD.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:53 +0000
Oct 9, 2023 21:03:55.079722881 CEST	25	49742	40.93.212.0	192.168.2.3	220 CD1PEPF000006AD.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:54 +0000
Oct 9, 2023 21:03:56.468019962 CEST	25	49744	40.93.212.0	192.168.2.3	220 CD1PEPF000006AD.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:55 +0000
Oct 9, 2023 21:03:58.710621119 CEST	25	49746	104.47.54.36	192.168.2.3	220 DM3NAM06FT014.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:58 +0000
Oct 9, 2023 21:03:59.732928038 CEST	25	49748	104.47.54.36	192.168.2.3	220 DM3NAM06FT010.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:03:59 +0000
Oct 9, 2023 21:04:01.313339949 CEST	25	49750	104.47.54.36	192.168.2.3	220 DM3NAM06FT003.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:00 +0000
Oct 9, 2023 21:04:02.255928040 CEST	25	49752	104.47.54.36	192.168.2.3	220 DM3NAM06FT016.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:01 +0000
Oct 9, 2023 21:04:03.849586964 CEST	25	49754	104.47.54.36	192.168.2.3	220 DM3NAM06FT009.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:02 +0000
Oct 9, 2023 21:04:04.940988064 CEST	25	49756	104.47.54.36	192.168.2.3	220 DM3NAM06FT007.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:04 +0000
Oct 9, 2023 21:04:06.204778910 CEST	25	49758	104.47.54.36	192.168.2.3	220 DM3NAM06FT016.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:05 +0000
Oct 9, 2023 21:04:07.404645920 CEST	25	49760	104.47.54.36	192.168.2.3	220 DM3NAM06FT004.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:06 +0000
Oct 9, 2023 21:04:08.900469065 CEST	25	49762	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:07 +0000
Oct 9, 2023 21:04:10.308058023 CEST	25	49764	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:09 +0000
Oct 9, 2023 21:04:11.698175907 CEST	25	49766	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:10 +0000
Oct 9, 2023 21:04:13.099709034 CEST	25	49768	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:12 +0000
Oct 9, 2023 21:04:14.467812061 CEST	25	49770	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:13 +0000
Oct 9, 2023 21:04:15.946964979 CEST	25	49772	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:14 +0000
Oct 9, 2023 21:04:17.435250044 CEST	25	49774	40.93.207.1	192.168.2.3	220 CB1PEPF00003667.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:17 +0000
Oct 9, 2023 21:04:18.981692076 CEST	25	49776	40.93.212.0	192.168.2.3	220 CD1PEPF000006AD.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:18 +0000
Oct 9, 2023 21:04:20.204605103 CEST	25	49778	40.93.212.0	192.168.2.3	220 CD1PEPF000006AD.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:19 +0000
Oct 9, 2023 21:04:21.478930950 CEST	25	49780	40.93.212.0	192.168.2.3	220 CD1PEPF000006AD.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:20 +0000
Oct 9, 2023 21:04:22.693321943 CEST	25	49782	40.93.212.0	192.168.2.3	220 CD1PEPF000006AD.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:21 +0000
Oct 9, 2023 21:04:23.884661913 CEST	25	49784	40.93.212.0	192.168.2.3	220 CD1PEPF000006AD.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:23 +0000
Oct 9, 2023 21:04:25.295798063 CEST	25	49786	40.93.212.0	192.168.2.3	220 CD1PEPF000006AD.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:24 +0000
Oct 9, 2023 21:04:26.691509008 CEST	25	49788	40.93.212.0	192.168.2.3	220 CD1PEPF000006AD.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:25 +0000
Oct 9, 2023 21:04:30.883565903 CEST	25	49790	40.93.207.5	192.168.2.3	220 CB1PEPF00003D78.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:30 +0000
Oct 9, 2023 21:04:32.130721092 CEST	25	49792	40.93.207.5	192.168.2.3	220 CB1PEPF00003D79.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:31 +0000
Oct 9, 2023 21:04:33.398545027 CEST	25	49795	40.93.207.5	192.168.2.3	220 CB1PEPF00003D79.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:32 +0000
Oct 9, 2023 21:04:34.626475096 CEST	25	49797	40.93.207.5	192.168.2.3	220 CB1PEPF00003D7A.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:33 +0000
Oct 9, 2023 21:04:35.924674034 CEST	25	49799	40.93.207.5	192.168.2.3	220 CB1PEPF00003D78.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:35 +0000
Oct 9, 2023 21:04:37.228729010 CEST	25	49801	40.93.207.5	192.168.2.3	220 CB1PEPF00003D79.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:36 +0000
Oct 9, 2023 21:04:38.483428955 CEST	25	49803	40.93.207.5	192.168.2.3	220 CB1PEPF00003D7A.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:38 +0000
Oct 9, 2023 21:04:39.759342909 CEST	25	49805	40.93.207.5	192.168.2.3	220 CB1PEPF00003D78.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:39 +0000
Oct 9, 2023 21:04:41.261710882 CEST	25	49807	40.93.207.5	192.168.2.3	220 CB1PEPF00003D79.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:40 +0000
Oct 9, 2023 21:04:42.557807922 CEST	25	49809	40.93.207.5	192.168.2.3	220 CB1PEPF00003D7A.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:42 +0000
Oct 9, 2023 21:04:43.779781103 CEST	25	49811	40.93.207.5	192.168.2.3	220 CB1PEPF00003D78.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:43 +0000
Oct 9, 2023 21:04:44.982021093 CEST	25	49813	40.93.207.5	192.168.2.3	220 CB1PEPF00003D79.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:44 +0000
Oct 9, 2023 21:04:46.363997936 CEST	25	49815	40.93.207.5	192.168.2.3	220 CB1PEPF00003D7A.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:46 +0000
Oct 9, 2023 21:04:48.948822975 CEST	25	49817	40.93.207.5	192.168.2.3	220 CB1PEPF00003D78.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:48 +0000
Oct 9, 2023 21:04:50.384640932 CEST	25	49819	40.93.207.5	192.168.2.3	220 CB1PEPF00003D79.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:04:49 +0000
Oct 9, 2023 21:05:12.417845011 CEST	25	49824	98.136.96.74	192.168.2.3	220 mtaproxy207.free.mail.ne1.yahoo.com ESMTP ready
Oct 9, 2023 21:05:16.419312954 CEST	25	49827	40.93.207.1	192.168.2.3	451 4.7.700 PFA agent busy, please try again. [CB1PEPF00003667.namprd00.prod.outlook.com 2023-10-09T19:05:16.289Z 08DBC8FAAAC634FC]
Oct 9, 2023 21:05:36.330264091 CEST	25	49835	67.195.204.74	192.168.2.3	220 mtaproxy507.free.mail.bf1.yahoo.com ESMTP ready
Oct 9, 2023 21:05:37.663113117 CEST	25	49838	104.47.53.36	192.168.2.3	220 BL2NAM06FT011.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:37 +0000
Oct 9, 2023 21:05:40.354428053 CEST	25	49842	104.47.53.36	192.168.2.3	220 BL2NAM06FT012.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:39 +0000
Oct 9, 2023 21:05:41.488259077 CEST	25	49844	104.47.53.36	192.168.2.3	220 BL2NAM06FT004.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:41 +0000
Oct 9, 2023 21:05:42.757977009 CEST	25	49847	104.47.53.36	192.168.2.3	220 BL2NAM06FT014.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:41 +0000
Oct 9, 2023 21:05:44.062406063 CEST	25	49850	104.47.53.36	192.168.2.3	220 BL2NAM06FT013.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:43 +0000
Oct 9, 2023 21:05:45.306204081 CEST	25	49853	104.47.53.36	192.168.2.3	220 BL2NAM06FT013.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:44 +0000
Oct 9, 2023 21:05:47.223807096 CEST	25	49856	104.47.53.36	192.168.2.3	220 BL2NAM06FT004.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:46 +0000
Oct 9, 2023 21:05:48.101303101 CEST	25	49859	104.47.53.36	192.168.2.3	220 BL2NAM06FT013.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:47 +0000
Oct 9, 2023 21:05:49.377680063 CEST	25	49862	104.47.53.36	192.168.2.3	220 BL2NAM06FT004.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:48 +0000
Oct 9, 2023 21:05:50.607858896 CEST	25	49865	104.47.53.36	192.168.2.3	220 BL2NAM06FT013.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:49 +0000
Oct 9, 2023 21:05:51.784666061 CEST	25	49868	104.47.53.36	192.168.2.3	220 BL2NAM06FT012.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:51 +0000
Oct 9, 2023 21:05:52.976387024 CEST	25	49871	104.47.53.36	192.168.2.3	220 BL2NAM06FT009.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:52 +0000
Oct 9, 2023 21:05:54.550313950 CEST	25	49875	104.47.53.36	192.168.2.3	220 BL2NAM06FT011.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:53 +0000
Oct 9, 2023 21:05:58.064825058 CEST	25	49879	104.47.54.36	192.168.2.3	220 DM3NAM06FT003.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:57 +0000
Oct 9, 2023 21:05:59.173299074 CEST	25	49882	104.47.54.36	192.168.2.3	220 DM3NAM06FT015.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:58 +0000
Oct 9, 2023 21:06:00.888798952 CEST	25	49885	104.47.54.36	192.168.2.3	220 DM3NAM06FT006.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:05:59 +0000
Oct 9, 2023 21:06:02.345829010 CEST	25	49888	104.47.54.36	192.168.2.3	220 DM3NAM06FT009.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:06:01 +0000
Oct 9, 2023 21:06:03.363599062 CEST	25	49891	104.47.54.36	192.168.2.3	220 DM3NAM06FT016.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:06:02 +0000
Oct 9, 2023 21:06:06.446969986 CEST	25	49894	104.47.54.36	192.168.2.3	220 DM3NAM06FT016.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 9 Oct 2023 19:06:06 +0000

Target ID:	0
Start time:	21:01:55
Start date:	09/10/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff743e40000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	21:01:55
Start date:	09/10/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff743e40000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	21:01:55
Start date:	09/10/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff743e40000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	21:01:55
Start date:	09/10/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff743e40000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	21:01:56
Start date:	09/10/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	221'184 bytes
MD5 hash:	21C68B05AC982CFF12AFCB9AF3A5657D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.1457392227.000000000090D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000004.00000003.1409298622.0000000000720000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:02:10
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ptlohvde\
Imagebase:	0xb80000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:02:10
Start date:	09/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:02:10
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\wdkncqjt.exe" C:\Windows\SysWOW64\ptlohvde\
Imagebase:	0xb80000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:02:10
Start date:	09/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:02:11
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" create ptlohvde binPath= "C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe /d\"C:\Users\user\Desktop\file.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0x490000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:02:11
Start date:	09/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:02:12
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" description ptlohvde "wifi internet conection
Imagebase:	0x490000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:02:12
Start date:	09/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:02:13
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start ptlohvde
Imagebase:	0x490000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:02:13
Start date:	09/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:02:13
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe /d"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	13'209'600 bytes
MD5 hash:	B11DD4A2DA4ABF719066A2DB8F95983F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000010.00000002.1576028208.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.1575910314.0000000000619000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000010.00000003.1572907946.0000000000EA0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	21:02:13
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x8e0000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	21:02:13
Start date:	09/10/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff743e40000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:02:13
Start date:	09/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:02:14
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7448 -ip 7448
Imagebase:	0xb0000
File size:	489'328 bytes
MD5 hash:	F5210A4A7E411A1BAD3844586A74B574
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:02:14
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 632
Imagebase:	0xb0000
File size:	489'328 bytes
MD5 hash:	F5210A4A7E411A1BAD3844586A74B574
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:02:25
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x60000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	21:02:25
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7956 -ip 7956
Imagebase:	0xb0000
File size:	489'328 bytes
MD5 hash:	F5210A4A7E411A1BAD3844586A74B574
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:02:26
Start date:	09/10/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 540
Imagebase:	0xb0000
File size:	489'328 bytes
MD5 hash:	F5210A4A7E411A1BAD3844586A74B574
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:02:56
Start date:	09/10/2023
Path:	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe" -wdenable
Imagebase:	0x7ff70adc0000
File size:	1'596'304 bytes
MD5 hash:	31E905BFB19E7D184BB81F274A71B221
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:02:56
Start date:	09/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff720030000
File size:	873'472 bytes
MD5 hash:	7366FBEFE66BA0F1F5304F7D6FEF09FE
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	21:04:57
Start date:	09/10/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff743e40000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	21:05:28
Start date:	09/10/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff743e40000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	31.3%
Signature Coverage:	25.3%
Total number of Nodes:	1574
Total number of Limit Nodes:	27

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

D, xrefs: 00409F8E
P, xrefs: 00409DAA
\, xrefs: 00409D0C
", xrefs: 0040A189
%X%08X, xrefs: 0040A0B0
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 00409EDB
", xrefs: 0040A078

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,76128A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID: PromptOnSecureDesktop
API String ID: 3188212458-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Strings

]Vw`'Vw, xrefs: 0040EBDA

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID: ]Vw`'Vw
API String ID: 2559512979-147723481
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00912102 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0091212A
Module32First.KERNEL32(00000000,00000224), ref: 0091214A

Memory Dump Source

Source File: 00000004.00000002.1457392227.000000000090D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_90d000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 1434111203bfbd9d8b473af22cf2b88cc631f56857e30327c1cdc8d8f8abed73
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 5FF0CD32200318BBD7207BF8A88DBEA76ECAF49325F100528E746910C0CB70E8858A60

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,761311B0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,761311B0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,761311B0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,761311B0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,761311B0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,761311B0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,761311B0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,761311B0,?,761311B0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(761311B0,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,761311B0,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(761311B0,?,761311B0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(761311B0), ref: 00407208
RegCloseKey.ADVAPI32(761311B0), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(761311B0), ref: 004072D0
RegCloseKey.ADVAPI32(761311B0), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(761311B0), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,761311B0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,761311B0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,761311B0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,761311B0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,761311B0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,761311B0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,761311B0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,761311B0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,761311B0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,761311B0,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,761311B0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0070003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0070024D

Strings

kernel32.dll, xrefs: 0070008F, 00700095
cess, xrefs: 0070018D

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 9be9b3c6779dbc4fec803037c48c4e54be1ef0d9e37ab80a9898581bd6dc0544
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 5C527974A00229DFDB64CF58C984BA8BBB1BF09314F1481E9E50DAB391DB34AE94DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,76128A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Uniqueness

Uniqueness Score: -1.00%

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00700E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00700223,?,?), ref: 00700E19
SetErrorMode.KERNELBASE(00000000,?,?,00700223,?,?), ref: 00700E1E

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 363d1c857498136fbe31aee574387ff28b79b8b4375f79cccd03c8d3e1615692
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: AED01231145128B7D7003A94DC09BCD7B5CDF05B62F008411FB0DE9080C774994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Uniqueness

Uniqueness Score: -1.00%

Function 00911DC1 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00911E12

Memory Dump Source

Source File: 00000004.00000002.1457392227.000000000090D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_90d000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ca25ba92f5b78bb74ea5cf394c076169ea20a53e63ecd7378dbff1ec50d353e4
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 13112B79A00208EFDB01DF98C985E99BBF5AF08350F058094FA489B362D375EA90DB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

wtm_w, xrefs: 0040C96C
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
wtm_c, xrefs: 0040C956
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
flags_upd, xrefs: 0040CE4A
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
@, xrefs: 0040D754
\, xrefs: 0040D39D
drivers\, xrefs: 0040D067
srv_time, xrefs: 0040CABB
lid_file_upd, xrefs: 0040CE6A
\, xrefs: 0040D3A7
local_time, xrefs: 0040CACD
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
.sys, xrefs: 0040D0CC
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
4, xrefs: 0040D9F7
wtm_r, xrefs: 0040C97F

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlSetLastWin32Error, xrefs: 004010D6
ntdll.dll, xrefs: 0040100D
RtlLengthSid, xrefs: 00401246
NtQueryInformationToken, xrefs: 00401262
NtTerminateProcess, xrefs: 004010F6
NtClose, xrefs: 004011B4
NtSetInformationThread, xrefs: 00401155
RtlNtStatusToDosError, xrefs: 00401194
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlInitUnicodeString, xrefs: 00401135
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtSetInformationToken, xrefs: 00401175
RtlFreeSid, xrefs: 00401116
NtOpenProcessToken, xrefs: 004011D4
NtDuplicateToken, xrefs: 004011F3
NtFilterToken, xrefs: 0040122B

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

May, xrefs: 0040B272
Sat, xrefs: 0040B24F
Oct, xrefs: 0040B295
Jul, xrefs: 0040B280
Feb, xrefs: 0040B25D
Sep, xrefs: 0040B28E
Jun, xrefs: 0040B279
Tue, xrefs: 0040B233
Mon, xrefs: 0040B22C
Nov, xrefs: 0040B29C
Dec, xrefs: 0040B2A3
Mar, xrefs: 0040B264
Aug, xrefs: 0040B287
Thu, xrefs: 0040B241
Jan, xrefs: 0040B256
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Wed, xrefs: 0040B23A
Sun, xrefs: 0040B225
Apr, xrefs: 0040B26B
Fri, xrefs: 0040B248

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7612F620), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7612F620), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

]Vw`'Vw, xrefs: 00402A86, 00402C02

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: ]Vw`'Vw
API String ID: 1639031587-147723481
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
, xrefs: 00401462
uac, xrefs: 00401628
D, xrefs: 004015C6
@EJv, xrefs: 0040139A
<, xrefs: 00401378
useless, xrefs: 0040161E

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$@EJv$D$uac$useless$wusa.exe
API String ID: 1628651668-3954050976
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

IsWow64Process, xrefs: 00401DF2
lid_file_upd, xrefs: 00401E25
loader_id, xrefs: 00401F4B, 00401F6B
work_srv, xrefs: 00401E5E
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
born_date, xrefs: 00401EAD, 00401ECC
start_srv, xrefs: 00401E6C
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
kernel32, xrefs: 00401DF7
net_type, xrefs: 00401E87

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 007065E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 007065F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00706610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 00706631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00706652

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: d5b2852258ea294fa3b781a67c577b059c5ec224640dca6139ade95039e84a6b
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 4711A3B1600218FFDB219F65DC1AF9B3FA8EB047A5F104124F908E7291D7B6DD1086A4

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 0070092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 00700966
., xrefs: 0070095F
GetProcAddress., xrefs: 007009DC, 007009DF, 007009E4

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: b191a1097d474a83367248c2b9c822c83515a3dcd5259a6ee529bdb81389497e
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: F0318AB6910609DFDB10CF99C884BAEBBF9FF08324F24414AD841A7351D775EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 009119DF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1457392227.000000000090D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_90d000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 84726b2e1c6c30446ccb431fb916080eafb8ee30ce04d06a9bfc922cf178a072
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: E1117C72340104AFDB44DE55DC81FE677EAEF88360B2980A5EA08CB316E679EC81C760

Uniqueness

Uniqueness Score: -1.00%

Function 00700D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: d711aeb3441189b51fc6b698b07a5e2285a8451c8e4702e3bd61251f80834f7d
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: D201A776700604DFDF21DF64C804BAA33E5FB85325F4545A5D506D72C2E778A9418BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00709EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00709E6D
lstrcpy.KERNEL32(?,00000000), ref: 00709FE1
lstrcat.KERNEL32(?,?), ref: 00709FF2
lstrcat.KERNEL32(?,0041070C), ref: 0070A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0070A054
DeleteFileA.KERNEL32(?), ref: 0070A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0070A0D6
lstrcpy.KERNEL32 ref: 0070A12F
lstrlen.KERNEL32(00000022), ref: 0070A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 00709F13

Part of subcall function 00707029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 00707081

Part of subcall function 00706F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\imehaowx,00707043), ref: 00706F4E
Part of subcall function 00706F30: GetProcAddress.KERNEL32(00000000), ref: 00706F55
Part of subcall function 00706F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00706F7B
Part of subcall function 00706F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00706F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0070A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0070A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0070A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0070A21B
GetDriveTypeA.KERNEL32(?), ref: 0070A265
lstrcat.KERNEL32(?,00000000), ref: 0070A29F
lstrcat.KERNEL32(?,00410A34), ref: 0070A2C5
lstrcat.KERNEL32(?,00000022), ref: 0070A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0070A2F4
wsprintfA.USER32 ref: 0070A31D
lstrcat.KERNEL32(?,00000000), ref: 0070A345
lstrcat.KERNEL32(?,?), ref: 0070A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0070A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0070A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0070A1D1

Part of subcall function 00709966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0070999D
Part of subcall function 00709966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 007099BD
Part of subcall function 00709966: RegCloseKey.ADVAPI32(?), ref: 007099C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0070A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0070A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0070A41D

Strings

D, xrefs: 0070A1F5
", xrefs: 0070A3F0
", xrefs: 0070A142
", xrefs: 0070A2DF
\, xrefs: 00709F73
P, xrefs: 0070A011

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 4ab369f4a2ebfd2a478f366438dbc1137b93b7a9720e689f295fce3a38d6ab67
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 79F120B1D40259FEDB21DBA0CC49EEF7BFCAB08300F1445A5E605E2182E7799A858F65

Uniqueness

Uniqueness Score: -1.00%

Function 00707CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00707D21
GetUserNameA.ADVAPI32(?,?), ref: 00707D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00707D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00707DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00707DC0
EqualSid.ADVAPI32(?,?), ref: 00707DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 00707DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00707DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00707E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00707E12
LocalFree.KERNEL32(00000000), ref: 00707E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00707E35

Strings

D, xrefs: 00707D73
PromptOnSecureDesktop, xrefs: 00707FA0

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: ae8f8cc9e38d0c854f966db04684b941c94a6e50a385067e9c90b75e8a0f93ca
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 61A14C71D00219EFDF118FA0DD88FEEBBB9FB08300F148169E615E6190DB799A85CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
Jan 13 2018, xrefs: 0040653A
except_info, xrefs: 00406728
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
va=%08X%08X uef=%p, xrefs: 00406595
%d=%p, xrefs: 004066F9
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
plgs:, xrefs: 004066AA
12:08:32, xrefs: 00406535
localcfg, xrefs: 0040672D

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
Too big smtp respons (%d bytes), xrefs: 0040A9B1
helo %s, xrefs: 0040A803
rcpt to:<%s>, xrefs: 0040A855
quit, xrefs: 0040A86C
data, xrefs: 0040A85E
AUTH LOGIN, xrefs: 0040A80C
mail from:<%s>, xrefs: 0040A848
Too small respons, xrefs: 0040A9C9
Incorrect respons, xrefs: 0040AB39
localcfg, xrefs: 0040AB0B
., xrefs: 0040A8CA
ESMTP, xrefs: 0040AA38
ehlo %s, xrefs: 0040A7F5

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00707A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00707A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00707ACD
GetLengthSid.ADVAPI32(?), ref: 00707ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00707B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00707B1F
EqualSid.ADVAPI32(?,?), ref: 00707B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 00707B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00707B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00707B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00707B77
LocalFree.KERNEL32(00000000), ref: 00707B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00707B9A
GetAce.ADVAPI32(?,?,?), ref: 00707BCA
EqualSid.ADVAPI32(?,?), ref: 00707BF1
DeleteAce.ADVAPI32(?,?), ref: 00707C0A
EqualSid.ADVAPI32(?,?), ref: 00707C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 00707CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00707CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00707CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00707CE0
LocalFree.KERNEL32(00000000), ref: 00707CEE

Strings

D, xrefs: 00707AC3

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 61c969a913bd9399a2c1faa80875b11a48e00d4fded76add52425ea7e5738472
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 7C813B71D0421AEBDB15CFA4DD48BEFBBFCAF08304F04816AE505E6190D779AA41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3
GetIfEntry, xrefs: 004019E4
]Vw`'Vw, xrefs: 00401A36

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$]Vw`'Vw
API String ID: 835516345-2743630432
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 0070858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0070865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0070867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 007086A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 007086B1

Strings

", xrefs: 0070896C
PromptOnSecureDesktop, xrefs: 007085B6, 00708645, 007086BD, 00708708, 007087C5, 00708812, 007088E9, 00708905

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 7f7dec48784a7a4f8c8b9dbb263bb3c59af1915417fa0a80f83e3c4cc95d8858
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 63C1B371900209FEEB51ABA4DD89EEF7BFCEB04300F144275F640E60D1EB794A948B66

Uniqueness

Uniqueness Score: -1.00%

Function 007014E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00701601
lstrlenW.KERNEL32(-00000003), ref: 007017D8

Strings

<, xrefs: 007015DF
D, xrefs: 0070182D
, xrefs: 007016C9
@, xrefs: 007015E7

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 6ed1f3166b767fa38220526483f69261fbfdbd704ebca32784317ee5e94298bc
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 14F17DB1508381DFD720DF64C888BABB7E5FB88304F908A2DF69597290D7B8D944CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00707666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 007076D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00707757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0070778F
___ascii_stricmp.LIBCMT ref: 007078B4
RegCloseKey.ADVAPI32(?), ref: 0070794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0070796D
RegCloseKey.ADVAPI32(?), ref: 0070797E
RegCloseKey.ADVAPI32(?), ref: 007079AC
RegCloseKey.ADVAPI32(?), ref: 00707A56

Part of subcall function 0070F40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,0070772A,?), ref: 0070F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 007079F6
RegCloseKey.ADVAPI32(?), ref: 00707A4D

Strings

", xrefs: 00707800
PromptOnSecureDesktop, xrefs: 007076C5, 007076CA, 007076E5, 00707782, 007077E6, 00707862, 0070787B, 007079C2

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 045f8e819d211decf6d0ab80a6cd417edb7a481bc182566d5ba7d921b7523964
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: C5C1B272D04209EFDB259BA4DC49FEE7BF9AF45310F1042A1F504E61D1EB79AA84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,76132640,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
]Vw`'Vw, xrefs: 00402E4F

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$]Vw`'Vw
API String ID: 929413710-3538517857
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00702CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00702CED
socket.WS2_32(00000002,00000002,00000011), ref: 00702D07
htons.WS2_32(00000000), ref: 00702D42
select.WS2_32 ref: 00702D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 00702DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00702E62

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: f871355bb295a184707b18c888080b8c38adf5997bbc697c81add561cb052ef5
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 3A61F472504305EBC7209F60DC4CB6BBBF8FB48751F144A19F98497192D7B8EC828BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_MID, xrefs: 0040AEAE
127.0.0.1, xrefs: 0040ADEB

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 0070958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 007095A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 007095D5
GetModuleFileNameA.KERNEL32(00000000), ref: 007095DC
wsprintfA.USER32 ref: 00709635
wsprintfA.USER32 ref: 00709673
wsprintfA.USER32 ref: 007096F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00709758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0070978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 007097D8

Strings

PromptOnSecureDesktop, xrefs: 00709604, 00709624, 00709662, 00709683, 007096B6, 007096DF, 00709701, 00709734, 00709780, 007097B7

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 31b14f8efeff2e82509ac46ccb5f8499bc19c78a2ddd72e77bce0b5f7215bfec
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 2AA152B290020CEFEB21DFA0DC49FDA3BECEB45741F104126FA15D6192E779D9848BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
86A, xrefs: 0040BF98
smtp_herr, xrefs: 0040BE46, 0040BF62
46A, xrefs: 0040BF85
06A, xrefs: 0040BF70

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_HASH, xrefs: 0040B4B0
%TO_USER, xrefs: 0040B488
%FROM_USER, xrefs: 0040B431
%TO_EMAIL, xrefs: 0040B473
%FROM_EMAIL, xrefs: 0040B3E9
%M5DATE, xrefs: 0040B50F
%TO_DOMAIN, xrefs: 0040B44B
%FROM_DOMAIN, xrefs: 0040B41E
%P5DATE, xrefs: 0040B4F2
%s@%s, xrefs: 0040B461
%DATE, xrefs: 0040B4D2

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00701FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0070202D
GetSystemInfo.KERNEL32(?), ref: 0070204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 0070206A
GetProcAddress.KERNEL32(00000000), ref: 00702071
GetCurrentProcess.KERNEL32(?), ref: 00702082
GetTickCount.KERNEL32 ref: 00702230

Part of subcall function 00701E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 00701E7C

Strings

flags_upd, xrefs: 007020A5, 007020AA, 007020E3
work_srv, xrefs: 007020C5
localcfg, xrefs: 00702091, 00702098, 007020AB, 007020E4, 007020F3, 00702119, 00702138, 0070214E, 00702166, 00702183, 0070219B, 007021B7, 007021D7
hi_id, xrefs: 0070217D, 00702182, 0070219A

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: e60f5034f5de5ff9df40058ede1a1cf21f20076265a81cc03440af8f4815295d
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: CE5194B1504348EFE330AF658C89F67BAECEB54704F004A1DF99682183D7BDA9458765

Uniqueness

Uniqueness Score: -1.00%

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7558EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7558EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 00703059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00703068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00703078
GetProcAddress.KERNEL32(00000000,00410408), ref: 00703095
RtlAllocateHeap.NTDLL(00000000), ref: 007030B6
htons.WS2_32(00000035), ref: 007030EF
inet_addr.WS2_32(?), ref: 007030FA
gethostbyname.WS2_32(?), ref: 0070310D
HeapFree.KERNEL32(00000000), ref: 0070314D

Strings

iphlpapi.dll, xrefs: 00703062, 00703067, 00703077

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: cf1c0660d91fea179c54af6bcdd5d6dd688988dc995c92ba76d7b847c25e6dc4
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 1C315731E0060AEBDB119BB89C48AAE77FCAF09761F144365E518E72D0DB78DE418B54

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,76132640,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B
]Vw`'Vw, xrefs: 00402DA0

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll$]Vw`'Vw
API String ID: 3560063639-312264031
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00706778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 007067C3
htonl.WS2_32(?), ref: 007067DF
htonl.WS2_32(?), ref: 007067EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 007068F1
ExitProcess.KERNEL32 ref: 007069BC

Strings

localcfg, xrefs: 00706994
except_info, xrefs: 0070698F

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 76418a5b784e01057503aa99c5a01bf3d45679088f874187ae670668f131a721
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 6A617F71A50208EFDB609FB4DC45FEA77E9FB08300F14816AF96DD21A1DA75A990CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0070F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0070CC84), ref: 0070F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0070F5CE
closesocket.WS2_32(00000000), ref: 0070F5DC

Strings

time_cfg, xrefs: 0070F58A

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: a23fbfd6b9b09caad08dd5e0698cc8b36290fd6af14d588eba3e4f7f141fcc10
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 78314972900119EBDB20DFA5DC899EE7BFCEF89310F104666F915E3190E7749A818BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 00702F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00702FA1
LoadLibraryA.KERNEL32(?), ref: 00702FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00702FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00703000
RtlAllocateHeap.NTDLL(00000000), ref: 00703007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 00703032

Strings

dnsapi.dll, xrefs: 00702F90

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: d237943668d99d5ee67cf637a21747a196146169b66c429bd48f1cb97cc02b12
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 83219271901226FBCB229B54DC48AAFBBFDEF08B50F104521F901E7181D7B8AE8187D4

Uniqueness

Uniqueness Score: -1.00%

Function 00706F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\imehaowx,00707043), ref: 00706F4E
GetProcAddress.KERNEL32(00000000), ref: 00706F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00706F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00706F92

Strings

C:\Windows\SysWOW64\, xrefs: 00706F30, 00706F38, 00706F65, 00706F6C, 00706F7A, 00706F85, 00706F91, 00706FA9, 00706FC6, 00706FEC
PromptOnSecureDesktop, xrefs: 00706F9D, 00706FBF, 00706FCF, 00706FE5, 00706FF5
\\.\pipe\imehaowx, xrefs: 00706F37

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\imehaowx
API String ID: 1082366364-3123451844
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 3eae28b06a11db5cdf03e825eda634c2d4ec7a4a7b172fd1b1d2849f3b406636
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 0721F221B44341F9F7325331AC8DFBB2ACC8B52710F1842A5F504E54C2DADD98E682AD

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 007092CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 007092E2
wsprintfA.USER32 ref: 00709350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00709375
lstrlen.KERNEL32(?,?,00000000), ref: 00709389
WriteFile.KERNEL32(00000000,?,00000000), ref: 00709394
CloseHandle.KERNEL32(00000000), ref: 0070939B

Strings

PromptOnSecureDesktop, xrefs: 0070932B, 00709343, 0070935E

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: a273b97bb30508950f103592c207f0e825e00108a339bed1cfdfdeb41138fb1c
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: D11187B1740114FBE7606731DC0EFEF7AADDBC4B10F008565BB05E50D1EAB85A418664

Uniqueness

Uniqueness Score: -1.00%

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 007099E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00709A18
GetThreadContext.KERNEL32(?,?), ref: 00709A52
TerminateProcess.KERNEL32(?,00000000), ref: 00709A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00709A98
SetThreadContext.KERNEL32(?,00010002), ref: 00709AB5
ResumeThread.KERNEL32(?), ref: 00709AC2

Strings

D, xrefs: 00709A10

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 49b3ab6954cd14da7d1209978f991b570fedbdb6c4576cc765f728612cd18aac
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: EA213BB1A01219FBDB219BA1DC09EEF7BBCEF04750F408161FA19E1091E7798A54CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00701C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00701C18
LoadLibraryA.KERNEL32(004102C8), ref: 00701C26
GetProcessHeap.KERNEL32 ref: 00701C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00701C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00701CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 00701D02
FreeLibrary.KERNEL32(?), ref: 00701D0B

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: abf46115fd32d1dcaa50b1968a2fb5cd36b7549f4a5236ceaa765b3e3e06daf4
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: B5311E31E00219FFCB119FE4DC888AEBBF9EB45751B64457AE501E3150D7B98E80DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402923 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

]Vw`'Vw, xrefs: 00402A04

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ]Vw`'Vw
API String ID: 0-147723481
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 00706CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00706CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00706D22
GetLastError.KERNEL32 ref: 00706DA7
CloseHandle.KERNEL32(?), ref: 00706DB5
GetLastError.KERNEL32 ref: 00706DD6
DeleteFileA.KERNEL32(?), ref: 00706DE7
GetLastError.KERNEL32 ref: 00706DFD

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: d9417bacf85b0eeafa8416bb16f198aa260721d99fa7aee6a69b808cd351a5dd
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 2E31E276A00249FFCF01EFA49D48ADE7FF9EB48300F148265E251E3291D77499658B61

Uniqueness

Uniqueness Score: -1.00%

Function 0070E2FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0070E50A,00000000,00000000,00000000,00020106,00000000,0070E50A,00000000,000000E4), ref: 0070E319
RegSetValueExA.ADVAPI32(0070E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0070E38E
RegDeleteValueA.ADVAPI32(0070E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,Dp), ref: 0070E3BF
RegCloseKey.ADVAPI32(0070E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,Dp,0070E50A), ref: 0070E3C8

Strings

Dp, xrefs: 0070E2FC
PromptOnSecureDesktop, xrefs: 0070E33A

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop$Dp
API String ID: 2667537340-1242397352
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: c4456268d0543188460e5621fc9a8a293847164b1d4ca826cc9d0b2978ece7d0
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: D6215E71A0021DFBDF209FA4EC89EDEBFB9EF08750F048521F904E6191E2718A54D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 007093AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 007093C6
GetModuleFileNameA.KERNEL32(00000000), ref: 007093CD
CharToOemA.USER32(?,?), ref: 007093DB
wsprintfA.USER32 ref: 00709410

Part of subcall function 007092CB: GetTempPathA.KERNEL32(00000400,?), ref: 007092E2
Part of subcall function 007092CB: wsprintfA.USER32 ref: 00709350
Part of subcall function 007092CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00709375
Part of subcall function 007092CB: lstrlen.KERNEL32(?,?,00000000), ref: 00709389
Part of subcall function 007092CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 00709394
Part of subcall function 007092CB: CloseHandle.KERNEL32(00000000), ref: 0070939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00709448

Strings

PromptOnSecureDesktop, xrefs: 007093FA, 007093FF, 0070941C

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 4ab7a0d218566fe51501b960b64e66f14fba66d06223ba1d2b9655732fba89d0
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 8D0192F6900118BBD720A7619D4DEDF37BCDB85701F0000A1BB09E2081DAB896C58F75

Uniqueness

Uniqueness Score: -1.00%

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 0070AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0070AAE5

Strings

localcfg, xrefs: 0070AD72
, xrefs: 0070ABB3

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 2dd263657a24ede65d8eb784aa2972e21c2546ce83af5f22c71ba0109d24a989
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: D471F772B40308FAEF319B54DC85FEE37E9AB00705F244326F905A60D1DA6E9D848767

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 0070E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070DF6C: GetCurrentThreadId.KERNEL32 ref: 0070DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0070E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00706128), ref: 0070E950
lstrcmp.KERNEL32(?,00000008), ref: 0070E989

Strings

A, xrefs: 0070E960, 0070E965
A, xrefs: 0070E9A0
A, xrefs: 0070E8C6, 0070E8CD, 0070E936, 0070E998

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: cdd0e1513e8d6f0941a2b4a26a40204cc7665ce35eeef8392ad3aa0de3babe0c
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 90318C31610705DBDB71CF24C888BAA7BE8EB15720F108A2AE59687591D378F880CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00706E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00706E19

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 748108236992c54585ae676b07027af15122e10792fd2b2d75c007d2324df4fb
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 69213B76104219FFDB119B70EC49EDF3EEDEB49760B208625F602D10D1EA789A509674

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,761311B0,?,00000000,0040E538,?,761311B0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 0070C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0070C6B4
InterlockedIncrement.KERNEL32(0070C74B), ref: 0070C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0070C747), ref: 0070C728
CloseHandle.KERNEL32(00000000,?,0070C747,00413588,00708A77), ref: 0070C733

Strings

localcfg, xrefs: 0070C544

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: b1cff133437ee92479e30dae67f12082858bdfe30a8de4728d68649c7f4a808e
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 1F513BB1A01B41CFD7358F29C98552ABBE9FB48300B505A3EE18BC7AD0D779F8448B10

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,761311B0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,761311B0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,761311B0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,761311B0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,761311B0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,761311B0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,761311B0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 007071C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 007071E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00707228
LocalFree.KERNEL32(?,?,?), ref: 00707286
wsprintfA.USER32 ref: 0070729D

Strings

|, xrefs: 0070721A

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 5904ffdeceb4466b626a4cc14126d53e4b62dd1ba5e346976258deeaa5989818
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 27313C72904108FBCB11DFA8DC49ADA3BFCEF04314F148166F959DB141EA79E648CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 0070B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0070B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0070B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0070B548
GetTimeZoneInformation.KERNEL32(?), ref: 0070B590
wsprintfA.USER32 ref: 0070B61E

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: d066580a625e56964fb7679ad1e831d5fc39845efa53b58139b817014dc803a8
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 065100B1D0021DEACF14DFD5D8895EEBBB9BF48304F10866AF505A6150E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 007062D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 00706303
LoadLibraryA.KERNEL32(?), ref: 0070632A
GetProcAddress.KERNEL32(00000000,?), ref: 007063B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 00706405

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 4b2df583d90ff36b1dea4befc85a6887a1224f44c20f7aefc875062d34fe80ab
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: E9414CB1A00209EBDB14CF58D8A4AA9B7F4FF04354F248269E915DB3D0E779EE50DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(761311B8,00000000,?,761311B0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,761311B0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,761311B0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 0070E3DE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,Dp,00000000,00000000,00000000), ref: 0070E470
CloseHandle.KERNEL32(00000001,00000003), ref: 0070E484

Part of subcall function 0070E2FC: RegCreateKeyExA.ADVAPI32(80000001,0070E50A,00000000,00000000,00000000,00020106,00000000,0070E50A,00000000,000000E4), ref: 0070E319
Part of subcall function 0070E2FC: RegSetValueExA.ADVAPI32(0070E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0070E38E
Part of subcall function 0070E2FC: RegDeleteValueA.ADVAPI32(0070E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,Dp), ref: 0070E3BF
Part of subcall function 0070E2FC: RegCloseKey.ADVAPI32(0070E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,Dp,0070E50A), ref: 0070E3C8

Strings

Dp, xrefs: 0070E498, 0070E4BD, 0070E41A, 0070E447, 0070E4C0, 0070E41D, 0070E459, 0070E45A, 0070E46C, 0070E49B
PromptOnSecureDesktop, xrefs: 0070E4F1, 0070E4F6, 0070E537, 0070E561

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop$Dp
API String ID: 4151426672-1242397352
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: b67b4eae2216135855583e3893e8ed3a73cf4b1dd77d9b44e120191eb3b3845f
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: FD41DE72D00214FAEB205F518C4AFDF3BACEF44724F148635FA09940D2E7B98A50D6B5

Uniqueness

Uniqueness Score: -1.00%

Function 0070E795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0070DF6C: GetCurrentThreadId.KERNEL32 ref: 0070DFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0070A6AC), ref: 0070E7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0070A6AC), ref: 0070E7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0070A6AC), ref: 0070E819

Strings

PromptOnSecureDesktop, xrefs: 0070E840, 0070E845, 0070E87C, 0070E89B

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: c1146d72ee6071685d935e6c35b05930933f574c631f9a9c097c7ff2461c35b0
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 8621E7B2A40301FAE23077719C0FFEB3E9CDB65B60F105625FA09A51D3EA9D985082B5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,761311B0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,761311B0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,761311B0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00707665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 007076D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0070796D
RegCloseKey.ADVAPI32(?), ref: 0070797E

Strings

PromptOnSecureDesktop, xrefs: 007076C5, 007076CA, 007076E5

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: c40250672e2ccc30d5fc75780f2b040b7f13f12d2d6168c8c57c3847399938f8
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 5511AC71A04109EFDB118FA9DC49EAFBFB8EB81710F144261F515E62D1E6B99D40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 00709966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0070999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 007099BD
RegCloseKey.ADVAPI32(?), ref: 007099C6

Strings

PromptOnSecureDesktop, xrefs: 00709989, 0070998E, 007099B0, 007099D3

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: e76a516849abb4a3180378e9c4516ab0a3a3752da83d2f5a45aa5f0b053a1d03
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 13F0F6B2680208FBF7106B50EC0BFDB3A6CDB94B14F100070FA05B50C2F6E99E9182B9

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 007028EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 007028FA
gethostbyname.WS2_32(u6A), ref: 00702906

Strings

time_cfg, xrefs: 007028EB
u6A, xrefs: 007028EC, 007028F9, 00702905

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 246371fac7d59bf08bc2222fe851244e570c25a65e8296b0b52bed7539fefd09
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 07E08C31604111CFCB408B28F848AC577E4AF0A330F008280F040D32E1C7389C829640

Uniqueness

Uniqueness Score: -1.00%

Function 007069C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 007069E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 00706A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 00706A3A
CloseHandle.KERNEL32(000000FF), ref: 00706BD8

Part of subcall function 0070EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00701DCF,?), ref: 0070EEA8
Part of subcall function 0070EE95: HeapFree.KERNEL32(00000000), ref: 0070EEAF

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 906ed86e3a9608ed06de50e6fc13fd39618e572dfb964ea1e3ac2885554dceb6
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 2B7129B190021DEFDF10DFA4CC949EEBBB9FB04314F20466AE515E6190E7349E91DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0070417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 007041AB
GetLastError.KERNEL32 ref: 007041B5
WaitForSingleObject.KERNEL32(?,?), ref: 007041C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 007041D9

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 436a6d301eee9229df9b5e0c28d82529c171526aab2c3ba8a9509683d006626c
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 3301E97651110EEBDF01DF91ED84BEE7BACEB18359F104161FA01E2090D7749A948BB9

Uniqueness

Uniqueness Score: -1.00%

Function 007041F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0070421F
GetLastError.KERNEL32 ref: 00704229
WaitForSingleObject.KERNEL32(?,?), ref: 0070423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0070424D

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 7d10d00d499ac07f99eb23055672c10012d99f299c0d466730b94f5d5e59676b
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 9201A5B2611109ABDF01DF90ED84BEE7BACFB08355F108561FA01E2090D7749A649BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0070E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0070E066

Strings

A, xrefs: 0070E036
A, xrefs: 0070E07F
A, xrefs: 0070E037, 0070E03C

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: ee989ec6da866e75e4a24ca2236dc6f26eb7c3df02037516d74587017e59f0d8
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 55F06272600702DBCB20CF25D884A92B7E9FF45321B648B2AE154C30A0D3B8A898CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 00708330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 007083C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00708477

Part of subcall function 007069C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 007069E5
Part of subcall function 007069C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 00706A26
Part of subcall function 007069C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 00706A3A

Part of subcall function 0070EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00701DCF,?), ref: 0070EEA8
Part of subcall function 0070EE95: HeapFree.KERNEL32(00000000), ref: 0070EEAF

Strings

PromptOnSecureDesktop, xrefs: 007083B2, 007083B7, 00708483

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: ed5f43b52d20b3056ecbf475c63832a0cec4ff4c414f96396c5baa26082d9095
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: C64190B2800149FEEB50EFA0DD85DFF77ECEB00300F044666F544D2191EAB85A948B66

Uniqueness

Uniqueness Score: -1.00%

Function 0070E631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0070E859,00000000,00020119,0070E859,PromptOnSecureDesktop), ref: 0070E64D
RegCloseKey.ADVAPI32(0070E859,?,?,?,?,000000C8,000000E4), ref: 0070E787

Strings

PromptOnSecureDesktop, xrefs: 0070E637

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: cf5a5eb93cd81712f2dd7f4ac734bfdeda87bec65a4bb243625e828c229ada02
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: CD4146B2D0021DFFDF11EF94DC85DEEBBB9EB14304F004966FA10A61A1E3758A558B60

Uniqueness

Uniqueness Score: -1.00%

Function 0070AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0070AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0070B00D

Part of subcall function 0070AF6F: gethostname.WS2_32(?,00000080), ref: 0070AF83
Part of subcall function 0070AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0070AFE6

Part of subcall function 0070331C: gethostname.WS2_32(?,00000080), ref: 0070333F
Part of subcall function 0070331C: gethostbyname.WS2_32(?), ref: 00703349

Part of subcall function 0070AA0A: inet_ntoa.WS2_32(00000000), ref: 0070AA10

Strings

%OUTLOOK_BND_, xrefs: 0070B076, 0070B07B, 0070B0BE, 0070B0DD

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 6827acbf3698685a3369a245493d227fa3c0f4b1b8ab2c8caa05b4b72f53b809
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: A841147290424CEBDB25EFA0DC4AEEF3BACFF04304F144526F92592192EB79E6548B54

Uniqueness

Uniqueness Score: -1.00%

Function 00709452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 00709536
Sleep.KERNEL32(000001F4), ref: 0070955D

Strings

, xrefs: 007094D9

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 6827c31359edcb5c9ab77b1bb460b09ae6beed50640c43c39e4a9549bbaa7897
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 15412571808385EEEB378B65DC9C7E67BE49B42314F2803A5E282971E3E6BC4D818711

Uniqueness

Uniqueness Score: -1.00%

Function 0070BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0070B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0070BA3A
InterlockedIncrement.KERNEL32(?), ref: 0070BA94
GetTickCount.KERNEL32 ref: 0070BB79
GetTickCount.KERNEL32 ref: 0070BB99
InterlockedIncrement.KERNEL32(?), ref: 0070BE15
closesocket.WS2_32(00000000), ref: 0070BEB4

Strings

%FROM_EMAIL, xrefs: 0070BC7D

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 2b3112301957975279169886607490dc11bb65af435a5b4ba1a80f69b19c6650
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: DC315E71500248DFDF25DFA4DC89AE977E8EB48700F204256FA1492191DB79DB85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0070709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 007070BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 007070F4

Strings

|, xrefs: 007070E6

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 10cefcb34136b5c55272ede55dc717ea099146f414004b79c1bfaf257b144ba4
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: AA111872D0411CEBDF15CBD4DC84ADEB7FDAB44301F1442A6E501E61D0E674AB98CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7558EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00703189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00702F88: GetModuleHandleA.KERNEL32(?), ref: 00702FA1
Part of subcall function 00702F88: LoadLibraryA.KERNEL32(?), ref: 00702FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 007031DA
HeapFree.KERNEL32(00000000), ref: 007031E1

Memory Dump Source

Source File: 00000004.00000002.1457259908.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_700000_file.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 5fa702f42920f5470ba0570c07b9f7f45603474db928626c7c0f4478b6068e16
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 69519A3190020AEFCB11DF64D8889EAB7B9FF19305B144669EC96C7291E7369A19CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,76132640,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000004.00000002.1457131872.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1457131872.0000000000414000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wdkncqjt.exePID: 7956, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	30.9%
Signature Coverage:	0%
Total number of Nodes:	1587
Total number of Limit Nodes:	13

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\file.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 0040A189
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A078
P, xrefs: 00409DAA
C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 0040A1D9
ptlohvde, xrefs: 0040A389, 0040A397
C:\Users\user\Desktop\file.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
D, xrefs: 00409F8E
", xrefs: 00409EDB
\, xrefs: 00409D0C

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\file.exe$C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe$D$P$\$ptlohvde
API String ID: 2089075347-2447701589
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,761311B0,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,761311B0,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,761311B0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,761311B0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,761311B0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,761311B0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,761311B0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0074003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0074024D

Strings

kernel32.dll, xrefs: 0074008F, 00740095
cess, xrefs: 0074018D

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 4e37773463db04960ea610d5de5676e08d2a9b3ebfc9bb26bbd888d8c2496cbd
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: A2527874A00229DFDB64CF68C984BA8BBB1BF09304F1480D9E90DAB251DB34AE94DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Uniqueness

Uniqueness Score: -1.00%

Function 0061D9CA Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0061D9F2
Module32First.KERNEL32(00000000,00000224), ref: 0061DA12

Memory Dump Source

Source File: 00000010.00000002.1575910314.0000000000619000.00000040.00000020.00020000.00000000.sdmp, Offset: 00619000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_619000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 2c165b29db12cc72cb96234e6c17815ef3a6a7f4b68e92ed05a1c970f34fb709
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 98F0F6311003146FD7207BF5E88DBEF72EABF49724F140628E642D11C0DB70EC854664

Uniqueness

Uniqueness Score: -1.00%

Function 00740E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00740223,?,?), ref: 00740E19
SetErrorMode.KERNELBASE(00000000,?,?,00740223,?,?), ref: 00740E1E

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 0d95ee2dc00d02904126902d519ad7257b8297a6f4be405c0843031f0b165e47
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 03D0123114512877D7003A94DC09BCD7B1CDF05B62F008411FB0DD9080C774994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Uniqueness

Uniqueness Score: -1.00%

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Uniqueness

Uniqueness Score: -1.00%

Function 0061D689 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0061D6DA

Memory Dump Source

Source File: 00000010.00000002.1575910314.0000000000619000.00000040.00000020.00020000.00000000.sdmp, Offset: 00619000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_619000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 70d02c65c123443b32d183ec83923d1733279a1e7689d0158c2fb6a468728371
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3F113C79A00208EFDB01DF98C985E98BBF5AF08350F198094F9489B362D371EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 007465E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 007465F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00746610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 00746631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00746652

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 1015a6b8d4e37b405196035f5609910990c226b875a90b9d49e2c12596f30f20
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 0F1173B1600218BFDB219F65EC4AF9B3FA8EB057A5F114024F908E7251DBB5DD1086A5

Uniqueness

Uniqueness Score: -1.00%

Function 00749EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00749E6D
lstrcpy.KERNEL32(?,00000000), ref: 00749FE1
lstrcat.KERNEL32(?,?), ref: 00749FF2
lstrcat.KERNEL32(?,0041070C), ref: 0074A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0074A054
DeleteFileA.KERNEL32(?), ref: 0074A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0074A0D6
lstrcpy.KERNEL32 ref: 0074A12F
lstrlen.KERNEL32(00000022), ref: 0074A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 00749F13

Part of subcall function 00747029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 00747081

Part of subcall function 00746F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\imehaowx,00747043), ref: 00746F4E
Part of subcall function 00746F30: GetProcAddress.KERNEL32(00000000), ref: 00746F55
Part of subcall function 00746F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00746F7B
Part of subcall function 00746F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00746F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0074A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0074A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0074A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0074A21B
GetDriveTypeA.KERNEL32(?), ref: 0074A265
lstrcat.KERNEL32(?,00000000), ref: 0074A29F
lstrcat.KERNEL32(?,00410A34), ref: 0074A2C5
lstrcat.KERNEL32(?,00000022), ref: 0074A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0074A2F4
wsprintfA.USER32 ref: 0074A31D
lstrcat.KERNEL32(?,00000000), ref: 0074A345
lstrcat.KERNEL32(?,?), ref: 0074A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0074A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0074A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0074A1D1

Part of subcall function 00749966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0074999D
Part of subcall function 00749966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 007499BD
Part of subcall function 00749966: RegCloseKey.ADVAPI32(?), ref: 007499C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0074A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0074A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0074A41D

Strings

D, xrefs: 0074A1F5
", xrefs: 0074A3F0
P, xrefs: 0074A011
", xrefs: 0074A2DF
", xrefs: 0074A142
\, xrefs: 00749F73

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: d986b72bdb7d80835bec6d491fe8f363047ba8b792898e8006851d006c173c0c
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: BAF14DB1D40259FFDB21DFA08C49EEF7BBCAB09300F5440A6F609E2151E7798A858F65

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtDuplicateToken, xrefs: 004011F3
ntdll.dll, xrefs: 0040100D
RtlLengthSid, xrefs: 00401246
NtQueryInformationToken, xrefs: 00401262
NtSetInformationThread, xrefs: 00401155
RtlSetLastWin32Error, xrefs: 004010D6
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlNtStatusToDosError, xrefs: 00401194
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtOpenProcessToken, xrefs: 004011D4
NtTerminateProcess, xrefs: 004010F6
RtlFreeSid, xrefs: 00401116
NtClose, xrefs: 004011B4
NtFilterToken, xrefs: 0040122B
RtlInitUnicodeString, xrefs: 00401135
NtSetInformationToken, xrefs: 00401175

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Mon, xrefs: 0040B22C
Aug, xrefs: 0040B287
Nov, xrefs: 0040B29C
Feb, xrefs: 0040B25D
Wed, xrefs: 0040B23A
May, xrefs: 0040B272
Mar, xrefs: 0040B264
Sun, xrefs: 0040B225
Jun, xrefs: 0040B279
Apr, xrefs: 0040B26B
Fri, xrefs: 0040B248
Dec, xrefs: 0040B2A3
Jul, xrefs: 0040B280
Jan, xrefs: 0040B256
Tue, xrefs: 0040B233
Thu, xrefs: 0040B241
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Sat, xrefs: 0040B24F
Oct, xrefs: 0040B295
Sep, xrefs: 0040B28E

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe$D
API String ID: 2976863881-2306690221
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00747CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00747D21
GetUserNameA.ADVAPI32(?,?), ref: 00747D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00747D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00747DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00747DC0
EqualSid.ADVAPI32(?,?), ref: 00747DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 00747DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00747DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00747E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00747E12
LocalFree.KERNEL32(00000000), ref: 00747E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00747E35

Strings

D, xrefs: 00747D73
C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 00747F49, 00747F76, 00747F8A, 00747F8B

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe$D
API String ID: 2976863881-2306690221
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: f8b34ed57ea39d59eb4b11cb1a3505c2aa00a1630071442f917a0eace9ad89b1
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 0DA14B71900219EFDF11CFA0DD88FEEBBB9FB08300F14816AE615E6150DB798A85CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

12:08:32, xrefs: 00406535
plgs:, xrefs: 004066AA
%d=%p, xrefs: 004066F9
va=%08X%08X uef=%p, xrefs: 00406595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
localcfg, xrefs: 0040672D
Jan 13 2018, xrefs: 0040653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

., xrefs: 0040A8CA
AUTH LOGIN, xrefs: 0040A80C
Incorrect respons, xrefs: 0040AB39
quit, xrefs: 0040A86C
localcfg, xrefs: 0040AB0B
mail from:<%s>, xrefs: 0040A848
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ESMTP, xrefs: 0040AA38
Too small respons, xrefs: 0040A9C9
helo %s, xrefs: 0040A803
data, xrefs: 0040A85E
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
rcpt to:<%s>, xrefs: 0040A855
ehlo %s, xrefs: 0040A7F5

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00747A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00747A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00747ACD
GetLengthSid.ADVAPI32(?), ref: 00747ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00747B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00747B1F
EqualSid.ADVAPI32(?,?), ref: 00747B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 00747B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00747B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00747B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00747B77
LocalFree.KERNEL32(00000000), ref: 00747B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00747B9A
GetAce.ADVAPI32(?,?,?), ref: 00747BCA
EqualSid.ADVAPI32(?,?), ref: 00747BF1
DeleteAce.ADVAPI32(?,?), ref: 00747C0A
EqualSid.ADVAPI32(?,?), ref: 00747C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 00747CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00747CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00747CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00747CE0
LocalFree.KERNEL32(00000000), ref: 00747CEE

Strings

D, xrefs: 00747AC3

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 6d5ce4fc84ce9974c9853f1ebcb556059f1cc5513be25013d457977b87ecc2c6
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 7C815B71904219AFDB25CFA4DD88FEEBBBCEF08304F04806AE505E6150E7799A41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe$localcfg
API String ID: 237177642-4107672054
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7612F620), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7612F620), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

]Vw`'Vw, xrefs: 00402A86, 00402C02

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: ]Vw`'Vw
API String ID: 1639031587-147723481
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

%systemroot%\system32\cmd.exe, xrefs: 00401316
@, xrefs: 00401380
wusa.exe, xrefs: 00401388
, xrefs: 00401462
@EJv, xrefs: 0040139A
useless, xrefs: 0040161E
<, xrefs: 00401378
uac, xrefs: 00401628
D, xrefs: 004015C6

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$@EJv$D$uac$useless$wusa.exe
API String ID: 1628651668-3954050976
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
GetBestInterface, xrefs: 004019EF
]Vw`'Vw, xrefs: 00401A36
GetAdaptersInfo, xrefs: 004019DC
123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
Iphlpapi.dll, xrefs: 004019B7

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$]Vw`'Vw
API String ID: 835516345-2743630432
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

hi_id, xrefs: 00401F16, 00401F1B, 00401F33
kernel32, xrefs: 00401DF7
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
loader_id, xrefs: 00401F4B, 00401F6B
start_srv, xrefs: 00401E6C
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
lid_file_upd, xrefs: 00401E25
born_date, xrefs: 00401EAD, 00401ECC
net_type, xrefs: 00401E87
work_srv, xrefs: 00401E5E
IsWow64Process, xrefs: 00401DF2

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0074858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0074865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0074867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 007486A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 007486B1

Strings

C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 0074882F, 0074883C, 0074884C
", xrefs: 0074896C

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe
API String ID: 237177642-2344421956
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 355089f920a2aef7cc216b93c229489c2b79bb82e6c03665f61512eb923c60e7
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 7DC1907190024DFEEB51ABA4DD89EFF7BBCEB05300F144076F604E6051EBB84A949B66

Uniqueness

Uniqueness Score: -1.00%

Function 007414E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00741601
lstrlenW.KERNEL32(-00000003), ref: 007417D8

Strings

<, xrefs: 007415DF
D, xrefs: 0074182D
, xrefs: 007416C9
@, xrefs: 007415E7

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: b779b260d34a436f15c1bcca5e9103bd6dc3a1d58177830f69769b573dcb701c
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: B3F18EB15083819FD720EF64C888BABB7E4FB89304F50892DF595D7290D7B8E984CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,76132640,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
]Vw`'Vw, xrefs: 00402E4F
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$]Vw`'Vw
API String ID: 929413710-3538517857
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00747666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 007476D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00747757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0074778F
___ascii_stricmp.LIBCMT ref: 007478B4
RegCloseKey.ADVAPI32(?), ref: 0074794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0074796D
RegCloseKey.ADVAPI32(?), ref: 0074797E
RegCloseKey.ADVAPI32(?), ref: 007479AC
RegCloseKey.ADVAPI32(?), ref: 00747A56

Part of subcall function 0074F40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,0074772A,?), ref: 0074F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 007479F6
RegCloseKey.ADVAPI32(?), ref: 00747A4D

Strings

", xrefs: 00747800

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: dcc47306138f02559c9c51e1ba2d735cb8d8f49f90aa56220ec59c865973cc3e
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: A3C1A072904209EFEB259FA4DC49FEE7BB9EF45310F2040A5F504E6191EB799E84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,761311B0,?,761311B0,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(761311B0,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,761311B0,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(761311B0,?,761311B0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(761311B0), ref: 00407208
RegCloseKey.ADVAPI32(761311B0), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(761311B0), ref: 004072D0
RegCloseKey.ADVAPI32(761311B0), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(761311B0), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00742CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00742CED
socket.WS2_32(00000002,00000002,00000011), ref: 00742D07
htons.WS2_32(00000000), ref: 00742D42
select.WS2_32 ref: 00742D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 00742DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00742E62

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 97dd1b67a814434a3686414e53eded37f4486729584d9aedd3ed5dff16ec5b2b
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 6061F171904315ABC3209F61CC0CBABBBF8FF88341F954819F98497152D7B8D896CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_MID, xrefs: 0040AEAE
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,761311B0,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,761311B0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,761311B0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,761311B0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,761311B0,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,761311B0,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,761311B0,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,761311B0,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,761311B0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,761311B0,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,761311B0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_EMAIL, xrefs: 0040B473
%TO_HASH, xrefs: 0040B4B0
%FROM_EMAIL, xrefs: 0040B3E9
%s@%s, xrefs: 0040B461
%FROM_USER, xrefs: 0040B431
%TO_DOMAIN, xrefs: 0040B44B
%P5DATE, xrefs: 0040B4F2
%FROM_DOMAIN, xrefs: 0040B41E
%TO_USER, xrefs: 0040B488
%M5DATE, xrefs: 0040B50F
%DATE, xrefs: 0040B4D2

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00741FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0074202D
GetSystemInfo.KERNEL32(?), ref: 0074204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 0074206A
GetProcAddress.KERNEL32(00000000), ref: 00742071
GetCurrentProcess.KERNEL32(?), ref: 00742082
GetTickCount.KERNEL32 ref: 00742230

Part of subcall function 00741E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 00741E7C

Strings

flags_upd, xrefs: 007420A5, 007420AA, 007420E3
work_srv, xrefs: 007420C5
hi_id, xrefs: 0074217D, 00742182, 0074219A
localcfg, xrefs: 00742091, 00742098, 007420AB, 007420E4, 007420F3, 00742119, 00742138, 0074214E, 00742166, 00742183, 0074219B, 007421B7, 007421D7

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 198f0d33f0d59ab4e133cd479612102028f22039550b4ff87ac6f57e3c69f9c3
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 7651B0B0900348AFE330AF758C8AF67BAECFB54704F40492DF99682143D7BDA9958765

Uniqueness

Uniqueness Score: -1.00%

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7558EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7558EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 00743059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00743068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00743078
GetProcAddress.KERNEL32(00000000,00410408), ref: 00743095
RtlAllocateHeap.NTDLL(00000000), ref: 007430B6
htons.WS2_32(00000035), ref: 007430EF
inet_addr.WS2_32(?), ref: 007430FA
gethostbyname.WS2_32(?), ref: 0074310D
HeapFree.KERNEL32(00000000), ref: 0074314D

Strings

iphlpapi.dll, xrefs: 00743062, 00743067, 00743077

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 864b56fa5fe5af2282559075a2eb445ef3748741aa7779e45a6fb218e4da7d90
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 97319A31A0060AABDF119BB89C48AAE7778EF04761F144225F51CE7290DB7CDF41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,76132640,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

]Vw`'Vw, xrefs: 00402DA0
dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll$]Vw`'Vw
API String ID: 3560063639-312264031
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 0074958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 007495A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 007495D5
GetModuleFileNameA.KERNEL32(00000000), ref: 007495DC
wsprintfA.USER32 ref: 00749635
wsprintfA.USER32 ref: 00749673
wsprintfA.USER32 ref: 007496F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00749758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0074978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 007497D8

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: ae6d1a74b350a94d5b8a397cbe4073c44ee22f232896630728f40eee73421cac
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: D7A16BB1940208EBEB21DFA0CC49FDB3BACEB45741F204026FA1596152E7B9D984CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,76128A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Uniqueness

Uniqueness Score: -1.00%

Function 00746778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 007467C3
htonl.WS2_32(?), ref: 007467DF
htonl.WS2_32(?), ref: 007467EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 007468F1
ExitProcess.KERNEL32 ref: 007469BC

Strings

except_info, xrefs: 0074698F
localcfg, xrefs: 00746994

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 56d2a40df6b4aad73c63c38996c659fe959fb88f387219c4e4e877d0628ec318
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 1D615F71940208EFDB609FA4DC45FEA77E9FB09300F14806AF96DD2161DBB5A9908F54

Uniqueness

Uniqueness Score: -1.00%

Function 0074F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0074CC84), ref: 0074F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0074F5CE
closesocket.WS2_32(00000000), ref: 0074F5DC

Strings

time_cfg, xrefs: 0074F58A

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: f6a2ddb5b5a291d4193c385a1d9cdcb4203fb2485dcab6c1f4c81871e425f971
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 24317872901118ABDB10DFA9DC89DEFBBBCEF88310F11456AF915E3150E7748A818BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 00742F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00742FA1
LoadLibraryA.KERNEL32(?), ref: 00742FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00742FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00743000
RtlAllocateHeap.NTDLL(00000000), ref: 00743007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 00743032

Strings

dnsapi.dll, xrefs: 00742F90

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 450330b5ad563baddef2fceec9a9b61318ff3c8c145422806621fa57b8df3b03
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: B221C171940229BBCB219B95DC48AEEBBBDEF08B10F404421F905E3150D7B89E8587E0

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 007499E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00749A18
GetThreadContext.KERNEL32(?,?), ref: 00749A52
TerminateProcess.KERNEL32(?,00000000), ref: 00749A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00749A98
SetThreadContext.KERNEL32(?,00010002), ref: 00749AB5
ResumeThread.KERNEL32(?), ref: 00749AC2

Strings

D, xrefs: 00749A10

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 9d6b62081588d00201d640c3d129d79b9d8a06d6a0fb29ba6d5aa87621164ac0
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: E9213BB1A01219BBDB11DBA1DC09EEFBBBCEF05750F408061FA19E1150E7798A44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00741C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00741C18
LoadLibraryA.KERNEL32(004102C8), ref: 00741C26
GetProcessHeap.KERNEL32 ref: 00741C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00741C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00741CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 00741D02
FreeLibrary.KERNEL32(?), ref: 00741D0B

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 5fa7d3c7aff946033c0c49fc085b765df152c9afc4c19583a06074b4e51db22a
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 97314F71E00219FFCB11AFE4DD888FEBBB9EB45711B64447AE505A2110D7B94EC0DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402923 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

]Vw`'Vw, xrefs: 00402A04

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID:
String ID: ]Vw`'Vw
API String ID: 0-147723481
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 00746CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00746CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00746D22
GetLastError.KERNEL32 ref: 00746DA7
CloseHandle.KERNEL32(?), ref: 00746DB5
GetLastError.KERNEL32 ref: 00746DD6
DeleteFileA.KERNEL32(?), ref: 00746DE7
GetLastError.KERNEL32 ref: 00746DFD

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ce0cdec72c218be419ce2d37e57b0b6d1f86778aa247fafa450894609603c039
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6F31BD76E00249FFCF01AFA4DD48ADE7FB9EB4A310F148066E251E3251D7748A958F62

Uniqueness

Uniqueness Score: -1.00%

Function 00746F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\imehaowx,00747043), ref: 00746F4E
GetProcAddress.KERNEL32(00000000), ref: 00746F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00746F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00746F92

Strings

\\.\pipe\imehaowx, xrefs: 00746F37
C:\Windows\SysWOW64\, xrefs: 00746F30, 00746F38, 00746F65, 00746F6C, 00746F7A, 00746F85, 00746F91, 00746FA9, 00746FC6, 00746FEC

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\imehaowx
API String ID: 1082366364-2204482974
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 7d6cb92cb9b5bb9565179f88736f21de2e78f07f11fe95e4294d6cce5a01c62c
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: E6210521745344BAF7225331AC8DFFB2E4C8B53721F1840A5F544E64A2DBDD88DAC2AE

Uniqueness

Uniqueness Score: -1.00%

Function 0074AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0074AAE5

Strings

, xrefs: 0074ABB3
localcfg, xrefs: 0074AD72

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 52f434c64c9b9c3270739fbb5144e6cf5e7d23f5037b002a10bdae966abe0009
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 227129B1FC4308BAEF218B54DCC6FEE3769EB01705F244026F905A6091DB6E9D848B67

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 0074E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0074DF6C: GetCurrentThreadId.KERNEL32 ref: 0074DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0074E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00746128), ref: 0074E950
lstrcmp.KERNEL32(?,00000008), ref: 0074E989

Strings

A, xrefs: 0074E9A0
A, xrefs: 0074E960, 0074E965
A, xrefs: 0074E8C6, 0074E8CD, 0074E936, 0074E998

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 4184892cc4629e26c79c73dd90967e87b5a00d68d601dba0f994c8b258f07060
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 0E317E31600715EBDF718F24C888BA67BE8FB15731F10892AE59687591D378FC84CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 00746E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00746E19

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 7e862f71146ab3dbc8b46b0d3f69da226e992cecf6d8899443596fcbb73a8df2
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: A4214D76504125FFEB109B70FC49EDF3FEDEB4A760B208425F502D1091EB799A409675

Uniqueness

Uniqueness Score: -1.00%

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 007492CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 007492E2
wsprintfA.USER32 ref: 00749350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00749375
lstrlen.KERNEL32(?,?,00000000), ref: 00749389
WriteFile.KERNEL32(00000000,?,00000000), ref: 00749394
CloseHandle.KERNEL32(00000000), ref: 0074939B

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 5f7f354fc97b7a13501a8a7e0c6cc6d804e5faef1ee494a97efc8631acc521c7
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 9D1196B1740114BBE7606B31EC0EFEF3A6DDBC9B10F00C065BB09E5091EFB84A558664

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,761311B0,?,00000000,0040E538,?,761311B0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 0074C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0074C6B4
InterlockedIncrement.KERNEL32(0074C74B), ref: 0074C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0074C747), ref: 0074C728
CloseHandle.KERNEL32(00000000,?,0074C747,00413588,00748A77), ref: 0074C733

Strings

localcfg, xrefs: 0074C544

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 27ecf7a9895b7f5e0d05ef4024b614188c6c7862e9cae8d0978497e1842a53fb
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 5B514BB1A02B418FD7659F29C5C552AFBE9FB48300B61593EE18BC7AA0D778F840CB11

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,761311B0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,761311B0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,761311B0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,761311B0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,761311B0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,761311B0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,761311B0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe
API String ID: 124786226-3552900515
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 0074E2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0074E50A,00000000,00000000,00000000,00020106,00000000,0074E50A,00000000,000000E4), ref: 0074E319
RegSetValueExA.ADVAPI32(0074E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0074E38E
RegDeleteValueA.ADVAPI32(0074E50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dt), ref: 0074E3BF
RegCloseKey.ADVAPI32(0074E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dt,0074E50A), ref: 0074E3C8

Strings

Dt, xrefs: 0074E2FC

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: Dt
API String ID: 2667537340-659336120
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 1adb0634de8ea2fb60c19c2f6943b1803670e00a5ac758984722de7196f2a9f4
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 7B214A71A0021DABDF219FA4EC89EEE7F79EF08760F008061F904A6161E7718A54D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 007471C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 007471E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00747228
LocalFree.KERNEL32(?,?,?), ref: 00747286
wsprintfA.USER32 ref: 0074729D

Strings

|, xrefs: 0074721A

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 4e0ac2281bfdcf3eeffacd8172dc54d93a9318ec5f4f278f2d99d197afbcf7c6
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 65311C72904108BBDB01DFA4DC49ADA7BBCEF04354F148166F959DB101EB79D648CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 0074B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0074B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0074B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0074B548
GetTimeZoneInformation.KERNEL32(?), ref: 0074B590
wsprintfA.USER32 ref: 0074B61E

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 5a483ba9c181d32b59ec1d4d3e8be2a0a6ecab30b81a7d404f6ff0012d9b56a2
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 445110B1D0021CAACF14DFD5D8895EEFBB9BF48304F10816AF505A6150E7B88AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 007462D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 00746303
LoadLibraryA.KERNEL32(?), ref: 0074632A
GetProcAddress.KERNEL32(00000000,?), ref: 007463B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 00746405

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 5d9c18f314b851374638d268d507b3f30a3966ad971af20d6f66721eb79b006e
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 76418BB1A00259EFDB14CF98C884BA9B7B8FF06314F288079E915D7290E778EE40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(761311B8,00000000,?,761311B0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,761311B0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,761311B0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 007493AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 007493C6
GetModuleFileNameA.KERNEL32(00000000), ref: 007493CD
CharToOemA.USER32(?,?), ref: 007493DB
wsprintfA.USER32 ref: 00749410

Part of subcall function 007492CB: GetTempPathA.KERNEL32(00000400,?), ref: 007492E2
Part of subcall function 007492CB: wsprintfA.USER32 ref: 00749350
Part of subcall function 007492CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00749375
Part of subcall function 007492CB: lstrlen.KERNEL32(?,?,00000000), ref: 00749389
Part of subcall function 007492CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 00749394
Part of subcall function 007492CB: CloseHandle.KERNEL32(00000000), ref: 0074939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00749448

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 5b0afed918e05817027b93285f97f35c5544dbc408577a5be77044217c42c8d7
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 0C0140F6940158BBD721A7619D4DEDF367CDB95701F0040A1BB49E2080DBB896C58F75

Uniqueness

Uniqueness Score: -1.00%

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 007428EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 007428FA
gethostbyname.WS2_32(u6A), ref: 00742906

Strings

time_cfg, xrefs: 007428EB
u6A, xrefs: 007428EC, 007428F9, 00742905

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 23370dd8c60b69d6c34cfbdf1cb7a4bb7d0b182411274f3a34a596063c270ce9
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 3EE0C2306041118FDB008B2CF848AD937E8EF0A330F4181C0F040D31A1C738DCC29744

Uniqueness

Uniqueness Score: -1.00%

Function 007469C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 007469E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 00746A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 00746A3A
CloseHandle.KERNEL32(000000FF), ref: 00746BD8

Part of subcall function 0074EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00741DCF,?), ref: 0074EEA8
Part of subcall function 0074EE95: HeapFree.KERNEL32(00000000), ref: 0074EEAF

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 70b153c39bcc3250b292f3387199e545d0676331704becc08bc279525286ee4e
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 5A7128B190021DEFDF10DFA4CC849EEBBB9FB05314F20856AE525E6190D7349E92DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0074417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 007441AB
GetLastError.KERNEL32 ref: 007441B5
WaitForSingleObject.KERNEL32(?,?), ref: 007441C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 007441D9

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: c29e354f7fe9fe5c24e93d1d96e7dab8dc0b6d8d51ba243aa0c1ef1d396c8d3d
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 2901A57691110EABDF01DF91ED84BEE7BACEB18355F108061F901E2050D7749AA49BBA

Uniqueness

Uniqueness Score: -1.00%

Function 007441F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0074421F
GetLastError.KERNEL32 ref: 00744229
WaitForSingleObject.KERNEL32(?,?), ref: 0074423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0074424D

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 1473bd6191cc85010d6ffbb92c8b1d25d71cefb7fd08400c5da6d219f8b44a70
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 2401A272911209ABDF01DF90EE84BEF7BACFB08356F108461F901E2050D7B4AA549BB6

Uniqueness

Uniqueness Score: -1.00%

Function 0074E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0074E066

Strings

A, xrefs: 0074E036
A, xrefs: 0074E037, 0074E03C
A, xrefs: 0074E07F

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 8aaa5b77b89296526ad358b4c1df79fe0c8e6d6a5fa967e5a3783b1d9fa9c5bf
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 09F062312007029BCB20CF65D884A92B7E9FB05331B64862BE164C3070D3B8A898CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0074E3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,Dt,00000000,00000000,00000000), ref: 0074E470
CloseHandle.KERNEL32(00000001,00000003), ref: 0074E484

Part of subcall function 0074E2FC: RegCreateKeyExA.ADVAPI32(80000001,0074E50A,00000000,00000000,00000000,00020106,00000000,0074E50A,00000000,000000E4), ref: 0074E319
Part of subcall function 0074E2FC: RegSetValueExA.ADVAPI32(0074E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0074E38E
Part of subcall function 0074E2FC: RegDeleteValueA.ADVAPI32(0074E50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dt), ref: 0074E3BF
Part of subcall function 0074E2FC: RegCloseKey.ADVAPI32(0074E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dt,0074E50A), ref: 0074E3C8

Strings

Dt, xrefs: 0074E498, 0074E4BD, 0074E41A, 0074E447, 0074E4C0, 0074E41D, 0074E459, 0074E45A, 0074E46C, 0074E49B

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: Dt
API String ID: 4151426672-659336120
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: ba14b2dad52c724a3cc9ffda283e92c49a52d42b03440a39f38ac6dc6695b3e6
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 3641C975D00214FAEB206F558C4AFEB3B6CFF04734F548075FA0994092E7B98A60D6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00748330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 007483C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00748477

Part of subcall function 007469C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 007469E5
Part of subcall function 007469C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 00746A26
Part of subcall function 007469C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 00746A3A

Part of subcall function 0074EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00741DCF,?), ref: 0074EEA8
Part of subcall function 0074EE95: HeapFree.KERNEL32(00000000), ref: 0074EEAF

Strings

C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 0074848C, 007484A1

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe
API String ID: 359188348-3552900515
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: f52b0a36ead8e8df21503e5bfe4aeeebc75ebe385756fb450ae31b20b00dda67
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 7E4160B290015DBFEB50AFA89D85EFF776CEB04340F144466F604E6011EBB85A948B66

Uniqueness

Uniqueness Score: -1.00%

Function 0074AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0074AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0074B00D

Part of subcall function 0074AF6F: gethostname.WS2_32(?,00000080), ref: 0074AF83
Part of subcall function 0074AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0074AFE6

Part of subcall function 0074331C: gethostname.WS2_32(?,00000080), ref: 0074333F
Part of subcall function 0074331C: gethostbyname.WS2_32(?), ref: 00743349

Part of subcall function 0074AA0A: inet_ntoa.WS2_32(00000000), ref: 0074AA10

Strings

%OUTLOOK_BND_, xrefs: 0074B076, 0074B07B, 0074B0BE, 0074B0DD

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 219c482d39adef3bb600db47c4808480764c744fc37ad5451805e0db6fdf53c7
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 1841027290424CEBDB25EFA0DC4AEEF3B6CFB44304F144426F92992152EB79DA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 00749452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 00749536
Sleep.KERNEL32(000001F4), ref: 0074955D

Strings

, xrefs: 007494D9

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: ff1f4f068ed69e31fe36194be591787ceb3ccef477b7061d501fa6e8c11d93bd
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: E3411571804384AEEB778A68D88DBA7BBA49B02310F3440E5D282971E2E77C4D918711

Uniqueness

Uniqueness Score: -1.00%

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0074BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0074B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0074BA3A
InterlockedIncrement.KERNEL32(?), ref: 0074BA94
GetTickCount.KERNEL32 ref: 0074BB79
GetTickCount.KERNEL32 ref: 0074BB99
InterlockedIncrement.KERNEL32(?), ref: 0074BE15
closesocket.WS2_32(00000000), ref: 0074BEB4

Strings

%FROM_EMAIL, xrefs: 0074BC7D

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: c2df54dd6ab5b1124752b36b5f646c0dbfeaf672b73ee6afc5ad555f07d3f404
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 8A319F71900258EFDF25DFA4DC88AED77B8EB88700F204066FA2482161DB39DE85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0074709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 007470BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 007470F4

Strings

|, xrefs: 007470E6

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: f572759d8d8aa6e0e8aff4aaa37f5e7e3d837ea82455bfda58608e8463382bb9
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: CB11617290411CEBDF15CFE4DD84ADEB7BCAB48301F1441A6E501F6090E7749B88CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7558EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,76132640,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000010.00000002.1575682515.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00743189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00742F88: GetModuleHandleA.KERNEL32(?), ref: 00742FA1
Part of subcall function 00742F88: LoadLibraryA.KERNEL32(?), ref: 00742FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 007431DA
HeapFree.KERNEL32(00000000), ref: 007431E1

Memory Dump Source

Source File: 00000010.00000002.1575964842.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Offset: 00740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_740000_wdkncqjt.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: cb9aca7940ffeab1b22cffcc8ef01076bcec0416c2718d61b318512b16401b49
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 8D519A3190024AEFCF019F64D8889FAB775FF15305F244169EC9AC7221E776DA19CB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 6024, Parent PID: 7956COMMON

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1809
Total number of Limit Nodes:	18

Executed Functions

Function 025AC913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 025ACA4E
closesocket.WS2_32(?), ref: 025ACB63
GetTempPathA.KERNEL32(00000120,?), ref: 025ACC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 025ACCB4
WriteFile.KERNEL32(025AA4B3,?,-000000E8,?,00000000), ref: 025ACCDC
CloseHandle.KERNEL32(025AA4B3), ref: 025ACCED
wsprintfA.USER32 ref: 025ACD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 025ACD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 025ACD89
CloseHandle.KERNEL32(?), ref: 025ACD98
CloseHandle.KERNEL32(?), ref: 025ACD9D
DeleteFileA.KERNEL32(?), ref: 025ACDC4
CloseHandle.KERNEL32(025AA4B3), ref: 025ACDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 025ACFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 025ACFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 025AD033
lstrcatA.KERNEL32(?,03F00108), ref: 025AD10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 025AD155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 025AD171
WriteFile.KERNEL32(00000000,03F0012C,?,?,00000000), ref: 025AD195
CloseHandle.KERNEL32(00000000), ref: 025AD19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 025AD1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 025AD231
lstrcatA.KERNEL32(?,03F00108,?,?,?,?,?,?,?,00000100), ref: 025AD27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 025AD2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 025AD2C7
WriteFile.KERNEL32(00000000,03F0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 025AD2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 025AD2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 025AD326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 025AD372
lstrcatA.KERNEL32(?,03F00108,?,?,?,?,?,?,?,00000100), ref: 025AD3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 025AD3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 025AD408
WriteFile.KERNEL32(00000000,03F0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 025AD428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 025AD42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 025AD45B
CreateProcessA.KERNEL32(?,025B0264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 025AD4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 025AD4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 025AD4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 025AD513
closesocket.WS2_32(?), ref: 025AD56C
Sleep.KERNEL32(000003E8), ref: 025AD577
ExitProcess.KERNEL32 ref: 025AD583
wsprintfA.USER32 ref: 025AD81F

Part of subcall function 025AC65C: send.WS2_32(00000000,?,00000000), ref: 025AC74B

closesocket.WS2_32(?), ref: 025ADAD5

Strings

lid_file_upd, xrefs: 025ACE6A
C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 025ACC10, 025ACCF3, 025AD975, 025AD98E
time_cfg, xrefs: 025AC95B, 025AC962, 025AC971, 025AC984
localcfg, xrefs: 025ACA89, 025ACA93, 025ACAC0, 025ACAD2, 025ACE4F, 025ACE6F, 025AD8D3, 025AD8FC
local_time, xrefs: 025ACACD
wtm_r, xrefs: 025AC97F
\, xrefs: 025AD39D
\, xrefs: 025AD3A7
.dat, xrefs: 025AD0D7, 025AD138, 025AD1AE, 025AD1D4, 025AD28E, 025AD308, 025AD3CF, 025AD441
except_info, xrefs: 025AD8CD, 025AD8D2, 025AD8FB
flags_upd, xrefs: 025ACE4A
wtm_w, xrefs: 025AC96C
wtm_c, xrefs: 025AC956
srv_time, xrefs: 025ACABB
@, xrefs: 025AD754
4, xrefs: 025AD9F7
.sys, xrefs: 025AD0CC
work_srv, xrefs: 025AD607, 025AD60F, 025AD62C
drivers\, xrefs: 025AD067

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-1188463005
Opcode ID: 78e515f76d9b6a0a8133381edf881b3cbff643fbcf15fd79fab0da22e5927a77
Instruction ID: dbde9c55cd78c99c58654e23db9513c9792c7b1872bfb449ff6deb5f356af375
Opcode Fuzzy Hash: 78e515f76d9b6a0a8133381edf881b3cbff643fbcf15fd79fab0da22e5927a77
Instruction Fuzzy Hash: D3B2B571D41209AFEB11AF64DCAAFEE7BB9FB48304F04046AE505E7180E7309959DF68

Uniqueness

Uniqueness Score: -1.00%

Function 025A9A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 025A9A7F
SetErrorMode.KERNELBASE(00000003), ref: 025A9A83
SetUnhandledExceptionFilter.KERNEL32(025A6511), ref: 025A9A8A

Part of subcall function 025AEC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 025AEC5E
Part of subcall function 025AEC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 025AEC72
Part of subcall function 025AEC54: GetTickCount.KERNEL32 ref: 025AEC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 025A9AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 025A9ABA
GetCommandLineA.KERNEL32 ref: 025A9AFD
lstrlenA.KERNEL32(?), ref: 025A9B99
ExitProcess.KERNEL32 ref: 025A9C06
GetTempPathA.KERNEL32(000001F4,?), ref: 025A9CAC
lstrcpyA.KERNEL32(?,00000000), ref: 025A9D7A
lstrcatA.KERNEL32(?,?), ref: 025A9D8B
lstrcatA.KERNEL32(?,025B070C), ref: 025A9D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 025A9DED
DeleteFileA.KERNEL32(00000022), ref: 025A9E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 025A9E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 025A9EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 025A9ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 025A9F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 025A9F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 025A9F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 025A9FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 025A9FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 025A9FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 025AA038
lstrcatA.KERNEL32(00000022,025B0A34), ref: 025AA05E
lstrcatA.KERNEL32(00000022,00000022), ref: 025AA072
lstrcatA.KERNEL32(00000022,025B0A34), ref: 025AA08D
wsprintfA.USER32 ref: 025AA0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 025AA0DE
lstrcatA.KERNEL32(00000022,?), ref: 025AA0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 025AA120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 025AA131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 025AA174
GetModuleFileNameA.KERNEL32(00000000), ref: 025AA17B
GetDriveTypeA.KERNEL32(00000022), ref: 025AA1B6
GetCommandLineA.KERNEL32 ref: 025AA1E5

Part of subcall function 025A99D2: lstrcpyA.KERNEL32(?,?,00000100,025B22F8,00000000,?,025A9E9D,?,00000022,?,?,?,?,?,?,?), ref: 025A99DF
Part of subcall function 025A99D2: lstrcatA.KERNEL32(00000022,00000000,?,?,025A9E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 025A9A3C
Part of subcall function 025A99D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,025A9E9D,?,00000022,?,?,?), ref: 025A9A52

lstrlenA.KERNEL32(?), ref: 025AA288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 025AA3B7
GetLastError.KERNEL32 ref: 025AA3ED
Sleep.KERNEL32(000003E8), ref: 025AA400
DeleteFileA.KERNELBASE(025B33D8), ref: 025AA407
CreateThread.KERNELBASE(00000000,00000000,025A405E,00000000,00000000,00000000), ref: 025AA42C
WSAStartup.WS2_32(00001010,?), ref: 025AA43A
CreateThread.KERNELBASE(00000000,00000000,025A877E,00000000,00000000,00000000), ref: 025AA469
Sleep.KERNELBASE(00000BB8), ref: 025AA48A
GetTickCount.KERNEL32 ref: 025AA49F
GetTickCount.KERNEL32 ref: 025AA4B7
Sleep.KERNELBASE(00001A90), ref: 025AA4C3

Strings

", xrefs: 025AA189
\, xrefs: 025A9D0C
D, xrefs: 025A9F8E
%X%08X, xrefs: 025AA0B0
P, xrefs: 025A9DAA
C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 025AA1D9
", xrefs: 025A9EDB
", xrefs: 025AA078
ptlohvde, xrefs: 025AA389, 025AA397

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe$D$P$\$ptlohvde
API String ID: 2089075347-3407381469
Opcode ID: 1a744f0667b4f38c2a297fa9a839f4a63781ad6ab3d6ac2170be19943dc1cbdc
Instruction ID: 6d86ac99e88ebc1a981563c8d00cf417655e77cb55c03c7870823c5b9a22ad29
Opcode Fuzzy Hash: 1a744f0667b4f38c2a297fa9a839f4a63781ad6ab3d6ac2170be19943dc1cbdc
Instruction Fuzzy Hash: 755260B1C4025AAFDB129FA0CC5AEEF7BBDBF44304F1444A6E509A6140E7709A48CF69

Uniqueness

Uniqueness Score: -1.00%

Function 025A199C Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 025A19B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,025A1E9E), ref: 025A19BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 025A19E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 025A19ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 025A19F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,025A1E9E), ref: 025A1A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,025A1E9E), ref: 025A1A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,025A1E9E), ref: 025A1A36
GetAdaptersInfo.IPHLPAPI(00000000,025A1E9E,?,?,?,?,00000001,025A1E9E), ref: 025A1A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,025A1E9E,?,?,?,?,00000001,025A1E9E), ref: 025A1A5A
GetAdaptersInfo.IPHLPAPI(00000000,025A1E9E,?,?,?,?,00000001,025A1E9E), ref: 025A1A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,025A1E9E), ref: 025A1A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,025A1E9E), ref: 025A1AA4

Strings

GetAdaptersInfo, xrefs: 025A19DC
Iphlpapi.dll, xrefs: 025A19B7
GetBestInterface, xrefs: 025A19EF
123.45.67.89, xrefs: 025A19A6
]Vw`'Vw, xrefs: 025A1A36
localcfg, xrefs: 025A19A3
GetIfEntry, xrefs: 025A19E4

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$]Vw`'Vw
API String ID: 293628436-2743630432
Opcode ID: 5e225b13e22541c0678f790f982f7079174f379e176d11d8ebb6fe264b30bb68
Instruction ID: b52b49a75b586ac88c3c0608b94670fe426f6a6ab76f22d35400d887ba277b09
Opcode Fuzzy Hash: 5e225b13e22541c0678f790f982f7079174f379e176d11d8ebb6fe264b30bb68
Instruction Fuzzy Hash: 4F317E32D00209AFDB529FE4CD9A8BFBFB9FF44251F148569E10AA2140D7308E44DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 025A7A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 025A7ABA
GetUserNameA.ADVAPI32(?,?), ref: 025A7ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,025B070C,?,?,?), ref: 025A7B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 025A7B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 025A7B59
EqualSid.ADVAPI32(?,00000022), ref: 025A7B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 025A7B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 025A7B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 025A7B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 025A7BAB
LocalFree.KERNEL32(00000000), ref: 025A7BB2
GetSecurityDescriptorDacl.ADVAPI32(?,025A7FC9,?,00000000), ref: 025A7BCE

Strings

C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 025A7CE2, 025A7D0F, 025A7D23, 025A7D24
D, xrefs: 025A7B0C

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe$D
API String ID: 2976863881-2306690221
Opcode ID: c6c6550a1cba94fd5de46c680b72764dbce4f8e9caec0c67a091300202c926c5
Instruction ID: 6387624a93f5eff9e79178442bdc6ccc3049f47fa8ff9edcca764cfbaafb9db3
Opcode Fuzzy Hash: c6c6550a1cba94fd5de46c680b72764dbce4f8e9caec0c67a091300202c926c5
Instruction Fuzzy Hash: BEA14971D40219ABEF528FA0DC99EFFBFB9FB48304F044469E905E2180E7359A45DB68

Uniqueness

Uniqueness Score: -1.00%

Function 025A7809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 025A782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 025A7866
GetLengthSid.ADVAPI32(?), ref: 025A7878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 025A789A
GetSecurityDescriptorOwner.ADVAPI32(?,025A7F63,?), ref: 025A78B8
EqualSid.ADVAPI32(?,025A7F63), ref: 025A78D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 025A78E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 025A78F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 025A7901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 025A7910
LocalFree.KERNEL32(00000000), ref: 025A7917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 025A7933
GetAce.ADVAPI32(?,00000000,?), ref: 025A7963
EqualSid.ADVAPI32(?,025A7F63), ref: 025A798A
DeleteAce.ADVAPI32(?,00000000), ref: 025A79A3
EqualSid.ADVAPI32(?,025A7F63), ref: 025A79C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 025A7A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 025A7A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 025A7A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 025A7A79
LocalFree.KERNEL32(00000000), ref: 025A7A87

Strings

D, xrefs: 025A785C

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: a10b2989ddc31cad1ea9670b29afa26432aaa95040e8f60845eca83692f662d9
Instruction ID: 5ae97cf79d0c82b5db8e525b165487e79a944d67f21b7a25f2246ba081ae1554
Opcode Fuzzy Hash: a10b2989ddc31cad1ea9670b29afa26432aaa95040e8f60845eca83692f662d9
Instruction Fuzzy Hash: D9813871D0021AAFDB62CFA4CD95BEFBFB8BB0C344F14456AE506E2140D7349645DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 025A8328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 025A83F3
RegQueryValueExA.KERNELBASE(025B0750,?,00000000,?,025A8893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 025A8414
RegSetValueExA.KERNELBASE(025B0750,?,00000000,00000004,025A8893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 025A8441
RegCloseKey.ADVAPI32(025B0750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 025A844A

Strings

C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 025A85C8, 025A85D5, 025A85E5
localcfg, xrefs: 025A8348

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe$localcfg
API String ID: 237177642-4107672054
Opcode ID: 6abcf58da43b7e5def6aec89f3cff39d544821187c304a0451b59bbfbb63f4ee
Instruction ID: e87615f728425fbb8bfa241fef41f073a79a1e0e3a1ef210f4d778e365ee543f
Opcode Fuzzy Hash: 6abcf58da43b7e5def6aec89f3cff39d544821187c304a0451b59bbfbb63f4ee
Instruction Fuzzy Hash: B5C182B1D40209BEEF12AFA4DC9AEEF7BBDFB48304F140865E901E6040E7305A549F29

Uniqueness

Uniqueness Score: -1.00%

Function 025A1D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 025A1DC6
GetSystemInfo.KERNELBASE(?), ref: 025A1DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 025A1E03
GetProcAddress.KERNEL32(00000000), ref: 025A1E0A
GetCurrentProcess.KERNEL32(?), ref: 025A1E1B
GetTickCount.KERNEL32 ref: 025A1FC9

Part of subcall function 025A1BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 025A1C15

Strings

loader_id, xrefs: 025A1F4B, 025A1F6B
flags_upd, xrefs: 025A1E3E, 025A1E43, 025A1E7C
lid_file_upd, xrefs: 025A1E25
start_srv, xrefs: 025A1E6C
kernel32, xrefs: 025A1DF7
hi_id, xrefs: 025A1F16, 025A1F1B, 025A1F33
born_date, xrefs: 025A1EAD, 025A1ECC
localcfg, xrefs: 025A1E2A, 025A1E31, 025A1E44, 025A1E7D, 025A1E8C, 025A1EB2, 025A1ED1, 025A1EE7, 025A1EFF, 025A1F1C, 025A1F34, 025A1F50, 025A1F70
work_srv, xrefs: 025A1E5E
IsWow64Process, xrefs: 025A1DF2
net_type, xrefs: 025A1E87

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 50b6f2589eb992cf38187c1d8eb4bd3e02fda99c39087be508402950aa314611
Instruction ID: 26e1a1e3388a4583877764f94e94a1d32bd9ec85f71ea82a33aa9db8bef0a98a
Opcode Fuzzy Hash: 50b6f2589eb992cf38187c1d8eb4bd3e02fda99c39087be508402950aa314611
Instruction Fuzzy Hash: 495192B09047456FE360AF758C9BF6BBEECFF84748F04491DA58A82182D774A504CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 025A73FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,761311B0,00000000), ref: 025A7472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,761311B0,00000000), ref: 025A74F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,761311B0,00000000), ref: 025A7528
___ascii_stricmp.LIBCMT ref: 025A764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,761311B0,00000000), ref: 025A76E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 025A7706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,761311B0,00000000), ref: 025A7717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,761311B0,00000000), ref: 025A7745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,761311B0,00000000), ref: 025A77EF

Part of subcall function 025AF1A5: lstrlenA.KERNEL32(000000C8,000000E4,025B22F8,000000C8,025A7150,?), ref: 025AF1AD

GetFileAttributesExA.KERNELBASE(00000022,00000000,?), ref: 025A778F
RegCloseKey.KERNELBASE(?), ref: 025A77E6

Strings

", xrefs: 025A7599

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 3ec0b717855eaab4c8f33574cf740c2ab9f1803781f894e214c032e983ac4cc0
Instruction ID: cebc1ff81fec8f7fb410896c3ac21fd11cc137307b8af47e0836786597e0511d
Opcode Fuzzy Hash: 3ec0b717855eaab4c8f33574cf740c2ab9f1803781f894e214c032e983ac4cc0
Instruction Fuzzy Hash: CCC1847194020AABDB129FA4DC56BEEBBB9FF49310F1404A5E504E6190EB31DA54CF68

Uniqueness

Uniqueness Score: -1.00%

Function 025A675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,761311B0,00000000), ref: 025A677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,761311B0,00000000), ref: 025A679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,761311B0,00000000), ref: 025A67B0
SetFileAttributesA.KERNEL32(?,00000002,?,761311B0,00000000), ref: 025A67BF
GetFileSize.KERNEL32(000000FF,00000000,?,761311B0,00000000), ref: 025A67D3
ReadFile.KERNELBASE(000000FF,?,00000040,025A8244,00000000,?,761311B0,00000000), ref: 025A6807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 025A681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,761311B0,00000000), ref: 025A683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 025A685C
ReadFile.KERNEL32(000000FF,?,00000028,025A8244,00000000,?,761311B0,00000000), ref: 025A688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,761311B0,00000000), ref: 025A6906
ReadFile.KERNEL32(000000FF,?,00000000,025A8244,00000000,?,761311B0,00000000), ref: 025A691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,761311B0,00000000), ref: 025A6971

Part of subcall function 025AEC2E: GetProcessHeap.KERNEL32(00000000,025AEA27,00000000,025AEA27,00000000), ref: 025AEC41
Part of subcall function 025AEC2E: RtlFreeHeap.NTDLL(00000000), ref: 025AEC48

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 7a3065c04a5202e104b313de89cf9c0990afba908999251103a36c3a880d3e21
Instruction ID: 2298fac286eaaa5ce8790564ec53e6e991539d8a752aa8f7c25af34aa1a241e1
Opcode Fuzzy Hash: 7a3065c04a5202e104b313de89cf9c0990afba908999251103a36c3a880d3e21
Instruction Fuzzy Hash: 327134B1C0021EEFDF158FA4CC91AEEBBBDFB04314F14456AE915A6190E7309E92DB64

Uniqueness

Uniqueness Score: -1.00%

Function 025A2011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 025A2078
GetTickCount.KERNEL32 ref: 025A20D4
GetTickCount.KERNEL32 ref: 025A20DB
GetTickCount.KERNEL32 ref: 025A212B
GetTickCount.KERNEL32 ref: 025A2132
GetTickCount.KERNEL32 ref: 025A2142

Part of subcall function 025AF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,025AE342,00000000,7558EA50,80000001,00000000,025AE513,?,00000000,00000000,?,000000E4), ref: 025AF089
Part of subcall function 025AF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,025AE342,00000000,7558EA50,80000001,00000000,025AE513,?,00000000,00000000,?,000000E4,000000C8), ref: 025AF093

Part of subcall function 025AE854: lstrcpyA.KERNEL32(00000001,?,?,025AD8DF,00000001,localcfg,except_info,00100000,025B0264), ref: 025AE88B
Part of subcall function 025AE854: lstrlenA.KERNEL32(00000001,?,025AD8DF,00000001,localcfg,except_info,00100000,025B0264), ref: 025AE899

Part of subcall function 025A1C5F: wsprintfA.USER32 ref: 025A1CE1

Strings

rbl_bl, xrefs: 025A2181
rbl_ip, xrefs: 025A218F
localcfg, xrefs: 025A2070, 025A2160, 025A2186, 025A2194, 025A21E4
net_type, xrefs: 025A21DF

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 5d4490d999308da744a930b2e90d34557c5c2653704418bdfd7e1c4c274ed8b9
Instruction ID: 3234badba868dcd2d7bfe3636738b19ef61a4b8df0d99f3d14a8fb667b94cc53
Opcode Fuzzy Hash: 5d4490d999308da744a930b2e90d34557c5c2653704418bdfd7e1c4c274ed8b9
Instruction Fuzzy Hash: 12510370D4834A4EE76AEF24ECA7B6ABFD5BB40314F000819DE06C6190DBB4D058EB2D

Uniqueness

Uniqueness Score: -1.00%

Function 025AF315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(025ACA1D), ref: 025AF34D
socket.WS2_32(00000002,00000001,00000000), ref: 025AF367
closesocket.WS2_32(00000000), ref: 025AF375

Strings

time_cfg, xrefs: 025AF323

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 1dcac43e6dc7d7de7d79d5407d1e3636c402176a26784026e61df8a1dc0567dc
Instruction ID: 80bc14daf5d75d145ffd2fb7c04dba224aff75755e61e908fa9d3e4f5194d011
Opcode Fuzzy Hash: 1dcac43e6dc7d7de7d79d5407d1e3636c402176a26784026e61df8a1dc0567dc
Instruction Fuzzy Hash: C6316B72940119ABDB119FA4EC869EFBBBCFF88310F104566F915D2140E7309A458BA8

Uniqueness

Uniqueness Score: -1.00%

Function 025A2D21 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,76132640,?,00000000,025A2F01,?,025A20FF,025B2000), ref: 025A2D3A
LoadLibraryA.KERNEL32(?), ref: 025A2D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 025A2D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 025A2D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 025A2D99
RtlAllocateHeap.NTDLL(00000000), ref: 025A2DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 025A2DCB

Strings

DnsQuery_A, xrefs: 025A2D5B
dnsapi.dll, xrefs: 025A2D29
]Vw`'Vw, xrefs: 025A2DA0

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll$]Vw`'Vw
API String ID: 1093190573-312264031
Opcode ID: 00f7fb7fbbaf86eeb07a41bcb0b38b8348c3591ff19e2f3aad1bc3985beb73d5
Instruction ID: 6ffb2ffa638a53f45afc4a829ad19d61ce5f199600c8841322205a556e43966d
Opcode Fuzzy Hash: 00f7fb7fbbaf86eeb07a41bcb0b38b8348c3591ff19e2f3aad1bc3985beb73d5
Instruction Fuzzy Hash: 4C219071D4062AABCB229F54DC5AAAFBFB9FF08B50F004416FC05E7141D370998687D8

Uniqueness

Uniqueness Score: -1.00%

Function 025A405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 025A4070
ExitProcess.KERNEL32 ref: 025A4121

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 9c6118c44bb0996944a0e727f072271807f5a2cf95eec0e62a999d2ff9469d09
Instruction ID: 89d013db6f24705972d8db71ae6f1a231d121fcc911b8b205f8ca7ff2c5c604d
Opcode Fuzzy Hash: 9c6118c44bb0996944a0e727f072271807f5a2cf95eec0e62a999d2ff9469d09
Instruction Fuzzy Hash: 14517FB1D40219BAEB21AAA0CC56FBF7ABDFF50718F000465F600B6080E7749A55DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 025A80C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 025A815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,025AA45F,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 025A8187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,025AA45F,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 025A81BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,761311B0,00000000), ref: 025A8210

Part of subcall function 025A675C: SetFileAttributesA.KERNEL32(?,00000080,?,761311B0,00000000), ref: 025A677E
Part of subcall function 025A675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,761311B0,00000000), ref: 025A679A
Part of subcall function 025A675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,761311B0,00000000), ref: 025A67B0
Part of subcall function 025A675C: SetFileAttributesA.KERNEL32(?,00000002,?,761311B0,00000000), ref: 025A67BF
Part of subcall function 025A675C: GetFileSize.KERNEL32(000000FF,00000000,?,761311B0,00000000), ref: 025A67D3
Part of subcall function 025A675C: ReadFile.KERNELBASE(000000FF,?,00000040,025A8244,00000000,?,761311B0,00000000), ref: 025A6807
Part of subcall function 025A675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 025A681F
Part of subcall function 025A675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,761311B0,00000000), ref: 025A683E
Part of subcall function 025A675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,761311B0,00000000), ref: 025A685C

Part of subcall function 025AEC2E: GetProcessHeap.KERNEL32(00000000,025AEA27,00000000,025AEA27,00000000), ref: 025AEC41
Part of subcall function 025AEC2E: RtlFreeHeap.NTDLL(00000000), ref: 025AEC48

Strings

C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe, xrefs: 025A8225, 025A823A

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe
API String ID: 124786226-3552900515
Opcode ID: c3acf5208c426a815a2d8ae03b18d53be68e9a53c4ee455f45686cd7fc18b67a
Instruction ID: 0e9a7b00f93052f8fb29a177cb84da5651df714d8e3995d59755c43e3b7e6b08
Opcode Fuzzy Hash: c3acf5208c426a815a2d8ae03b18d53be68e9a53c4ee455f45686cd7fc18b67a
Instruction Fuzzy Hash: B94163B2D45109BFEB12AFA0DD96DBE7BBDFB44304F144866E905E2000E7309E589B6D

Uniqueness

Uniqueness Score: -1.00%

Function 025A1AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 025A1AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 025A1AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 025A1B20

Strings

Iphlpapi.dll, xrefs: 025A1ACC
GetAdaptersAddresses, xrefs: 025A1AE3

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 317567453b32a9ca1f5c34b16949886a3bba80912a2298224ea545d240445eee
Instruction ID: 187a8fbf22c1c430ef1814708d9c3140632168838695d450b2c6b5dfb5b54d02
Opcode Fuzzy Hash: 317567453b32a9ca1f5c34b16949886a3bba80912a2298224ea545d240445eee
Instruction Fuzzy Hash: 8B11B771E0252CBFDB169BA8CD968EEFFBAFB44B10F148055E019A7140E7308A44DB98

Uniqueness

Uniqueness Score: -1.00%

Function 025AE3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,025AE5F2,00000000,00020119,025AE5F2,025B22F8), ref: 025AE3E6
RegQueryValueExA.ADVAPI32(025AE5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 025AE44E
RegQueryValueExA.ADVAPI32(025AE5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 025AE482
RegQueryValueExA.ADVAPI32(025AE5F2,?,00000000,?,80000001,?), ref: 025AE4CF
RegCloseKey.ADVAPI32(025AE5F2,?,?,?,?,000000C8,000000E4), ref: 025AE520

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 7987005692a77532741708702524544d54b41193fa06c2ba52388ce176e2a355
Instruction ID: 83bd018e5ec10c9bcb74ecdb5f30d1ffb0a86e0e3c89afce786ae202c06422b2
Opcode Fuzzy Hash: 7987005692a77532741708702524544d54b41193fa06c2ba52388ce176e2a355
Instruction Fuzzy Hash: F14107B2D4021EBFDF11AFA8DC92DEEBBBDFB48304F544466E910A2150E3319A159F64

Uniqueness

Uniqueness Score: -1.00%

Function 025AF26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 025AF2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 025AF2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 025AF2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 025AF2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 025AF2FD

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: cddc2c40a9714d5dc1986ec22bc883cceba7e37c7f1dfea27abb53b21b469098
Instruction ID: c919086a3ab940ee25185577919a3d4f117126608e8c496f2d994afcbeeb9bf1
Opcode Fuzzy Hash: cddc2c40a9714d5dc1986ec22bc883cceba7e37c7f1dfea27abb53b21b469098
Instruction Fuzzy Hash: 77110DB1A40248BAEF11DF94CD41FDE7FBCEB44751F004066BB04EA1D0E6B19A44DB94

Uniqueness

Uniqueness Score: -1.00%

Function 025A1BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 025A1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 025A1AD4
Part of subcall function 025A1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 025A1AE9
Part of subcall function 025A1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 025A1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 025A1C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 025A1C51

Strings

hi_id, xrefs: 025A1BE5
localcfg, xrefs: 025A1BE7

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: b1417488262fca44639ebbe097232201fde5cef343e1e5fd4e59a40a914a5a96
Instruction ID: 01b8da59af58f459e35c73af02ac2caf02fb5ca02d99661b3078f4076c08ad5c
Opcode Fuzzy Hash: b1417488262fca44639ebbe097232201fde5cef343e1e5fd4e59a40a914a5a96
Instruction Fuzzy Hash: A10180B2A4461CBBEB50DEE8C8E69FFBABCBB44655F104875E706E3140D2309E4496A4

Uniqueness

Uniqueness Score: -1.00%

Function 025A1B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 025A1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 025A1AD4
Part of subcall function 025A1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 025A1AE9
Part of subcall function 025A1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 025A1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 025A1BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,025A1EFD,00000000,00000000,00000000,00000000), ref: 025A1BB8

Strings

localcfg, xrefs: 025A1B7B

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 3053d43507fa4f6f8874561e5f31730350c2e3581d056b277d05ca04b645282c
Instruction ID: 0c621566febc86dd18607c95d8e2d580e4864b718a04a7664ee013a6a470b08a
Opcode Fuzzy Hash: 3053d43507fa4f6f8874561e5f31730350c2e3581d056b277d05ca04b645282c
Instruction Fuzzy Hash: 0C014FB6D0050CBFE7019AE9C8829EFFABDAB48654F154561A605E7180D5705E084AB4

Uniqueness

Uniqueness Score: -1.00%

Function 025A2684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000002), ref: 025A2693
gethostbyname.WS2_32(00000002), ref: 025A269F

Strings

time_cfg, xrefs: 025A2684

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 212e9e79548c1d27c65ed5bd8bc48db0c04f8e5703ddf5d9ec9b7d3539920afc
Instruction ID: 46ecb859e18b267ded6a248658e1f4c35b6658ce3a14c146b5f08ffb8714abf6
Opcode Fuzzy Hash: 212e9e79548c1d27c65ed5bd8bc48db0c04f8e5703ddf5d9ec9b7d3539920afc
Instruction Fuzzy Hash: 4DE08C30A050118FCB918F2CF456A9E7BA4AF06230F018580F840C7190CB30DC809688

Uniqueness

Uniqueness Score: -1.00%

Function 025AEBCC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,025AEBFE,7FFF0001,?,025ADB55,7FFF0001), ref: 025AEBD3
RtlAllocateHeap.NTDLL(00000000,?,025ADB55,7FFF0001), ref: 025AEBDA

Part of subcall function 025AEB74: GetProcessHeap.KERNEL32(00000000,00000000,025AEC28,00000000,?,025ADB55,7FFF0001), ref: 025AEB81
Part of subcall function 025AEB74: HeapSize.KERNEL32(00000000,?,025ADB55,7FFF0001), ref: 025AEB88

Strings

]Vw`'Vw, xrefs: 025AEBDA

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID: ]Vw`'Vw
API String ID: 2559512979-147723481
Opcode ID: af6f329e08b9b5efe200114491360e27f9a81b8d13777df86c266609ad323c52
Instruction ID: 4d66b88f9ee1e6a718d1d89c0506c22fd6f3c8c0ae544adacb77700056734c45
Opcode Fuzzy Hash: af6f329e08b9b5efe200114491360e27f9a81b8d13777df86c266609ad323c52
Instruction Fuzzy Hash: 99C0803254522067C6463BA4BC0DFDF3E98EF84352F040414F505C1190C73048509799

Uniqueness

Uniqueness Score: -1.00%

Function 025AE52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 025ADD05: GetTickCount.KERNEL32 ref: 025ADD0F
Part of subcall function 025ADD05: InterlockedExchange.KERNEL32(025B36B4,00000001), ref: 025ADD44
Part of subcall function 025ADD05: GetCurrentThreadId.KERNEL32 ref: 025ADD53

GetFileSize.KERNEL32(00000000,00000000,?,761311B0,?,00000000,?,025AA445), ref: 025AE558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,761311B0,?,00000000,?,025AA445), ref: 025AE583
CloseHandle.KERNEL32(00000000,?,761311B0,?,00000000,?,025AA445), ref: 025AE5B2

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: c7b42356cd0976a324074602dbd4ae6025ecc1da36eb43510558894091ed4927
Instruction ID: fa6f95f9b1d2f000b4e5c6e1154ab55550fd5f912af882f9dc14a93f7b978530
Opcode Fuzzy Hash: c7b42356cd0976a324074602dbd4ae6025ecc1da36eb43510558894091ed4927
Instruction Fuzzy Hash: 9321F8B19802063AF2617E21DC27FAF3E1EFF95750F000864BE0AB51D2FA51E81489BD

Uniqueness

Uniqueness Score: -1.00%

Function 025A877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 025A88A5

Part of subcall function 025AF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,025AE342,00000000,7558EA50,80000001,00000000,025AE513,?,00000000,00000000,?,000000E4), ref: 025AF089
Part of subcall function 025AF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,025AE342,00000000,7558EA50,80000001,00000000,025AE513,?,00000000,00000000,?,000000E4,000000C8), ref: 025AF093

Strings

localcfg, xrefs: 025A87CA, 025A87CF, 025A87FB, 025A8835, 025A8861
rresolv, xrefs: 025A87F6, 025A885C

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 1c0453455c2875146bd46454d36de354e522044a213c360409ab44dc79a84c42
Instruction ID: 6a9d6f263563f8a8aef426037db8ccc75edb33d60aa25f69601c74c57d27a1ef
Opcode Fuzzy Hash: 1c0453455c2875146bd46454d36de354e522044a213c360409ab44dc79a84c42
Instruction Fuzzy Hash: 562198319883036AF355BB65EC6BBBE7AD9BB84722F600C19F904D60C0EFA145544DBD

Uniqueness

Uniqueness Score: -1.00%

Function 025A4000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,025B22F8,025A42B6,00000000,00000001,025B22F8,00000000,?,025A98FD), ref: 025A4021
GetLastError.KERNEL32(?,025A98FD,00000001,00000100,025B22F8,025AA3C7), ref: 025A402C
Sleep.KERNEL32(000001F4,?,025A98FD,00000001,00000100,025B22F8,025AA3C7), ref: 025A4046

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 7a52bd9e0f73563d144a4a580ba822ac36a3cc4e0586f88537e91cf227a0bc0f
Instruction ID: 935fb799109073701c3a4c26319513e377a900e75e859d5106b9b12f11afcff8
Opcode Fuzzy Hash: 7a52bd9e0f73563d144a4a580ba822ac36a3cc4e0586f88537e91cf227a0bc0f
Instruction Fuzzy Hash: 89F08931644145AED7710A64AC5773E3651FB81724F658B14F3B5E50D0C7B04485B61D

Uniqueness

Uniqueness Score: -1.00%

Function 025ADB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(025ADC19,?,00000104), ref: 025ADB7F
lstrcpyA.KERNEL32(?,025B28F8), ref: 025ADBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 025ADBC2

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: 5918f254799dac3ccf10006f9e36d5f9289c5ac9615d8c96a9876660ebf2b697
Instruction ID: 6afa7f7e8909c0e0c71051eb681cb4823e316d40e9b47d292c486c241ed99550
Opcode Fuzzy Hash: 5918f254799dac3ccf10006f9e36d5f9289c5ac9615d8c96a9876660ebf2b697
Instruction Fuzzy Hash: BAF0B47054020DABEF11DF64DC4AFEA3B69BB04348F504594BB51A40D0D7F2D559DF18

Uniqueness

Uniqueness Score: -1.00%

Function 025AEC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 025AEC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 025AEC72
GetTickCount.KERNEL32 ref: 025AEC78

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: bce84f5dc1e860d15b662e4dcab7ab22c5d4b3c5c60ac9cc5eb9b3653e9e7570
Instruction ID: e6fbe9915fa8777d0afc5d65028467ae9a663a962661530e99183d9b68797db6
Opcode Fuzzy Hash: bce84f5dc1e860d15b662e4dcab7ab22c5d4b3c5c60ac9cc5eb9b3653e9e7570
Instruction Fuzzy Hash: F5E09AF5C50208BFEB46AFB4DC4AE7B77BCEB08314F900A50B911D60D0EA70DA189B64

Uniqueness

Uniqueness Score: -1.00%

Function 025A30B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 025A30D8
gethostbyname.WS2_32(?), ref: 025A30E2

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 5f81fab3e8ca608f7b564f973176c09da4d0427cd4d56e73fb549dabf5008af3
Instruction ID: 47a126fcec86114240cee14780f60e8d54ab54b675523d5826030ae9b16cc84c
Opcode Fuzzy Hash: 5f81fab3e8ca608f7b564f973176c09da4d0427cd4d56e73fb549dabf5008af3
Instruction Fuzzy Hash: FCE06571D00119ABCF409BA8EC86F9F77ACBB04208F180461F905E3280EA34E5088794

Uniqueness

Uniqueness Score: -1.00%

Function 025AEC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 025AEBA0: GetProcessHeap.KERNEL32(00000000,00000000,025AEC0A,00000000,80000001,?,025ADB55,7FFF0001), ref: 025AEBAD
Part of subcall function 025AEBA0: HeapSize.KERNEL32(00000000,?,025ADB55,7FFF0001), ref: 025AEBB4

GetProcessHeap.KERNEL32(00000000,025AEA27,00000000,025AEA27,00000000), ref: 025AEC41
RtlFreeHeap.NTDLL(00000000), ref: 025AEC48

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: 18112ed3d42e8ce59d546855745f7892bb9acb57cf02853b314b724e89e75949
Instruction ID: aed09315aaaf8e60fe7c55ec7e8831d5e451d0fb98c7555d9db3526ac2c7b995
Opcode Fuzzy Hash: 18112ed3d42e8ce59d546855745f7892bb9acb57cf02853b314b724e89e75949
Instruction Fuzzy Hash: 01C012328462306BC5963A50BC2FF9F6B5CAF85651F090809F505670808760984056ED

Uniqueness

Uniqueness Score: -1.00%

Function 025AF43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,025ACA44), ref: 025AF476

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: b9bb44d7bdd0160cbe20b75e79c7bc6a0a558e1223f30d1577c20ebbb3817a21
Instruction ID: db089069a1c187451455122d71deca18b051af36dfe727321baed6a2540450b3
Opcode Fuzzy Hash: b9bb44d7bdd0160cbe20b75e79c7bc6a0a558e1223f30d1577c20ebbb3817a21
Instruction Fuzzy Hash: 93F01C7220555AABDB119E9ADC84CAF7FAEFBC9250B040522FA14D7110D632E8258BA4

Uniqueness

Uniqueness Score: -1.00%

Function 025A1978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 025A1992

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 7916c928b969a1438efcf97dea71b794e0cf336bffaadd15915a20c120324e19
Instruction ID: d533241c7f3e2b4afecd61d47f867344edfa6cb4df635d8ec8b0430b8043d056
Opcode Fuzzy Hash: 7916c928b969a1438efcf97dea71b794e0cf336bffaadd15915a20c120324e19
Instruction Fuzzy Hash: 5FD022225486322A42412718F80047FEB8CFF442A2B00841AFC48C0150C730C841879A

Uniqueness

Uniqueness Score: -1.00%

Function 025ADD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 025ADDB5

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: aa19fb1740475fc6b8549b89737ecef6fe8264d0e0661e671a2eeb5ce62d3799
Instruction ID: 58fbf8f0e2f333239db53ea42dc5a760439d28b2a4b28a81de232a54129a0ca2
Opcode Fuzzy Hash: aa19fb1740475fc6b8549b89737ecef6fe8264d0e0661e671a2eeb5ce62d3799
Instruction Fuzzy Hash: 4EF08231602206CBCB21EE35985566ABBF4FF46229F144C2EE155D3940D730D855CB25

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 025A637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,025A9816,EntryPoint), ref: 025A638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,025A9816,EntryPoint), ref: 025A63A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 025A63CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 025A63EB

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: b92c2ae1b2254f2ad4b027cf033fda06e93683bcd533db3976473bb19b15117e
Instruction ID: ad6c4dcd945fa8097e8ad6a4af684fc966af8e45447243b029c57be9faa17de7
Opcode Fuzzy Hash: b92c2ae1b2254f2ad4b027cf033fda06e93683bcd533db3976473bb19b15117e
Instruction Fuzzy Hash: C71191B1A40219BFDB118E65DC4AF9B3FACFB047A4F154424F905EB280D770DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 025A1000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,025A1839,025A9646), ref: 025A1012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 025A10C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 025A10E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 025A1101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 025A1121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 025A1140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 025A1160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 025A1180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 025A119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 025A11BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 025A11DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 025A11FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 025A121A

Strings

RtlLengthSid, xrefs: 025A1246
RtlFreeSid, xrefs: 025A1116
NtSetInformationThread, xrefs: 025A1155
NtDuplicateToken, xrefs: 025A11F3
RtlNtStatusToDosError, xrefs: 025A1194
NtQueryInformationToken, xrefs: 025A1262
NtFilterToken, xrefs: 025A122B
ntdll.dll, xrefs: 025A100D
NtClose, xrefs: 025A11B4
NtSetInformationToken, xrefs: 025A1175
NtTerminateProcess, xrefs: 025A10F6
RtlSetLastWin32Error, xrefs: 025A10D6
NtOpenProcessToken, xrefs: 025A11D4
RtlAllocateAndInitializeSid, xrefs: 025A120F
RtlInitUnicodeString, xrefs: 025A1135
RtlExpandEnvironmentStrings_U, xrefs: 025A10BC

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: ec3ed6fcd2c2727c2c2f42abdddd6a8dad132f65d32c1e1ae00c1a045995fea4
Instruction ID: 3b66a903debc4811b26d333b96a225c50ab5d70acdc28ef9e89d9da44437cb86
Opcode Fuzzy Hash: ec3ed6fcd2c2727c2c2f42abdddd6a8dad132f65d32c1e1ae00c1a045995fea4
Instruction Fuzzy Hash: 30510431986E01B7E7A38E6DEC627663AA47B4C324F1487969828F21D0C770D099EF5D

Uniqueness

Uniqueness Score: -1.00%

Function 025AB211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 025AB2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 025AB2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 025AB2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 025AB2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 025AB31A
GetTimeZoneInformation.KERNEL32(?), ref: 025AB329
wsprintfA.USER32 ref: 025AB3B7

Strings

Nov, xrefs: 025AB29C
Mon, xrefs: 025AB22C
Apr, xrefs: 025AB26B
Sun, xrefs: 025AB225
May, xrefs: 025AB272
Aug, xrefs: 025AB287
Fri, xrefs: 025AB248
Oct, xrefs: 025AB295
Jul, xrefs: 025AB280
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 025AB3AF
Mar, xrefs: 025AB264
Wed, xrefs: 025AB23A
Dec, xrefs: 025AB2A3
Jun, xrefs: 025AB279
Thu, xrefs: 025AB241
Sep, xrefs: 025AB28E
Sat, xrefs: 025AB24F
Jan, xrefs: 025AB256
Feb, xrefs: 025AB25D
Tue, xrefs: 025AB233

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 699d2bd7f3f5a7704a3cf2fb8b42191ba2d302cf92d26b20e1b8d8e79e3d9328
Instruction ID: 92d7748f79220cd14a837d83c6fc4e2fb581a92a5a545282a2a0d7a5c2640213
Opcode Fuzzy Hash: 699d2bd7f3f5a7704a3cf2fb8b42191ba2d302cf92d26b20e1b8d8e79e3d9328
Instruction Fuzzy Hash: AE513CB1E00218AACF56CFD4D9995FFFBF9BF48305F10445AE501A6190D3348A89CB98

Uniqueness

Uniqueness Score: -1.00%

Function 025A6511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 025A654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 025A655C
htonl.WS2_32(?), ref: 025A6578
htonl.WS2_32(?), ref: 025A6587
wsprintfA.USER32 ref: 025A659B
wsprintfA.USER32 ref: 025A65DC
wsprintfA.USER32 ref: 025A6671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 025A668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 025A6696
wsprintfA.USER32 ref: 025A66B0
wsprintfA.USER32 ref: 025A66E7
wsprintfA.USER32 ref: 025A66FF
wsprintfA.USER32 ref: 025A671F
ExitProcess.KERNEL32 ref: 025A6755

Strings

except_info, xrefs: 025A6728
plgs:, xrefs: 025A66AA
Jan 13 2018, xrefs: 025A653A
va=%08X%08X uef=%p, xrefs: 025A6595
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 025A65D6
localcfg, xrefs: 025A672D
12:08:32, xrefs: 025A6535
ver=%d date=%s %sc=%08x a=%p, xrefs: 025A6547
%d=%p, xrefs: 025A66F9
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 025A666B

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 45f9d89fd387d83e5832d17c40c91549c92f68ffbfe29dfc61b2a634926e13fa
Instruction ID: 4f80aefc3b3ed5c508a9d03a6c058b564b636934555a90c3b259269ff901a41f
Opcode Fuzzy Hash: 45f9d89fd387d83e5832d17c40c91549c92f68ffbfe29dfc61b2a634926e13fa
Instruction Fuzzy Hash: ED617B72950208AFEF619FB4DC46FEE77E9FF08300F144469F969D2161EA70A9548F28

Uniqueness

Uniqueness Score: -1.00%

Function 025AA7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 025AA7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 025AA87E
send.WS2_32(00000000,?,00000000,00000000), ref: 025AA893
wsprintfA.USER32 ref: 025AA8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 025AA8D2
wsprintfA.USER32 ref: 025AA8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 025AA97C
wsprintfA.USER32 ref: 025AA9B9

Strings

rcpt to:<%s>, xrefs: 025AA855
data, xrefs: 025AA85E
ehlo %s, xrefs: 025AA7F5
Too small respons, xrefs: 025AA9C9
localcfg, xrefs: 025AAB0B
., xrefs: 025AA8CA
AUTH LOGIN, xrefs: 025AA80C
quit, xrefs: 025AA86C
Error sending command (sent = %d/%d), xrefs: 025AA8A7, 025AA8DA
helo %s, xrefs: 025AA803
mail from:<%s>, xrefs: 025AA848
ESMTP, xrefs: 025AAA38
Too big smtp respons (%d bytes), xrefs: 025AA9B1
Incorrect respons, xrefs: 025AAB39

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: bdbf67d38798cab579c7ab8a6f6b3b5bd47e784a98008a261b1c9a6f57aa0669
Instruction ID: d0981929cfe7304caa32df6bb6b1e0a991b1c1ede14c49629d83e152ba09375b
Opcode Fuzzy Hash: bdbf67d38798cab579c7ab8a6f6b3b5bd47e784a98008a261b1c9a6f57aa0669
Instruction Fuzzy Hash: F8A10C7194430AABEF228E54DCA7FBE7B79BB40318F140866F902A6090DB719958CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 025A2A62 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7612F620), ref: 025A2A83
HeapAlloc.KERNEL32(00000000,?,7612F620), ref: 025A2A86
socket.WS2_32(00000002,00000002,00000011), ref: 025A2AA0
htons.WS2_32(00000000), ref: 025A2ADB
select.WS2_32 ref: 025A2B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 025A2B4A
htons.WS2_32(?), ref: 025A2B71
htons.WS2_32(?), ref: 025A2B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 025A2BFB

Strings

]Vw`'Vw, xrefs: 025A2A86, 025A2C02

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: ]Vw`'Vw
API String ID: 1639031587-147723481
Opcode ID: e7cd0477d33fd5f9668e4ec5c92524f3a1a299c33fda336c50ed5e46e065a04f
Instruction ID: 648ce03b1032f11bf0adca145c8be2ea651207a40aca21a904b41ee57dd536b2
Opcode Fuzzy Hash: e7cd0477d33fd5f9668e4ec5c92524f3a1a299c33fda336c50ed5e46e065a04f
Instruction Fuzzy Hash: E061B071904305ABD7219F64DC6BB6FBBE8FB88795F000809FD49D7180D7B0D8488BAA

Uniqueness

Uniqueness Score: -1.00%

Function 025A1280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 025A139A
lstrlenW.KERNEL32(-00000003), ref: 025A1571

Strings

, xrefs: 025A1462
D, xrefs: 025A15C6
@, xrefs: 025A1380
uac, xrefs: 025A1628
<, xrefs: 025A1378
useless, xrefs: 025A161E
@EJv, xrefs: 025A139A
%systemroot%\system32\cmd.exe, xrefs: 025A1316
wusa.exe, xrefs: 025A1388

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$@EJv$D$uac$useless$wusa.exe
API String ID: 1628651668-3954050976
Opcode ID: bff67474c32b7a17139206319b5a210766047f06ca48346b80c70ead4e3ee49f
Instruction ID: aca5e55bc052a5bb8b7ff183fd82e0e67ffe8fbdb2d4d98e8fa253287441f6c5
Opcode Fuzzy Hash: bff67474c32b7a17139206319b5a210766047f06ca48346b80c70ead4e3ee49f
Instruction Fuzzy Hash: 84F189B55087419FD321DF64C899BAEBBE5FB88304F008D1DF99A97280D774D848CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 025A2DF2 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,76132640,?,000DBBA0,?,00000000,025A2F0F,?,025A20FF,025B2000), ref: 025A2E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,025A2F0F,?,025A20FF,025B2000), ref: 025A2E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 025A2E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,025A2F0F,?,025A20FF,025B2000), ref: 025A2E4C
HeapAlloc.KERNEL32(00000000,?,00000000,025A2F0F,?,025A20FF,025B2000), ref: 025A2E4F
htons.WS2_32(00000035), ref: 025A2E88
inet_addr.WS2_32(?), ref: 025A2E93
gethostbyname.WS2_32(?), ref: 025A2EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,025A2F0F,?,025A20FF,025B2000), ref: 025A2EE3
HeapFree.KERNEL32(00000000,?,00000000,025A2F0F,?,025A20FF,025B2000), ref: 025A2EE6

Strings

GetNetworkParams, xrefs: 025A2E28
]Vw`'Vw, xrefs: 025A2E4F
iphlpapi.dll, xrefs: 025A2DFB, 025A2E00, 025A2E10

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$]Vw`'Vw
API String ID: 929413710-3538517857
Opcode ID: a1a08d8aad54d2d73c6892d5db8c038b17a426bd770849fda6bf69142855343a
Instruction ID: 5c0b3474958701caa76325f2d90a3ef5cd870da9b9e601a6f9a768155c2a7a11
Opcode Fuzzy Hash: a1a08d8aad54d2d73c6892d5db8c038b17a426bd770849fda6bf69142855343a
Instruction Fuzzy Hash: AF31BC31E4020AABDB129FB8985ABBF7BB8BF04364F140515ED14E72C0EB30C5959B68

Uniqueness

Uniqueness Score: -1.00%

Function 025A704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,761311B0,?,761311B0,00000000), ref: 025A70C2
RegEnumValueA.ADVAPI32(761311B0,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,761311B0,00000000), ref: 025A719E
RegCloseKey.ADVAPI32(761311B0,?,761311B0,00000000), ref: 025A71B2
RegCloseKey.ADVAPI32(761311B0), ref: 025A7208
RegCloseKey.ADVAPI32(761311B0), ref: 025A7291
___ascii_stricmp.LIBCMT ref: 025A72C2
RegCloseKey.ADVAPI32(761311B0), ref: 025A72D0
RegCloseKey.ADVAPI32(761311B0), ref: 025A7314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 025A738D
RegCloseKey.ADVAPI32(761311B0), ref: 025A73D8

Part of subcall function 025AF1A5: lstrlenA.KERNEL32(000000C8,000000E4,025B22F8,000000C8,025A7150,?), ref: 025AF1AD

Strings

, xrefs: 025A7194
", xrefs: 025A7227

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 122028973ce2e8d6f09514aaafb6c2c41b5c68b2c00055727b07245c5a606d13
Instruction ID: 69cf47ff9e94f09e703aee2618242b2d403b41f48f0c2e466a86026ab9580ade
Opcode Fuzzy Hash: 122028973ce2e8d6f09514aaafb6c2c41b5c68b2c00055727b07245c5a606d13
Instruction Fuzzy Hash: 03B18371D4420AAEDF159FA4DC66BEFBBB9FF48300F100466F501E6090EB719A94CB68

Uniqueness

Uniqueness Score: -1.00%

Function 025AAD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 025AAD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 025AADA6

Part of subcall function 025AAD08: gethostname.WS2_32(?,00000080), ref: 025AAD1C
Part of subcall function 025AAD08: lstrlenA.KERNEL32(00000000), ref: 025AAD60
Part of subcall function 025AAD08: lstrlenA.KERNEL32(00000000), ref: 025AAD69
Part of subcall function 025AAD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 025AAD7F

Part of subcall function 025A30B5: gethostname.WS2_32(?,00000080), ref: 025A30D8
Part of subcall function 025A30B5: gethostbyname.WS2_32(?), ref: 025A30E2

wsprintfA.USER32 ref: 025AAEA5

Part of subcall function 025AA7A3: inet_ntoa.WS2_32(?), ref: 025AA7A9

wsprintfA.USER32 ref: 025AAE4F
wsprintfA.USER32 ref: 025AAE5E

Part of subcall function 025AEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 025AEF92
Part of subcall function 025AEF7C: lstrlenA.KERNEL32(?), ref: 025AEF99
Part of subcall function 025AEF7C: lstrlenA.KERNEL32(00000000), ref: 025AEFA0

Strings

%s%d, xrefs: 025AAE58
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 025AAE9F
%OUTLOOK_MID, xrefs: 025AAEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 025AAE49
%OUTLOOK_BND_, xrefs: 025AAE0F, 025AAE14, 025AAE57, 025AAE76
127.0.0.1, xrefs: 025AADEB
%OUTLOOK_HST, xrefs: 025AAEC5

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: a68720a79e021c45145bef40bd104039582aaf94aa10e14431efffb0fb4b53b8
Instruction ID: 641105b471aee3a09b97e25141c1e0ead07c666baa4e4dd7b90ffd6103bafd4f
Opcode Fuzzy Hash: a68720a79e021c45145bef40bd104039582aaf94aa10e14431efffb0fb4b53b8
Instruction Fuzzy Hash: 8B413FB290020DABEF26EFA0DC56EEF3BADFF48340F14442AB91592151EA71D558CF58

Uniqueness

Uniqueness Score: -1.00%

Function 025A9326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,025A9DD7,?,00000022,?,?,00000000,00000001), ref: 025A9340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,025A9DD7,?,00000022,?,?,00000000,00000001), ref: 025A936E
GetModuleFileNameA.KERNEL32(00000000,?,025A9DD7,?,00000022,?,?,00000000,00000001), ref: 025A9375
wsprintfA.USER32 ref: 025A93CE
wsprintfA.USER32 ref: 025A940C
wsprintfA.USER32 ref: 025A948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 025A94F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 025A9526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 025A9571

Strings

runas, xrefs: 025A9674

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 5ffbd7e5010678d21bb5b29b26b5dd6378145d0eea132ebcb0e56230b7272ac2
Instruction ID: e3d09f4907c185475e1cc121299d7f9f683ef1fda147ad5201cc854cf71e4bd2
Opcode Fuzzy Hash: 5ffbd7e5010678d21bb5b29b26b5dd6378145d0eea132ebcb0e56230b7272ac2
Instruction Fuzzy Hash: 18A17CB1940258ABEB229FA4CC56FEF3BADFF48740F100426FA05D6191E7719944CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 025AB3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 025AB467

Part of subcall function 025AEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 025AEF92
Part of subcall function 025AEF7C: lstrlenA.KERNEL32(?), ref: 025AEF99
Part of subcall function 025AEF7C: lstrlenA.KERNEL32(00000000), ref: 025AEFA0

Strings

%TO_EMAIL, xrefs: 025AB473
%TO_HASH, xrefs: 025AB4B0
%TO_USER, xrefs: 025AB488
%s@%s, xrefs: 025AB461
%P5DATE, xrefs: 025AB4F2
%DATE, xrefs: 025AB4D2
%FROM_USER, xrefs: 025AB431
%FROM_EMAIL, xrefs: 025AB3E9
%M5DATE, xrefs: 025AB50F
%FROM_DOMAIN, xrefs: 025AB41E
%TO_DOMAIN, xrefs: 025AB44B

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: e5750398be4e030d2fd746e3429f9716569a716913a5e29904482a290278f45d
Instruction ID: 898a6a054c31b79fb8ecbfec92538525f9f9a9f68e393a060899060faa6fbe1b
Opcode Fuzzy Hash: e5750398be4e030d2fd746e3429f9716569a716913a5e29904482a290278f45d
Instruction Fuzzy Hash: 864163B254011E7EEF01AA94CCD2CFFBB6DFF89648F140425F905A2040DB35A9158BB9

Uniqueness

Uniqueness Score: -1.00%

Function 025AC2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 025AA4C7: GetTickCount.KERNEL32 ref: 025AA4D1
Part of subcall function 025AA4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 025AA4FA

GetTickCount.KERNEL32 ref: 025AC31F
GetTickCount.KERNEL32 ref: 025AC32B
GetTickCount.KERNEL32 ref: 025AC363
GetTickCount.KERNEL32 ref: 025AC378
GetTickCount.KERNEL32 ref: 025AC44D
InterlockedIncrement.KERNEL32(025AC4E4), ref: 025AC4AE
CreateThread.KERNEL32(00000000,00000000,025AB535,00000000,?,025AC4E0), ref: 025AC4C1
CloseHandle.KERNEL32(00000000,?,025AC4E0,025B3588,025A8810), ref: 025AC4CC

Strings

localcfg, xrefs: 025AC2DD

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: 3298fbc783b9ca70fc436df2ce7bb737fd0475ae5edb56255e79cbebf64db993
Instruction ID: 4af33993acdb9bf0f93d5c551db23ed2a206a4ecebcf11a8af7c6617d528d39d
Opcode Fuzzy Hash: 3298fbc783b9ca70fc436df2ce7bb737fd0475ae5edb56255e79cbebf64db993
Instruction Fuzzy Hash: 8E515AB1A00B418FD7648F69C5A662ABBE9FB48305B505D3FE18BC7A90D774F844CB18

Uniqueness

Uniqueness Score: -1.00%

Function 025ABE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 025ABE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 025ABE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 025ABE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 025ABF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 025ABF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 025ABF94

Strings

smtp_herr, xrefs: 025ABE46, 025ABF62
smtp_retr, xrefs: 025ABE61, 025ABF8C
smtp_ban, xrefs: 025ABE55, 025ABF77

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 0cacfa0bdceb2159ac1e461d0aed536c35fa3476368665ca337e2863682e324e
Instruction ID: 55cc8138099f63db2507f517083da2454dfd3629a17cb834d7adf46584883477
Opcode Fuzzy Hash: 0cacfa0bdceb2159ac1e461d0aed536c35fa3476368665ca337e2863682e324e
Instruction Fuzzy Hash: 7351A471A0021AEFDB119F64C8A2BAEBFA9BF5434CF484465E941AB250D730E941CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 025A6A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,76128A60,?,?,?,?,025A9A60,?,?,025A9E9D), ref: 025A6A7D
GetDiskFreeSpaceA.KERNEL32(025A9E9D,025A9A60,?,?,?,025B22F8,?,?,?,025A9A60,?,?,025A9E9D), ref: 025A6ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,025A9A60,?,?,025A9E9D), ref: 025A6B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,025A9A60,?,?,025A9E9D), ref: 025A6B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,025A9A60,?,?,025A9E9D), ref: 025A6B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,025A9A60,?,?,025A9E9D), ref: 025A6B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,025A9A60,?,?,025A9E9D), ref: 025A6B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,025A9A60,?,?,025A9E9D), ref: 025A6B80
GetLastError.KERNEL32(?,?,?,025A9A60,?,?,025A9E9D,?,?,?,?,?,025A9E9D,?,00000022,?), ref: 025A6B96

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 382a9cc5dc0c6364f0636e6cffd7a5e62ee678a6c05d4d2dc9620fed59e04917
Instruction ID: 023d78f01ca8cf918666aa9b4ec4bc1ee63e86b9ba5cdd0245f89be7345db30b
Opcode Fuzzy Hash: 382a9cc5dc0c6364f0636e6cffd7a5e62ee678a6c05d4d2dc9620fed59e04917
Instruction Fuzzy Hash: A331DDB2D0114DBFCF029FA08856AAFBFBDFB88310F084966E611E3240D73085599F69

Uniqueness

Uniqueness Score: -1.00%

Function 025A6F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,025AD7C3), ref: 025A6F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,025AD7C3), ref: 025A6FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 025A6FE8
LocalFree.KERNEL32(00000120), ref: 025A701F
wsprintfA.USER32 ref: 025A7036

Strings

/%d, xrefs: 025A7030
|, xrefs: 025A6FB3

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 158786704e56cade0ccd451bfda9a8a5abcf8cdec2830aefc79018712a4d1768
Instruction ID: 27f21ddfccccd4410eaa644a445d504ff50a8d1e6915172090e69f83da725bf3
Opcode Fuzzy Hash: 158786704e56cade0ccd451bfda9a8a5abcf8cdec2830aefc79018712a4d1768
Instruction Fuzzy Hash: 5B31FA72900219ABDB01DFA8D85AAEF7BBCFF04354F048566F959DB140EB35D6088F98

Uniqueness

Uniqueness Score: -1.00%

Function 025A6CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,025B22F8,000000E4,025A6DDC,000000C8), ref: 025A6CE7
GetProcAddress.KERNEL32(00000000), ref: 025A6CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 025A6D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 025A6D2B

Strings

C:\Windows\SysWOW64\, xrefs: 025A6CC9, 025A6CD1, 025A6CFE, 025A6D05, 025A6D13, 025A6D1E, 025A6D2A, 025A6D42, 025A6D5F, 025A6D85
kernel32, xrefs: 025A6CE2
GetSystemWow64DirectoryA, xrefs: 025A6CDD

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 2846514cdb858b1265d0b740cabbd5c4f995b375042c2e1af5c32e3a4138d584
Instruction ID: 19b04a167d18fef0431997bd39c4d5149934fad2beda6b6f34ae16b7d35e3779
Opcode Fuzzy Hash: 2846514cdb858b1265d0b740cabbd5c4f995b375042c2e1af5c32e3a4138d584
Instruction Fuzzy Hash: 10210455A802457AFB235A338CABFBF3E8DAF42694F0C0854FD04EA0C0C7948449C2BE

Uniqueness

Uniqueness Score: -1.00%

Function 025A977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,025A9947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,025B22F8), ref: 025A97B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,025B22F8), ref: 025A97EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,025B22F8), ref: 025A97F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,025B22F8), ref: 025A9831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,025B22F8), ref: 025A984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,025B22F8), ref: 025A985B

Strings

D, xrefs: 025A97A9

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 3bff2a3eed37fe1147e0e6ff3dd93ff92daa66995702c3759bbe040226d313bd
Instruction ID: 759c752446bd55eb5eb4c2fefe4d6f645dde176a2f31b682674c42820eeb58c9
Opcode Fuzzy Hash: 3bff2a3eed37fe1147e0e6ff3dd93ff92daa66995702c3759bbe040226d313bd
Instruction Fuzzy Hash: C4210C71D41129ABDB529FA1DC4AFEF7F7CFF05654F000461BA19E1080EB309654CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 025A2923 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

]Vw`'Vw, xrefs: 025A2A04

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID: ]Vw`'Vw
API String ID: 0-147723481
Opcode ID: 93417debb2295299fb05b60dd43ccb555b9dcf9dda52ac8afde701e40beb0726
Instruction ID: 62ee7bed141a99343137f4673cd5873e6d4dcd4935c998d69efc1d7c48ae6742
Opcode Fuzzy Hash: 93417debb2295299fb05b60dd43ccb555b9dcf9dda52ac8afde701e40beb0726
Instruction Fuzzy Hash: CA31B272A00309ABDB119FA5CC93BBEB7F5FF88701F10485AE905E6241E374D651CB58

Uniqueness

Uniqueness Score: -1.00%

Function 025AE8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 025ADD05: GetTickCount.KERNEL32 ref: 025ADD0F
Part of subcall function 025ADD05: InterlockedExchange.KERNEL32(025B36B4,00000001), ref: 025ADD44
Part of subcall function 025ADD05: GetCurrentThreadId.KERNEL32 ref: 025ADD53

Part of subcall function 025ADD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 025ADDB5

lstrcpynA.KERNEL32(?,025A1E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,025AEAAA,?,?), ref: 025AE8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,025AEAAA,?,?,00000001,?,025A1E84,?), ref: 025AE935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,025AEAAA,?,?,00000001,?,025A1E84,?,0000000A), ref: 025AE93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,025AEAAA,?,?,00000001,?,025A1E84,?), ref: 025AE94F

Strings

flags_upd, xrefs: 025AE8A7
localcfg, xrefs: 025AE8AB

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: b3e212319ad1e715f14bf21c2e82d79e0c4ed161748aaa08fd3e642b37ecb336
Instruction ID: 48029f72ec8c7f7d8e228618a1e3d71078cf07a1ec5d4ba4c796481214bd2b0e
Opcode Fuzzy Hash: b3e212319ad1e715f14bf21c2e82d79e0c4ed161748aaa08fd3e642b37ecb336
Instruction Fuzzy Hash: E0513E72D0020AAFCB11EFA8C996DAEBBFAFF48304F14456AE405A7610D735EA14CF54

Uniqueness

Uniqueness Score: -1.00%

Function 025A6BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 025A6BB2

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 28431c5e1d48329934ff3ad8ed77f4989c305a1967b977b42da260c37fccc061
Instruction ID: 1bf284871eb9e29dfbce6951323bc88391d35ebfa86b7deaef34335ee3ab84a7
Opcode Fuzzy Hash: 28431c5e1d48329934ff3ad8ed77f4989c305a1967b977b42da260c37fccc061
Instruction Fuzzy Hash: 8621A176905109FFDB126B70ED6ADAF3EACEB44764B140821F502E1080EB30DA04EA7C

Uniqueness

Uniqueness Score: -1.00%

Function 025A9064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,025B22F8), ref: 025A907B
wsprintfA.USER32 ref: 025A90E9
CreateFileA.KERNEL32(025B22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 025A910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 025A9122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 025A912D
CloseHandle.KERNEL32(00000000), ref: 025A9134

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f30db677cf29dfd540a8253f0b12c122d96b3f0cfcd8034efe25f2fe6096e41a
Instruction ID: b97ccd200a9bff46a630a13402bad09c3a472200ab393d6b6c6aa7e3f5517716
Opcode Fuzzy Hash: f30db677cf29dfd540a8253f0b12c122d96b3f0cfcd8034efe25f2fe6096e41a
Instruction Fuzzy Hash: 931187F6A405147BF7657A21DC1BEEF766FEFC4700F008465BB0AE6080EA704A159A68

Uniqueness

Uniqueness Score: -1.00%

Function 025ADD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 025ADD0F
GetCurrentThreadId.KERNEL32 ref: 025ADD20
GetTickCount.KERNEL32 ref: 025ADD2E
Sleep.KERNEL32(00000000,?,761311B0,?,00000000,025AE538,?,761311B0,?,00000000,?,025AA445), ref: 025ADD3B
InterlockedExchange.KERNEL32(025B36B4,00000001), ref: 025ADD44
GetCurrentThreadId.KERNEL32 ref: 025ADD53

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 3a522cc125f21f0528e81c14b1f646ab21d4ac0165277f819e49b5512a205257
Instruction ID: 1bbc3abffb179f0a89096bde9be46a3b1f9d21b34b327636343a70d245ac441d
Opcode Fuzzy Hash: 3a522cc125f21f0528e81c14b1f646ab21d4ac0165277f819e49b5512a205257
Instruction Fuzzy Hash: 8DF0E971986108AFC7C27F75A886B3E3BB4F749351F400855E209D2180E720506DEF2D

Uniqueness

Uniqueness Score: -1.00%

Function 025AAD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 025AAD1C
lstrlenA.KERNEL32(00000000), ref: 025AAD60
lstrlenA.KERNEL32(00000000), ref: 025AAD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 025AAD7F

Strings

LocalHost, xrefs: 025AAD79

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 6c67fc53bdcfe25d5f43174175f9c1a2b7b44e49d7d6a0eca2085258dff70c84
Instruction ID: e0c4f40e526fbd10f3290567ecfeab2c99275c9e1f5f440ecb0a77b0c391b0ff
Opcode Fuzzy Hash: 6c67fc53bdcfe25d5f43174175f9c1a2b7b44e49d7d6a0eca2085258dff70c84
Instruction Fuzzy Hash: 7601F520C8428A5EDF324A38D866BBD7F76BB8664AF500455E4C09B155EF248087C7AE

Uniqueness

Uniqueness Score: -1.00%

Function 025A4280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,025A98FD,00000001,00000100,025B22F8,025AA3C7), ref: 025A4290
CloseHandle.KERNEL32(025AA3C7), ref: 025A43AB
CloseHandle.KERNEL32(00000001), ref: 025A43AE

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: fd13066362fb1b4a4750de4561e16e264e911d226d9f311370d1782ae79eac98
Instruction ID: fa8f7151ae119d46970fab2084a527b59db8a7bbae1b37a24225cd69794615b2
Opcode Fuzzy Hash: fd13066362fb1b4a4750de4561e16e264e911d226d9f311370d1782ae79eac98
Instruction Fuzzy Hash: E841B171C1020ABADF10ABA1DD96FAFBFBDFF40324F104556F604A6180D7748650DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 025A6069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,025A64CF,00000000), ref: 025A609C
LoadLibraryA.KERNEL32(?,?,025A64CF,00000000), ref: 025A60C3
GetProcAddress.KERNEL32(?,00000014), ref: 025A614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 025A619E

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 7b2d891105ad6d258e6c941bb546de0463350b30fae2d783fb2bbb4a1d28ba48
Instruction ID: cb032fabb61daca6c4b69378ec19864c2aa5a5ea8a7076c5204158325ca93206
Opcode Fuzzy Hash: 7b2d891105ad6d258e6c941bb546de0463350b30fae2d783fb2bbb4a1d28ba48
Instruction Fuzzy Hash: C4415A71E0020AAFDF14CF58C8A6B6EBBB9FF44358F188469E815D7291E730E944CB94

Uniqueness

Uniqueness Score: -1.00%

Function 025A26FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 025A272E
htons.WS2_32(00000001), ref: 025A2752
htons.WS2_32(0000000F), ref: 025A27D5
htons.WS2_32(00000001), ref: 025A27E3
sendto.WS2_32(?,025B2BF8,00000009,00000000,00000010,00000010), ref: 025A2802

Part of subcall function 025AEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,025AEBFE,7FFF0001,?,025ADB55,7FFF0001), ref: 025AEBD3
Part of subcall function 025AEBCC: RtlAllocateHeap.NTDLL(00000000,?,025ADB55,7FFF0001), ref: 025AEBDA

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: ca8f13aab038345f714d4376220053f8e83506cc11518d4d3f035aa59b55e610
Instruction ID: 17f925ce6a54fc6af079a5b066cbca8da046a8c14842a681bd63e5aef06aca76
Opcode Fuzzy Hash: ca8f13aab038345f714d4376220053f8e83506cc11518d4d3f035aa59b55e610
Instruction Fuzzy Hash: 01318C34A883829FD7118F74D892A657B60FF18318F194C7DDC15CB302DA32D446EB28

Uniqueness

Uniqueness Score: -1.00%

Function 025A9145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,025B22F8), ref: 025A915F
GetModuleFileNameA.KERNEL32(00000000), ref: 025A9166
CharToOemA.USER32(?,?), ref: 025A9174
wsprintfA.USER32 ref: 025A91A9

Part of subcall function 025A9064: GetTempPathA.KERNEL32(00000400,?,00000000,025B22F8), ref: 025A907B
Part of subcall function 025A9064: wsprintfA.USER32 ref: 025A90E9
Part of subcall function 025A9064: CreateFileA.KERNEL32(025B22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 025A910E
Part of subcall function 025A9064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 025A9122
Part of subcall function 025A9064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 025A912D
Part of subcall function 025A9064: CloseHandle.KERNEL32(00000000), ref: 025A9134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 025A91E1

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 8616624351eb8b0705fadb70eeb33e8b45af4eceebb695d62cb198aa67ad7686
Instruction ID: 0142b74e9d2a38cae25a580e22e7793a6d9b40e33877494fdface071e8f15b55
Opcode Fuzzy Hash: 8616624351eb8b0705fadb70eeb33e8b45af4eceebb695d62cb198aa67ad7686
Instruction Fuzzy Hash: 630192F6C401187BDB61AA61CC4AFEF7B7CEB85701F0004A1BB09E2080E67096898F74

Uniqueness

Uniqueness Score: -1.00%

Function 025A2419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,025A2491,?,?,?,025AE844,-00000030,?,?,?,00000001), ref: 025A2429
lstrlenA.KERNEL32(?,?,025A2491,?,?,?,025AE844,-00000030,?,?,?,00000001,025A1E3D,00000001,localcfg,lid_file_upd), ref: 025A243E
lstrcmpiA.KERNEL32(?,?), ref: 025A2452
lstrlenA.KERNEL32(?,?,025A2491,?,?,?,025AE844,-00000030,?,?,?,00000001,025A1E3D,00000001,localcfg,lid_file_upd), ref: 025A2467

Strings

localcfg, xrefs: 025A241F

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e7b5b787dfafeb80ab61129a84fff55297405b0cd2c3c33f4c26d784855ec51a
Instruction ID: e17861306cf7de11d28a048c411af791c8061747006cc45651621e15b4636be3
Opcode Fuzzy Hash: e7b5b787dfafeb80ab61129a84fff55297405b0cd2c3c33f4c26d784855ec51a
Instruction Fuzzy Hash: A7011A31600218AFCF11EF69CC829DE7BA9FF44354B01C425EC59D7200E330EA548A98

Uniqueness

Uniqueness Score: -1.00%

Function 025A1C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 025A1CE1
wsprintfA.USER32 ref: 025A1D6B

Strings

%u.%u.%u.%u.%s, xrefs: 025A1CDB, 025A1D65
localcfg, xrefs: 025A1C70

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: ffb2c4d434e540f7046ab54384cc0ceb90eee98a020cf1f5018557b73f1d634c
Instruction ID: 1c8dd6d5125f437b6dba35775ae5c57cf88f347242e05262d2117325e4bc65ca
Opcode Fuzzy Hash: ffb2c4d434e540f7046ab54384cc0ceb90eee98a020cf1f5018557b73f1d634c
Instruction Fuzzy Hash: FE4199729042999FDB22CFB88D65BEE3FE9AF49310F240056FDA4D3141D634EA05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 025AE654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 025ADD05: GetTickCount.KERNEL32 ref: 025ADD0F
Part of subcall function 025ADD05: InterlockedExchange.KERNEL32(025B36B4,00000001), ref: 025ADD44
Part of subcall function 025ADD05: GetCurrentThreadId.KERNEL32 ref: 025ADD53

lstrcmpA.KERNEL32(761311B8,00000000,?,761311B0,00000000,?,025A5EC1), ref: 025AE693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,761311B0,00000000,?,025A5EC1), ref: 025AE6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,761311B0,00000000,?,025A5EC1), ref: 025AE722

Strings

89ABCDEF, xrefs: 025AE721

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: b6fbcb088c496bf5d4ba8f153f3fc644fb3c3a1bd3bf580dc3be9887d8addfb4
Instruction ID: f15e50cab25d6a25958289b6a4eab733dbecb4a5714a4c766b5db744affd9a8b
Opcode Fuzzy Hash: b6fbcb088c496bf5d4ba8f153f3fc644fb3c3a1bd3bf580dc3be9887d8addfb4
Instruction Fuzzy Hash: AA31AF31A04746DBCB329E68E8A7BAF7BE4BF05314F104C3AE55687541E770E884CB99

Uniqueness

Uniqueness Score: -1.00%

Function 025AE095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,025AE2A3,00000000,00000000,00000000,00020106,00000000,025AE2A3,00000000,000000E4), ref: 025AE0B2
RegSetValueExA.ADVAPI32(025AE2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,025B22F8), ref: 025AE127
RegDeleteValueA.ADVAPI32(025AE2A3,?,?,?,?,?,000000C8,025B22F8), ref: 025AE158
RegCloseKey.ADVAPI32(025AE2A3,?,?,?,?,000000C8,025B22F8,?,?,?,?,?,?,?,?,025AE2A3), ref: 025AE161

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: c554ba24da34b709c782e4a5634c536d49daabbead4ee9e12d4b4b9e7d3ef52f
Instruction ID: 6efc21baed21f53fb6a36d34bd15eac7ff8fae20854a3c3e4a61ebefc60a8981
Opcode Fuzzy Hash: c554ba24da34b709c782e4a5634c536d49daabbead4ee9e12d4b4b9e7d3ef52f
Instruction Fuzzy Hash: 7E214C71E0022EABDF219EA4DC8AEAF7FB9FF09750F004071F904A6150E6318A14DB94

Uniqueness

Uniqueness Score: -1.00%

Function 025A3F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,025AA3C7,00000000,00000000,000007D0,00000001), ref: 025A3F44
GetLastError.KERNEL32 ref: 025A3F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 025A3F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 025A3F72

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 425dff046e680bc1c41b9c4210d0e3a62a8e466fe87f0a530ac7c4e70b4e7170
Instruction ID: 71d2ac04ec257c0b501bb770a486576d29bd119810c25a76f86bd53980c8a720
Opcode Fuzzy Hash: 425dff046e680bc1c41b9c4210d0e3a62a8e466fe87f0a530ac7c4e70b4e7170
Instruction Fuzzy Hash: 76011372920109BBDB52DE90DD85BEF3BBCFB04369F404465FA01E2080D734DA648BAA

Uniqueness

Uniqueness Score: -1.00%

Function 025A3F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,025AA3C7,00000000,00000000,000007D0,00000001), ref: 025A3FB8
GetLastError.KERNEL32 ref: 025A3FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 025A3FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 025A3FE6

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 5c991f0320c1ecdbdd8ed35e3fac61d888ec3f41435b047f65fed09b1f98c793
Instruction ID: e190cd0281acde2fdc863bca6da07dc77253e9af976cccf1ce775e48be5f85e5
Opcode Fuzzy Hash: 5c991f0320c1ecdbdd8ed35e3fac61d888ec3f41435b047f65fed09b1f98c793
Instruction Fuzzy Hash: EB01D77292010AABDF11DF94D946BEF7BBCFB04359F404451F902E2040D774DA649BA5

Uniqueness

Uniqueness Score: -1.00%

Function 025AA4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 025AA4D1
GetTickCount.KERNEL32 ref: 025AA4E4
Sleep.KERNEL32(00000000,?,025AC2E9,025AC4E0,00000000,localcfg,?,025AC4E0,025B3588,025A8810), ref: 025AA4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 025AA4FA

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: c03c791ec26d47c30d547605949bbe8a010c14afde1f7a9a3734ddb7948d5eca
Instruction ID: fdc4e62b0b14ee41212d6c0c9b0b0b486ac78052be7d753724e27e4e6fd7fbd7
Opcode Fuzzy Hash: c03c791ec26d47c30d547605949bbe8a010c14afde1f7a9a3734ddb7948d5eca
Instruction Fuzzy Hash: 91E026332412185BCA002BA5AC84FBF37A8BB497A1F410421FA04D3180C616A855C1BE

Uniqueness

Uniqueness Score: -1.00%

Function 025A4E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 025A4E9E
GetTickCount.KERNEL32 ref: 025A4EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 025A4EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 025A4EC3

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: b4f8681cb630e68972297199e4c260095a36e0f7c415e20f36df556aa3f549fa
Instruction ID: c2de3bd09275a2496c4aecd6b22871e4bb4ccfdd802c92cc227955513ceb7628
Opcode Fuzzy Hash: b4f8681cb630e68972297199e4c260095a36e0f7c415e20f36df556aa3f549fa
Instruction Fuzzy Hash: 47E0863264121857D6102AF9AC85F6B6649AB45361F410931E609D2180C696D85645FA

Uniqueness

Uniqueness Score: -1.00%

Function 025A4BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 025A4BDD
GetTickCount.KERNEL32 ref: 025A4BEC
Sleep.KERNEL32(00000000,?,?,?,02A2C1A4,025A50F2), ref: 025A4BF9
InterlockedExchange.KERNEL32(02A2C198,00000001), ref: 025A4C02

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 7ac9fe697fca9962b28d43b7bf59f25172e9337c6e814293912b83e8479399be
Instruction ID: dc764dbdbac2d2a96b3434fa402ca9558d294f638ead04b65593da8cde5397a5
Opcode Fuzzy Hash: 7ac9fe697fca9962b28d43b7bf59f25172e9337c6e814293912b83e8479399be
Instruction Fuzzy Hash: 2EE0863668221C57CA502AE95C81F7B7758AB85361F460862F608D2180C596D45545B9

Uniqueness

Uniqueness Score: -1.00%

Function 025A30FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 025A3103
GetTickCount.KERNEL32 ref: 025A310F
Sleep.KERNEL32(00000000), ref: 025A311C
InterlockedExchange.KERNEL32(?,00000001), ref: 025A3128

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 82f3283c3cb5bcd3eb7b86f3f449f18785284b63fc7be72adfb65d620b84276e
Instruction ID: 1b1ea6dfb383592f60cd3fa4c79c76c37285774aeae30306959898806e12fc79
Opcode Fuzzy Hash: 82f3283c3cb5bcd3eb7b86f3f449f18785284b63fc7be72adfb65d620b84276e
Instruction Fuzzy Hash: CEE0C231640219BBDB406FB5AD46B6E6A5AEF847A5F0108B2F201D20D0C65088149979

Uniqueness

Uniqueness Score: -1.00%

Function 025A8CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 025A8D02
GetTickCount.KERNEL32 ref: 025A8DA1

Strings

localcfg, xrefs: 025A8D19

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 4ef739c80e4f8101aba6b99f2774749397ecb8df70e6892891761039404568c4
Instruction ID: 3f86c741849c661b81e647e84fdb5672595593672d9e1f68a87a269327877d26
Opcode Fuzzy Hash: 4ef739c80e4f8101aba6b99f2774749397ecb8df70e6892891761039404568c4
Instruction Fuzzy Hash: E221D632A20515AFDB51DF78D8AA66FBFBAFF60354B290499D401EB101CB30E944CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 025ABFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 025ABFD0
wsprintfA.USER32 ref: 025AC060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 025AC057

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: abed928c68d5b6d24eb2a5d9377fd9204fd1b9224376a3e95b01bd9e3b7f7730
Instruction ID: e15c5d8a6bf593bd60bae2aece3bc1c97556f3da6b72b341dc1905ec9d0e311a
Opcode Fuzzy Hash: abed928c68d5b6d24eb2a5d9377fd9204fd1b9224376a3e95b01bd9e3b7f7730
Instruction Fuzzy Hash: A6118672600100EFDB429EA9CD44E567FA6FF88318B34819CF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 025A38F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 025A30FA: GetTickCount.KERNEL32 ref: 025A3103
Part of subcall function 025A30FA: InterlockedExchange.KERNEL32(?,00000001), ref: 025A3128

GetCurrentThreadId.KERNEL32 ref: 025A3929
GetCurrentThreadId.KERNEL32 ref: 025A3939

Strings

%FROM_EMAIL, xrefs: 025A3913

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: 65993164cba317aeeafe1c6666b842d2cfd35cb565cac2603cd760303db7fdf2
Instruction ID: 348a81e23c21d032240e55b07d5188d20ccc55b59bb236c76fbe099ec8c426d6
Opcode Fuzzy Hash: 65993164cba317aeeafe1c6666b842d2cfd35cb565cac2603cd760303db7fdf2
Instruction Fuzzy Hash: 78116A71900209FFE761DF19D492A6DF7F5FB4871AF10899EE84497280C770AA84DFA8

Uniqueness

Uniqueness Score: -1.00%

Function 025AAB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,025ABD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 025AABB9
InterlockedIncrement.KERNEL32(025B3640), ref: 025AABE1

Strings

%FROM_EMAIL, xrefs: 025AAB8C

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: d20cc6761f92610a6f327ea900c490ad10b6b7eeff14de6c0f1960becf89970e
Instruction ID: 097945a99d772ef17278c59a4ee0b6f65eee24d20fe8e6ebebe22029f8657dc7
Opcode Fuzzy Hash: d20cc6761f92610a6f327ea900c490ad10b6b7eeff14de6c0f1960becf89970e
Instruction Fuzzy Hash: 1E01B1319093C8AFEB22CF28D892F9A7FA6BF45314F144884F58057243C370E544CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 025A26B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 025A26C3
inet_ntoa.WS2_32(?), ref: 025A26E4

Strings

localcfg, xrefs: 025A26CD, 025A26D2, 025A26DE

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 5cfa8a80830e144e2b904066f957f3cdd2211be6a2b9f87b9feaccf69c362edb
Instruction ID: 6698a00efe2530433d3987c4795164968c13d1727ab94cf5df256e18ebb3c622
Opcode Fuzzy Hash: 5cfa8a80830e144e2b904066f957f3cdd2211be6a2b9f87b9feaccf69c362edb
Instruction Fuzzy Hash: B5F082325492096FEB016EA4EC17AAE3B9DEF04250F104425F908CA090DB71D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 025AEAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,025AEB54,_alldiv,025AF0B7,80000001,00000000,00989680,00000000,?,?,?,025AE342,00000000,7558EA50,80000001,00000000), ref: 025AEAF2
GetProcAddress.KERNEL32(77520000,00000000), ref: 025AEB07

Strings

ntdll.dll, xrefs: 025AEAED

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b28ecc4cedbcb54587e235155862d9e4868e9c8d7136d11004cff89b7760f281
Instruction ID: d985f0feb4f189249ce152025904cfe740cd75c4e45cde5a4e02ffb46fbad01b
Opcode Fuzzy Hash: b28ecc4cedbcb54587e235155862d9e4868e9c8d7136d11004cff89b7760f281
Instruction Fuzzy Hash: D7D0C934E85B06AB9F974F78996FA5A7BE8BB40741B808865A40AE1100E730D42CEA0C

Uniqueness

Uniqueness Score: -1.00%

Function 025A2F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025A2D21: GetModuleHandleA.KERNEL32(00000000,76132640,?,00000000,025A2F01,?,025A20FF,025B2000), ref: 025A2D3A
Part of subcall function 025A2D21: LoadLibraryA.KERNEL32(?), ref: 025A2D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 025A2F73
HeapFree.KERNEL32(00000000), ref: 025A2F7A

Memory Dump Source

Source File: 00000017.00000002.3738563627.00000000025A0000.00000040.00000400.00020000.00000000.sdmp, Offset: 025A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_25a0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 9d37886f0f163bd9398a48aa0bc5790bfaa97e9c2a74338136b81cca15e268dd
Instruction ID: 25cf02137c26b9bce073b8f7f4a4a8a73d3d1fe74694dd61b911d1730723e7c9
Opcode Fuzzy Hash: 9d37886f0f163bd9398a48aa0bc5790bfaa97e9c2a74338136b81cca15e268dd
Instruction Fuzzy Hash: 1E51A171900246AFCB069F64D89AAFEBB75FF05304F1045A9EC96C7210E732DA19CB94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

C:\Users\user\AppData\Local\Temp\wdkncqjt.exe

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

C:\Windows\SysWOW64\ptlohvde\wdkncqjt.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre