Edit tour

Windows Analysis Report
qdHMT36Tn9.exe

Overview

General Information

Sample name:	qdHMT36Tn9.exe renamed because original name is a hash value
Original sample name:	3E5BA25AA4F23CEB11BE209D1967E341.exe
Analysis ID:	1393956
MD5:	3e5ba25aa4f23ceb11be209d1967e341
SHA1:	c25a05acb5231776456d08fad7df0e48d92931c0
SHA256:	518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818
Tags:	exenjratRAT
Infos:

Detection

44Caliber Stealer, Njrat, Rags Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected 44Caliber Stealer

Yara detected Njrat

Yara detected Rags Stealer

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Creates autostart registry keys with suspicious names

Drops PE files to the startup folder

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

qdHMT36Tn9.exe (PID: 1984 cmdline: C:\Users\user\Desktop\qdHMT36Tn9.exe MD5: 3E5BA25AA4F23CEB11BE209D1967E341)

1.exe (PID: 4292 cmdline: "C:\Users\user\AppData\Local\Temp\1.exe" MD5: 0CE3051B867D50AA172D1B332F156E3E)

3.exe (PID: 5656 cmdline: "C:\Users\user\AppData\Local\Temp\3.exe" MD5: 6D11195AF6CCA04EB53ECCF9AAF329DC)

netsh.exe (PID: 2260 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\3.exe" "3.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

3.exe (PID: 7064 cmdline: "C:\Users\user\AppData\Local\Temp\3.exe" .. MD5: 6D11195AF6CCA04EB53ECCF9AAF329DC)

3.exe (PID: 2724 cmdline: "C:\Users\user\AppData\Local\Temp\3.exe" .. MD5: 6D11195AF6CCA04EB53ECCF9AAF329DC)

3.exe (PID: 6208 cmdline: "C:\Users\user\AppData\Local\Temp\3.exe" .. MD5: 6D11195AF6CCA04EB53ECCF9AAF329DC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Host": "mary-cottage.gl.at.ply.gg", "Port": "10652", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "server.exe", "Install Dir": "TEMP"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\3.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Local\Temp\3.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7f0a:$a3: Download ERROR 0x81fc:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Local\Temp\3.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
C:\Users\user\AppData\Local\Temp\3.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7f0a:$a3: Download ERROR 0x81fc:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
C:\Users\user\AppData\Local\Temp\1.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\1.exe	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1.exe	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3a825:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
C:\Users\user\AppData\Local\Temp\1.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x3bef9:$s1: \VPN\NordVPN 0x3bf9d:$s1: \VPN\NordVPN 0x3c033:$s2: \VPN\OpenVPN 0x3c0a1:$s3: \VPN\ProtonVPN
C:\Users\user\AppData\Local\Temp\1.exe	MALWARE_Win_A310Logger	Detects A310Logger	ditekSHen	0x3d7a5:$s11: \Ethereum\keystore 0x3a7ae:$v1_5: sharedSecret 0x3c8c7:$v1_6: ":"([^"]+)" 0x328dc:$v1_8: WritePasswords 0x3309d:$v1_9: sGeckoBrowserPaths 0x2e555:$v1_10: get_sPassword
Click to see the 10 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64e1:$a1: get_Registry 0x7f2a:$a3: Download ERROR 0x821c:$a5: netsh firewall delete allowedprogram "
00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x8112:$a1: netsh firewall add allowedprogram 0x830c:$b1: [TAP] 0x82b2:$b2: & exit 0x827e:$c1: md.exe /k ping 0 & del
00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x62c1:$a1: get_Registry 0x7d0a:$a3: Download ERROR 0x7ffc:$a5: netsh firewall delete allowedprogram "
00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ef2:$a1: netsh firewall add allowedprogram 0x80ec:$b1: [TAP] 0x8092:$b2: & exit 0x805e:$c1: md.exe /k ping 0 & del
00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3a625:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000002.00000002.2051820157.000001F2CD109000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2051820157.000001F2CD109000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
00000002.00000002.2051820157.000001F2CD1D3000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x30e4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x381c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x17845:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000003.00000002.4480531198.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: qdHMT36Tn9.exe PID: 1984	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: qdHMT36Tn9.exe PID: 1984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: qdHMT36Tn9.exe PID: 1984	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
Process Memory Space: qdHMT36Tn9.exe PID: 1984	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
Process Memory Space: qdHMT36Tn9.exe PID: 1984	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x5877b:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: 1.exe PID: 4292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1.exe PID: 4292	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
Process Memory Space: 1.exe PID: 4292	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
Process Memory Space: 1.exe PID: 4292	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x383bf:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x64422:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x6450d:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: 3.exe PID: 5656	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.0.3.exe.5c0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
3.0.3.exe.5c0000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7f0a:$a3: Download ERROR 0x81fc:$a5: netsh firewall delete allowedprogram "
3.0.3.exe.5c0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80f2:$a1: netsh firewall add allowedprogram 0x82ec:$b1: [TAP] 0x8292:$b2: & exit 0x825e:$c1: md.exe /k ping 0 & del
3.0.3.exe.5c0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81fc:$s1: netsh firewall delete allowedprogram 0x80f2:$s2: netsh firewall add allowedprogram 0x825c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ee6:$s4: Execute ERROR 0x7f46:$s4: Execute ERROR 0x7f0a:$s5: Download ERROR 0x82a2:$s6: [kl]
2.0.1.exe.1f2cb290000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.0.1.exe.1f2cb290000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.0.1.exe.1f2cb290000.0.unpack	JoeSecurity_RagsStealer	Yara detected Rags Stealer	Joe Security
2.0.1.exe.1f2cb290000.0.unpack	JoeSecurity_44CaliberStealer	Yara detected 44Caliber Stealer	Joe Security
2.0.1.exe.1f2cb290000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3a825:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
2.0.1.exe.1f2cb290000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x3bef9:$s1: \VPN\NordVPN 0x3bf9d:$s1: \VPN\NordVPN 0x3c033:$s2: \VPN\OpenVPN 0x3c0a1:$s3: \VPN\ProtonVPN
2.0.1.exe.1f2cb290000.0.unpack	MALWARE_Win_A310Logger	Detects A310Logger	ditekSHen	0x3d7a5:$s11: \Ethereum\keystore 0x3a7ae:$v1_5: sharedSecret 0x3c8c7:$v1_6: ":"([^"]+)" 0x328dc:$v1_8: WritePasswords 0x3309d:$v1_9: sGeckoBrowserPaths 0x2e555:$v1_10: get_sPassword
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\user\AppData\Local\Temp\3.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\3.exe, ProcessId: 5656, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9902b29d6de7130c2f409ab27fb09fa7

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\3.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\3.exe, ProcessId: 5656, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9902b29d6de7130c2f409ab27fb09fa7

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\3.exe, ProcessId: 5656, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\3.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\3.exe, ProcessId: 5656, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9902b29d6de7130c2f409ab27fb09fa7

Snort Signatures

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:04.259395
SID:	2825563
Source Port:	49707
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:49.072739
SID:	2814860
Source Port:	49720
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:09.235022
SID:	2814860
Source Port:	49724
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:15.853737
SID:	2814860
Source Port:	49725
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:23.326434
SID:	2033132
Source Port:	49749
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:11.034301
SID:	2825563
Source Port:	49708
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:18.141345
SID:	2033132
Source Port:	49748
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:07.732975
SID:	2033132
Source Port:	49746
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:02.386885
SID:	2033132
Source Port:	49745
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:12.949378
SID:	2033132
Source Port:	49747
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:38.776331
SID:	2814856
Source Port:	49719
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:51.562322
SID:	2033132
Source Port:	49743
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:56.964928
SID:	2033132
Source Port:	49744
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:16.567473
SID:	2825564
Source Port:	49747
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:24.696429
SID:	2814856
Source Port:	49717
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:31.906944
SID:	2814856
Source Port:	49718
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:53.150930
SID:	2814860
Source Port:	49722
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:17.604122
SID:	2814856
Source Port:	49716
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:11.846735
SID:	2814856
Source Port:	49725
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:28.458601
SID:	2033132
Source Port:	49750
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:54.853217
SID:	2814856
Source Port:	49755
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:46.089995
SID:	2033132
Source Port:	49742
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:58.615681
SID:	2814856
Source Port:	49723
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:40.466833
SID:	2033132
Source Port:	49741
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:39.466746
SID:	2033132
Source Port:	49752
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:05.382586
SID:	2814856
Source Port:	49724
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:34.811467
SID:	2033132
Source Port:	49740
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:59.597580
SID:	2814856
Source Port:	49756
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:34.464701
SID:	2033132
Source Port:	49751
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:28.798105
SID:	2814856
Source Port:	49750
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:34.764199
SID:	2814856
Source Port:	49751
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:52.098391
SID:	2814856
Source Port:	49722
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:49.734616
SID:	2814856
Source Port:	49754
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:45.642655
SID:	2814856
Source Port:	49720
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:39.797300
SID:	2814856
Source Port:	49752
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:44.790001
SID:	2814856
Source Port:	49753
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:31.906944
SID:	2825563
Source Port:	49718
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:28.653198
SID:	2033132
Source Port:	49739
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:24.391981
SID:	2033132
Source Port:	49717
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:35.919369
SID:	2825564
Source Port:	49718
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:21.864454
SID:	2033132
Source Port:	49738
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:17.298204
SID:	2033132
Source Port:	49716
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:15.940296
SID:	2033132
Source Port:	49737
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:38.776331
SID:	2825563
Source Port:	49719
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:03.325082
SID:	2033132
Source Port:	49735
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:58.433164
SID:	2825564
Source Port:	49755
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:56:01.071896
SID:	2825564
Source Port:	49756
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:57.092450
SID:	2033132
Source Port:	49734
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:09.959178
SID:	2033132
Source Port:	49736
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:59.278876
SID:	2033132
Source Port:	49756
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:44.467327
SID:	2033132
Source Port:	49753
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:27.778338
SID:	2825564
Source Port:	49717
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:17.604122
SID:	2825563
Source Port:	49716
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:24.696429
SID:	2825563
Source Port:	49717
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:11.034301
SID:	2814856
Source Port:	49708
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:18.307570
SID:	2825564
Source Port:	49716
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:25.040431
SID:	2814856
Source Port:	49729
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:44.248452
SID:	2033132
Source Port:	49732
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:25.770567
SID:	2825564
Source Port:	49738
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:49.433586
SID:	2033132
Source Port:	49754
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:04.259395
SID:	2814856
Source Port:	49707
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:18.507651
SID:	2814856
Source Port:	49728
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:50.736922
SID:	2033132
Source Port:	49733
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:23.647835
SID:	2814856
Source Port:	49749
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:54.388467
SID:	2033132
Source Port:	49755
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:52.690799
SID:	2825564
Source Port:	49733
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:28.982204
SID:	2814860
Source Port:	49729
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:27.598799
SID:	2814860
Source Port:	49749
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:22.343303
SID:	2814860
Source Port:	49728
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:31.595838
SID:	2033132
Source Port:	49718
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:38.473071
SID:	2033132
Source Port:	49719
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:35.408526
SID:	2825564
Source Port:	49730
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:32.523742
SID:	2825564
Source Port:	49750
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:01.316397
SID:	2814860
Source Port:	49744
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:55.861168
SID:	2814860
Source Port:	49743
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:50.393995
SID:	2814860
Source Port:	49742
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:06.615566
SID:	2814860
Source Port:	49745
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:11.913957
SID:	2814860
Source Port:	49746
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:19.572153
SID:	2825564
Source Port:	49728
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:39.102451
SID:	2814860
Source Port:	49740
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:18.199865
SID:	2033132
Source Port:	49728
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:17.086051
SID:	2814860
Source Port:	49747
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:22.416223
SID:	2814860
Source Port:	49748
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:44.777989
SID:	2814860
Source Port:	49741
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:09.235022
SID:	2825564
Source Port:	49724
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:58.615681
SID:	2825563
Source Port:	49723
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:05.034795
SID:	2033132
Source Port:	49724
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:11.528070
SID:	2033132
Source Port:	49725
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:51.799554
SID:	2033132
Source Port:	49722
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:58.312088
SID:	2033132
Source Port:	49723
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:28.983704
SID:	2814856
Source Port:	49739
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:13.250021
SID:	2814856
Source Port:	49747
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:10.263467
SID:	2814856
Source Port:	49736
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:22.169858
SID:	2814856
Source Port:	49738
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:57.269542
SID:	2814856
Source Port:	49744
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:18.464218
SID:	2814856
Source Port:	49748
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:51.047431
SID:	2814856
Source Port:	49733
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:16.249447
SID:	2814856
Source Port:	49737
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:37.752783
SID:	2033132
Source Port:	49731
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:45.336723
SID:	2033132
Source Port:	49720
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:57.407277
SID:	2814856
Source Port:	49734
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:02.706342
SID:	2814856
Source Port:	49745
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:31.237871
SID:	2033132
Source Port:	49730
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:08.024603
SID:	2814856
Source Port:	49746
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:03.647201
SID:	2814856
Source Port:	49735
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:31.544107
SID:	2814856
Source Port:	49730
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:40.792497
SID:	2814856
Source Port:	49741
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:35.114530
SID:	2814856
Source Port:	49740
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:44.566584
SID:	2814856
Source Port:	49732
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:51.869617
SID:	2814856
Source Port:	49743
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:38.074175
SID:	2814856
Source Port:	49731
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:46.401491
SID:	2814856
Source Port:	49742
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:54.912197
SID:	2814860
Source Port:	49733
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:53.691251
SID:	2814860
Source Port:	49754
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:58.692906
SID:	2814860
Source Port:	49755
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:48.544889
SID:	2814860
Source Port:	49732
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:01.281165
SID:	2814860
Source Port:	49734
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:41.995232
SID:	2814860
Source Port:	49731
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:07.631530
SID:	2814860
Source Port:	49735
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:43.699808
SID:	2814860
Source Port:	49752
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:48.795743
SID:	2814860
Source Port:	49753
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:56:01.071896
SID:	2814860
Source Port:	49756
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:18.307570
SID:	2814860
Source Port:	49716
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:20.056141
SID:	2814860
Source Port:	49737
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:32.523742
SID:	2814860
Source Port:	49750
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:55:38.656173
SID:	2814860
Source Port:	49751
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:35.408526
SID:	2814860
Source Port:	49730
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:14.174404
SID:	2814860
Source Port:	49736
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:25.770567
SID:	2814860
Source Port:	49738
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:53.150930
SID:	2825564
Source Port:	49722
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:52.098391
SID:	2825563
Source Port:	49722
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:35.919369
SID:	2814860
Source Port:	49718
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:33.408174
SID:	2814860
Source Port:	49739
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:27.778338
SID:	2814860
Source Port:	49717
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:04.094268
SID:	2033132
Source Port:	49707
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:49.072739
SID:	2825564
Source Port:	49720
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:54:44.533872
SID:	2825564
Source Port:	49741
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:45.642655
SID:	2825563
Source Port:	49720
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:53:24.727442
SID:	2033132
Source Port:	49729
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 147.185.221.17

Timestamp:	02/17/24-20:52:10.711575
SID:	2033132
Source Port:	49708
Destination Port:	10652
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: mary-cottage.gl.at.ply.gg

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1.exe	Avira: detection malicious, Label: HEUR/AGEN.1307065
Source: C:\Users\user\AppData\Local\Temp\3.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen

Found malware configuration

Source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp

Malware Configuration Extractor: Njrat {"Host": "mary-cottage.gl.at.ply.gg", "Port": "10652", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "server.exe", "Install Dir": "TEMP"}

Multi AV Scanner detection for domain / URL

Source: mary-cottage.gl.at.ply.gg	Virustotal: Detection: 8%			Perma Link
Source: mary-cottage.gl.at.ply.gg	Virustotal: Detection: 8%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\1.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\3.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\3.exe	Virustotal: Detection: 88%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	Virustotal: Detection: 88%	Perma Link

Multi AV Scanner detection for submitted file

Source: qdHMT36Tn9.exe	ReversingLabs: Detection: 76%
Source: qdHMT36Tn9.exe	Virustotal: Detection: 77%			Perma Link

Yara detected Njrat

Source: Yara match	File source: 3.0.3.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4480531198.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3.exe PID: 5656, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, type: DROPPED

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: qdHMT36Tn9.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: +POFWV
Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: Y^XOKG
Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: q;MDST
Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: K;]CTQM+S
Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: J^B_F
Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: x:BYP/8Q_]
Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: ~yJZ43K(Fuw
Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: {:$!1'
Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: hG^GAWQ
Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: ABJDC^
Source: 2.0.1.exe.1f2cb290000.0.unpack	String decryptor: "*"!5<'t9<s:?;s5p'' o!1!:6'$

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: freegeoip.app

Source: qdHMT36Tn9.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\3.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.160.84:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.71:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: qdHMT36Tn9.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: qdHMT36Tn9.exe
Source:	Binary string: mscorlib.pdb source: 1.exe, 00000002.00000002.2051820157.000001F2CD172000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: 1.exe, 00000002.00000002.2051820157.000001F2CD24F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: 1.exe, 00000002.00000002.2057293840.000001F2E5836000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Downloads\44CALIBER-main\44CALIBER\obj\Release\Nursultan.pdb source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000002.2051820157.000001F2CD192000.00000004.00000800.00020000.00000000.sdmp, 1.exe, 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, 1.exe.0.dr
Source:	Binary string: System.pdb source: 1.exe, 00000002.00000002.2051820157.000001F2CD24F000.00000004.00000800.00020000.00000000.sdmp

Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: 3.exe, 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: autorun.inf
Source: 3.exe, 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: [autorun]
Source: 3.exe, 00000003.00000002.4480531198.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: 3.exe, 00000003.00000002.4480531198.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: 9902b29d6de7130c2f409ab27fb09fa7.exe.3.dr	Binary or memory string: autorun.inf
Source: 9902b29d6de7130c2f409ab27fb09fa7.exe.3.dr	Binary or memory string: [autorun]
Source: 3.exe.0.dr	Binary or memory string: autorun.inf
Source: 3.exe.0.dr	Binary or memory string: [autorun]

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0056C4A8 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0056C4A8
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0057E560 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0057E560
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0058D998 FindFirstFileExA,	0_2_0058D998

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49707 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49707 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49707 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49708 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49708 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49708 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49716 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49716 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49716 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49716 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49716 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49717 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49717 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49717 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49717 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49717 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49718 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49718 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49718 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49718 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49718 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49719 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49719 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49719 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49720 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49720 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49720 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49720 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49720 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49722 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49722 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49722 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49722 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49722 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49723 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49723 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49723 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49724 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49724 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49724 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49724 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49725 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49725 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49725 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49728 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49728 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49728 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49728 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49729 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49729 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49729 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49730 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49730 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49730 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49730 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49731 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49731 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49731 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49732 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49732 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49732 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49733 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49733 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49733 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49733 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49734 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49734 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49734 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49735 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49735 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49735 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49736 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49736 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49736 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49737 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49737 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49737 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49738 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49738 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49738 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49738 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49739 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49739 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49739 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49740 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49740 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49740 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49741 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49741 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49741 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49741 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49742 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49742 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49742 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49743 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49743 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49743 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49744 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49744 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49744 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49745 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49745 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49745 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49746 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49746 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49746 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49747 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49747 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49747 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49747 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49748 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49748 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49748 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49749 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49749 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49749 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49750 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49750 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49750 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49750 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49751 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49751 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49751 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49752 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49752 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49752 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49753 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49753 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49753 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49754 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49754 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49754 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49755 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49755 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49755 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49755 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49756 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49756 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49756 -> 147.185.221.17:10652
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49756 -> 147.185.221.17:10652

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: mary-cottage.gl.at.ply.gg

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.185.221.17 ports 0,1,2,5,6,10652

Yara detected Generic Downloader

Source: Yara match	File source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.5:49707 -> 147.185.221.17:10652

Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: ipbase.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.209.71 172.67.209.71
Source: Joe Sandbox View	IP Address: 147.185.221.17 147.185.221.17
Source: Joe Sandbox View	IP Address: 172.67.160.84 172.67.160.84

Source: Joe Sandbox View	ASN Name: SALSGIVERUS SALSGIVERUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: ipbase.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: freegeoip.app

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 17 Feb 2024 19:51:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeAge: 0Cache-Control: public,max-age=0,must-revalidateCache-Status: "Netlify Edge"; fwd=missVary: Accept-EncodingX-Nf-Request-Id: 01HPWA06KE7Q6YWZ13ESJ0RXWWCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nD%2FqN1usfuEjBpDyOMSgN0VjHHfat69gi1bbbPZrxArTy18PlvgkxYxYVNGKMPS9u%2FFiW4PZ3gXb3pLHaWjXqWWHDG4l2XDcRqYMbFkSMd2HRJoucncjOX0WYU2b"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 85709163cd9543e2-EWRalt-svc: h3=":443"; ma=86400

Source: cert9.db.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: cert9.db.2.dr	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: cert9.db.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.2.dr	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 1.exe, 00000002.00000002.2051820157.000001F2CD19B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://freegeoip.app
Source: 3.exe, 00000003.00000002.4479346622.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.
Source: 3.exe, 00000003.00000002.4479346622.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.LinkId=42127
Source: 1.exe, 00000002.00000002.2051820157.000001F2CD1F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipbase.com
Source: cert9.db.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.2.dr	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 1.exe, 00000002.00000002.2051820157.000001F2CD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cert9.db.2.dr	String found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.2.dr	String found in binary or memory: http://x1.i.lencr.org/0
Source: 1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 1.exe, 00000002.00000002.2051820157.000001F2CD1C9000.00000004.00000800.00020000.00000000.sdmp, 1.exe, 00000002.00000002.2051820157.000001F2CD24F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125
Source: 1.exe, 00000002.00000002.2051820157.000001F2CD0E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.vimeworld.ru/user/name/
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, 1.exe.0.dr	String found in binary or memory: https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/
Source: 1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, 1.exe.0.dr	String found in binary or memory: https://discord.com/api/webhooks/1199323175729758268/CBdP8e3cXbL0ED8xKBhMw0ikKHmITu-6CI4WjfttZm2aWGZ
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, 3.exe, 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, 9902b29d6de7130c2f409ab27fb09fa7.exe.3.dr, 3.exe.0.dr	String found in binary or memory: https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0
Source: 1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 1.exe, 00000002.00000002.2051820157.000001F2CD24F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: 1.exe, 00000002.00000002.2051820157.000001F2CD181000.00000004.00000800.00020000.00000000.sdmp, 1.exe, 00000002.00000002.2051820157.000001F2CD192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app
Source: 1.exe, 00000002.00000002.2051820157.000001F2CD0E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://freegeoip.app/xml/
Source: 1.exe, 00000002.00000002.2051820157.000001F2CD1D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipbase.com
Source: 1.exe, 00000002.00000002.2051820157.000001F2CD1CF000.00000004.00000800.00020000.00000000.sdmp, 1.exe, 00000002.00000002.2051820157.000001F2CD19B000.00000004.00000800.00020000.00000000.sdmp, 1.exe, 00000002.00000002.2051820157.000001F2CD1D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipbase.com/xml/
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, 1.exe.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/ASOFTWARE
Source: tmpFC74.tmp.tmpdb.2.dr	String found in binary or memory: https://support.mozilla.org
Source: tmpFC74.tmp.tmpdb.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmpFC74.tmp.tmpdb.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmpFC74.tmp.tmpdb.2.dr	String found in binary or memory: https://www.mozilla.org
Source: tmpFC74.tmp.tmpdb.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: tmpFC74.tmp.tmpdb.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: tmpFC74.tmp.tmpdb.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmpFC74.tmp.tmpdb.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: tmpFC74.tmp.tmpdb.2.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: tmpFC74.tmp.tmpdb.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 172.67.160.84:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.71:443 -> 192.168.2.5:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 3.exe.0.dr, kl.cs	.Net Code: VKCodeToUnicode
Source: 9902b29d6de7130c2f409ab27fb09fa7.exe.3.dr, kl.cs	.Net Code: VKCodeToUnicode

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: 3.0.3.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4480531198.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3.exe PID: 5656, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, type: DROPPED

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Local\Temp\3.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.0.3.exe.5c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 3.0.3.exe.5c0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 3.0.3.exe.5c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE	Matched rule: Detects A310Logger Author: ditekSHen
Source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000002.00000002.2051820157.000001F2CD1D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: 1.exe PID: 4292, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\3.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\3.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Local\Temp\3.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED	Matched rule: Detects A310Logger Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\3.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\3.exe	Code function: 3_2_00DDBECA NtQuerySystemInformation,	3_2_00DDBECA
Source: C:\Users\user\AppData\Local\Temp\3.exe	Code function: 3_2_00DDBBEA NtSetInformationProcess,	3_2_00DDBBEA
Source: C:\Users\user\AppData\Local\Temp\3.exe	Code function: 3_2_00DDBBC8 NtSetInformationProcess,	3_2_00DDBBC8
Source: C:\Users\user\AppData\Local\Temp\3.exe	Code function: 3_2_00DDBE8F NtQuerySystemInformation,	3_2_00DDBE8F

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: 0_2_00567FD3: _wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00567FD3

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0056F963	0_2_0056F963
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00569906	0_2_00569906
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0057EA07	0_2_0057EA07
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00578C7E	0_2_00578C7E
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00594044	0_2_00594044
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_005760F7	0_2_005760F7
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00579111	0_2_00579111
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00572125	0_2_00572125
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_005782D0	0_2_005782D0
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0056E394	0_2_0056E394
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00576445	0_2_00576445
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00571476	0_2_00571476
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0057976F	0_2_0057976F
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00587738	0_2_00587738
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00570949	0_2_00570949
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00587967	0_2_00587967
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0058FA90	0_2_0058FA90
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00563AB7	0_2_00563AB7
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00564C6E	0_2_00564C6E
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00575E86	0_2_00575E86
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0058FF3E	0_2_0058FF3E
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00562FCB	0_2_00562FCB
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00570FAC	0_2_00570FAC
Source: C:\Users\user\AppData\Local\Temp\1.exe	Code function: 2_2_00007FF848F112FD	2_2_00007FF848F112FD
Source: C:\Users\user\AppData\Local\Temp\1.exe	Code function: 2_2_00007FF848F25642	2_2_00007FF848F25642
Source: C:\Users\user\AppData\Local\Temp\1.exe	Code function: 2_2_00007FF848F248DA	2_2_00007FF848F248DA
Source: C:\Users\user\AppData\Local\Temp\1.exe	Code function: 2_2_00007FF848F11355	2_2_00007FF848F11355

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: String function: 00581D60 appears 31 times
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: String function: 00581590 appears 57 times

Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005873000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNursultan.exe4 vs qdHMT36Tn9.exe
Source: qdHMT36Tn9.exe, 00000000.00000002.2023616594.0000000005905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNursultan.exe4 vs qdHMT36Tn9.exe

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: qdHMT36Tn9.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.0.3.exe.5c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 3.0.3.exe.5c0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 3.0.3.exe.5c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207
Source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000002.00000002.2051820157.000001F2CD1D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: 1.exe PID: 4292, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Users\user\AppData\Local\Temp\3.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\3.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Local\Temp\3.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED	Matched rule: MALWARE_Win_A310Logger author = ditekSHen, description = Detects A310Logger, snort_sid = 920204-920207

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@11/19@3/3

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: 0_2_00567BFF GetLastError,FormatMessageW,

0_2_00567BFF

Source: C:\Users\user\AppData\Local\Temp\3.exe	Code function: 3_2_00DDB89A AdjustTokenPrivileges,		3_2_00DDB89A
Source: C:\Users\user\AppData\Local\Temp\3.exe	Code function: 3_2_00DDB863 AdjustTokenPrivileges,		3_2_00DDB863

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: 0_2_0057C652 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_0057C652

Source: C:\Users\user\AppData\Local\Temp\1.exe

File created: C:\Users\user\AppData\Local\44

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5348:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\3.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\3.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\AppData\Local\Temp\3.exe	Mutant created: \Sessions\1\BaseNamedObjects\9902b29d6de7130c2f409ab27fb09fa7

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6485750

Jump to behavior

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Command line argument: sfxname	0_2_0058037C
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Command line argument: sfxstime	0_2_0058037C
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Command line argument: pPZ	0_2_0058037C
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Command line argument: STARTDLG	0_2_0058037C
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Command line argument: >GY	0_2_00594690

Source: qdHMT36Tn9.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1.exe, 00000002.00000002.2051820157.000001F2CD17B000.00000004.00000800.00020000.00000000.sdmp, tmpFD12.tmp.dat.2.dr, tmpFD94.tmp.dat.2.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: qdHMT36Tn9.exe	ReversingLabs: Detection: 76%
Source: qdHMT36Tn9.exe	Virustotal: Detection: 77%

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

File read: C:\Users\user\Desktop\qdHMT36Tn9.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\qdHMT36Tn9.exe C:\Users\user\Desktop\qdHMT36Tn9.exe
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Process created: C:\Users\user\AppData\Local\Temp\1.exe "C:\Users\user\AppData\Local\Temp\1.exe"
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Process created: C:\Users\user\AppData\Local\Temp\3.exe "C:\Users\user\AppData\Local\Temp\3.exe"
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\3.exe" "3.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\3.exe "C:\Users\user\AppData\Local\Temp\3.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\3.exe "C:\Users\user\AppData\Local\Temp\3.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\3.exe "C:\Users\user\AppData\Local\Temp\3.exe" ..
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Process created: C:\Users\user\AppData\Local\Temp\1.exe "C:\Users\user\AppData\Local\Temp\1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Process created: C:\Users\user\AppData\Local\Temp\3.exe "C:\Users\user\AppData\Local\Temp\3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\3.exe" "3.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\3.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: qdHMT36Tn9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: qdHMT36Tn9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: qdHMT36Tn9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: qdHMT36Tn9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: qdHMT36Tn9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: qdHMT36Tn9.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: qdHMT36Tn9.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: qdHMT36Tn9.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: qdHMT36Tn9.exe
Source:	Binary string: mscorlib.pdb source: 1.exe, 00000002.00000002.2051820157.000001F2CD172000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: 1.exe, 00000002.00000002.2051820157.000001F2CD24F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: 1.exe, 00000002.00000002.2057293840.000001F2E5836000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Downloads\44CALIBER-main\44CALIBER\obj\Release\Nursultan.pdb source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000002.2051820157.000001F2CD192000.00000004.00000800.00020000.00000000.sdmp, 1.exe, 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, 1.exe.0.dr
Source:	Binary string: System.pdb source: 1.exe, 00000002.00000002.2051820157.000001F2CD24F000.00000004.00000800.00020000.00000000.sdmp

Source: qdHMT36Tn9.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: qdHMT36Tn9.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: qdHMT36Tn9.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: qdHMT36Tn9.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: qdHMT36Tn9.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: 3.exe.0.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 9902b29d6de7130c2f409ab27fb09fa7.exe.3.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: 1.exe.0.dr

Static PE information: 0xEBC36CC3 [Thu May 5 16:58:43 2095 UTC]

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6485750

Jump to behavior

Source: qdHMT36Tn9.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0058125A push ecx; ret	0_2_0058126D
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00581DB0 push ecx; ret	0_2_00581DC3
Source: C:\Users\user\AppData\Local\Temp\1.exe	Code function: 2_2_00007FF848F112FD push esp; retn 4810h	2_2_00007FF848F116C6
Source: C:\Users\user\AppData\Local\Temp\1.exe	Code function: 2_2_00007FF848F1021D push E95D9198h; ret	2_2_00007FF848F10259
Source: C:\Users\user\AppData\Local\Temp\1.exe	Code function: 2_2_00007FF848F1025B push E95D9198h; ret	2_2_00007FF848F10259
Source: C:\Users\user\AppData\Local\Temp\1.exe	Code function: 2_2_00007FF848F1EBCE push cs; iretd	2_2_00007FF848F1EBCF
Source: C:\Users\user\AppData\Local\Temp\1.exe	Code function: 2_2_00007FF848F100BD pushad ; iretd	2_2_00007FF848F100C1

Source: C:\Users\user\AppData\Local\Temp\3.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	File created: C:\Users\user\AppData\Local\Temp\3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	File created: C:\Users\user\AppData\Local\Temp\1.exe	Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\AppData\Local\Temp\3.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9902b29d6de7130c2f409ab27fb09fa7

Jump to behavior

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\3.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\3.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9902b29d6de7130c2f409ab27fb09fa7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9902b29d6de7130c2f409ab27fb09fa7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 9902b29d6de7130c2f409ab27fb09fa7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 9902b29d6de7130c2f409ab27fb09fa7	Jump to behavior

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\AppData\Local\Temp\1.exe	Memory allocated: 1F2CB7E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Memory allocated: 1F2E50E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 10B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 2D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 4D60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 2D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 1480000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 3150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 3150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 5150000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 18B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 3330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Memory allocated: 5330000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599305	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599077	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598921	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1.exe	Window / User API: threadDelayed 1998	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Window / User API: threadDelayed 728	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Window / User API: threadDelayed 3190	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Window / User API: threadDelayed 725	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Window / User API: threadDelayed 4487	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Window / User API: foregroundWindowGot 413	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Window / User API: foregroundWindowGot 1272	Jump to behavior

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-24213

Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -599782s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -599305s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -599077s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -598921s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -598812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 6340	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 5696	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe TID: 5880	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe TID: 4788	Thread sleep time: -725000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe TID: 4788	Thread sleep time: -4487000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe TID: 3292	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe TID: 3652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe TID: 6180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\1.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ProcessorId FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0056C4A8 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0056C4A8
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0057E560 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0057E560
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0058D998 FindFirstFileExA,	0_2_0058D998

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: 0_2_00580B80 VirtualQuery,GetSystemInfo,

0_2_00580B80

Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599305	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 599077	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598921	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598812	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 3.exe, 00000003.00000002.4479346622.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWment, System.WorkflowServices, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: netsh.exe, 00000004.00000002.2090766171.0000000000824000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000003.2090413332.0000000000821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 1.exe, 00000002.00000002.2056331183.000001F2DD1C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,116
Source: 3.exe, 00000003.00000002.4479346622.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 1.exe, 00000002.00000002.2057293840.000001F2E57B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll?
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: tmpFD83.tmp.dat.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

API call chain: ExitProcess graph end node

graph_0-24445

Source: C:\Users\user\AppData\Local\Temp\1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: 0_2_0058647F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0058647F

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: 0_2_0058A640 mov eax, dword ptr fs:[00000030h]

0_2_0058A640

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: 0_2_0058E680 GetProcessHeap,

0_2_0058E680

Source: C:\Users\user\AppData\Local\Temp\1.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0058215D SetUnhandledExceptionFilter,	0_2_0058215D
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_005812D7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_005812D7
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_0058647F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0058647F
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Code function: 0_2_00581FCA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00581FCA

Source: C:\Users\user\AppData\Local\Temp\1.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 3.exe.0.dr, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: 3.exe.0.dr, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: 3.exe.0.dr, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Process created: C:\Users\user\AppData\Local\Temp\1.exe "C:\Users\user\AppData\Local\Temp\1.exe"			Jump to behavior
Source: C:\Users\user\Desktop\qdHMT36Tn9.exe	Process created: C:\Users\user\AppData\Local\Temp\3.exe "C:\Users\user\AppData\Local\Temp\3.exe"			Jump to behavior

Source: 3.exe, 00000003.00000002.4480531198.000000000320E000.00000004.00000800.00020000.00000000.sdmp, 3.exe, 00000003.00000002.4479346622.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp, 3.exe, 00000003.00000002.4480531198.00000000030C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 3.exe, 00000003.00000002.4480531198.000000000320E000.00000004.00000800.00020000.00000000.sdmp, 3.exe, 00000003.00000002.4480531198.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, 3.exe, 00000003.00000002.4480531198.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.
Source: 3.exe, 00000003.00000002.4480531198.000000000320E000.00000004.00000800.00020000.00000000.sdmp, 3.exe, 00000003.00000002.4480531198.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program manager
Source: 3.exe, 00000003.00000002.4480531198.000000000320E000.00000004.00000800.00020000.00000000.sdmp, 3.exe, 00000003.00000002.4480531198.00000000030C4000.00000004.00000800.00020000.00000000.sdmp, 3.exe, 00000003.00000002.4480531198.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: 0_2_005727A9 cpuid

0_2_005727A9

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_0057D0AB

Source: C:\Users\user\AppData\Local\Temp\1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: 0_2_0058037C GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_0058037C

Source: C:\Users\user\AppData\Local\Temp\3.exe

Code function: 3_2_00DDB1EA GetUserNameW,

3_2_00DDB1EA

Source: C:\Users\user\Desktop\qdHMT36Tn9.exe

Code function: 0_2_0056D076 GetVersionExW,

0_2_0056D076

Source: C:\Users\user\AppData\Local\Temp\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\3.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\3.exe" "3.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\3.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\3.exe" "3.exe" ENABLE

Stealing of Sensitive Information

Yara detected 44Caliber Stealer

Source: Yara match	File source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1.exe PID: 4292, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED

Yara detected Njrat

Source: Yara match	File source: 3.0.3.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4480531198.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3.exe PID: 5656, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, type: DROPPED

Yara detected Rags Stealer

Source: Yara match	File source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2051820157.000001F2CD109000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1.exe PID: 4292, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: JaxxDir
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusDir
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %\Wallets\DashCore\)\DashCore\wallet.dat#\Electrum\wallets%\Wallets\Electrum\%\Ethereum\keystore%\Wallets\Ethereum\-\Exodus\exodus.wallet\!\Wallets\Exodus\m\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior

Source: Yara match	File source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2051820157.000001F2CD109000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1.exe PID: 4292, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED

Remote Access Functionality

Yara detected 44Caliber Stealer

Source: Yara match	File source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1.exe PID: 4292, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED

Yara detected Njrat

Source: Yara match	File source: 3.0.3.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4480531198.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3.exe PID: 5656, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, type: DROPPED

Yara detected Rags Stealer

Source: Yara match	File source: 2.0.1.exe.1f2cb290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2051820157.000001F2CD109000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qdHMT36Tn9.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1.exe PID: 4292, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	221 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 Peripheral Device Discovery	Remote Desktop Protocol	3 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	12 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	1 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	221 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	56 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	241 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	151 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
qdHMT36Tn9.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.NjRAT
qdHMT36Tn9.exe	78%	Virustotal		Browse
qdHMT36Tn9.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1.exe	100%	Avira	HEUR/AGEN.1307065
C:\Users\user\AppData\Local\Temp\3.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.DataStealer
C:\Users\user\AppData\Local\Temp\1.exe	72%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\3.exe	100%	ReversingLabs	ByteCode-MSIL.Backdoor.Ratenjay
C:\Users\user\AppData\Local\Temp\3.exe	89%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	100%	ReversingLabs	ByteCode-MSIL.Backdoor.Ratenjay
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe	89%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ipbase.com	1%	Virustotal	Browse
freegeoip.app	0%	Virustotal	Browse
mary-cottage.gl.at.ply.gg	9%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://go.microsoft.	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
mary-cottage.gl.at.ply.gg	100%	Avira URL Cloud	malware
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
http://go.microsoft.LinkId=42127	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/1199323175729758268/CBdP8e3cXbL0ED8xKBhMw0ikKHmITu-6CI4WjfttZm2aWGZ	0%	Avira URL Cloud	safe
https://freegeoip.app	0%	Virustotal		Browse
https://freegeoip.app/xml/	1%	Virustotal		Browse
mary-cottage.gl.at.ply.gg	9%	Virustotal		Browse
https://discord.com/api/webhooks/1199323175729758268/CBdP8e3cXbL0ED8xKBhMw0ikKHmITu-6CI4WjfttZm2aWGZ	0%	Virustotal		Browse
https://freegeoip.app/xml/	0%	Avira URL Cloud	safe
https://freegeoip.app	0%	Avira URL Cloud	safe
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Avira URL Cloud	safe
http://ipbase.com	0%	Avira URL Cloud	safe
https://ipbase.com/xml/	0%	Avira URL Cloud	safe
https://ipbase.com	0%	Avira URL Cloud	safe
http://freegeoip.app	0%	Avira URL Cloud	safe
http://ipbase.com	1%	Virustotal		Browse
http://freegeoip.app	0%	Virustotal		Browse
https://ipbase.com/xml/	0%	Virustotal		Browse
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	0%	Virustotal		Browse
https://ipbase.com	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipbase.com	172.67.209.71	true	false	1%, Virustotal, Browse	unknown
freegeoip.app	172.67.160.84	true	true	0%, Virustotal, Browse	unknown
mary-cottage.gl.at.ply.gg	147.185.221.17	true	true	9%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://freegeoip.app/xml/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
mary-cottage.gl.at.ply.gg	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ipbase.com/xml/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	false		high
https://duckduckgo.com/ac/?q=	1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	false		high
https://steamcommunity.com/profiles/ASOFTWARE	qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, 1.exe.0.dr	false		high
https://freegeoip.app	1.exe, 00000002.00000002.2051820157.000001F2CD181000.00000004.00000800.00020000.00000000.sdmp, 1.exe, 00000002.00000002.2051820157.000001F2CD192000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	cert9.db.2.dr	false	URL Reputation: safe	unknown
http://go.microsoft.	3.exe, 00000003.00000002.4479346622.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	cert9.db.2.dr	false	Avira URL Cloud: safe	unknown
http://go.microsoft.LinkId=42127	3.exe, 00000003.00000002.4479346622.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.ecosia.org/newtab/	1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	false		high
https://discord.com/api/webhooks/1199323175729758268/CBdP8e3cXbL0ED8xKBhMw0ikKHmITu-6CI4WjfttZm2aWGZ	qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, 1.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmpFC74.tmp.tmpdb.2.dr	false		high
https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125	1.exe, 00000002.00000002.2051820157.000001F2CD1C9000.00000004.00000800.00020000.00000000.sdmp, 1.exe, 00000002.00000002.2051820157.000001F2CD24F000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	false		high
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0	qdHMT36Tn9.exe, 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, 3.exe, 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, 9902b29d6de7130c2f409ab27fb09fa7.exe.3.dr, 3.exe.0.dr	false		high
http://ipbase.com	1.exe, 00000002.00000002.2051820157.000001F2CD1F5000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	cert9.db.2.dr	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	cert9.db.2.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	cert9.db.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	tmpFC74.tmp.tmpdb.2.dr	false		high
https://api.vimeworld.ru/user/name/	1.exe, 00000002.00000002.2051820157.000001F2CD0E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.vimeworld.ru/user/name/5https://freegeoip.app/xml/	qdHMT36Tn9.exe, 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, 1.exe.0.dr	false		high
https://support.mozilla.org	tmpFC74.tmp.tmpdb.2.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	1.exe, 00000002.00000002.2051820157.000001F2CD172000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	1.exe, 00000002.00000002.2056331183.000001F2DD16A000.00000004.00000800.00020000.00000000.sdmp, tmpFD24.tmp.dat.2.dr, tmpFCC3.tmp.dat.2.dr	false		high
https://ipbase.com	1.exe, 00000002.00000002.2051820157.000001F2CD1D3000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://freegeoip.app	1.exe, 00000002.00000002.2051820157.000001F2CD19B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.209.71	ipbase.com	United States	13335	CLOUDFLARENETUS	false
147.185.221.17	mary-cottage.gl.at.ply.gg	United States	12087	SALSGIVERUS	true
172.67.160.84	freegeoip.app	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1393956
Start date and time:	2024-02-17 20:51:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qdHMT36Tn9.exe renamed because original name is a hash value
Original Sample Name:	3E5BA25AA4F23CEB11BE209D1967E341.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@11/19@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 259 Number of non-executed functions: 99
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:51:55	API Interceptor	16x Sleep call for process: 1.exe modified
20:52:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9902b29d6de7130c2f409ab27fb09fa7 "C:\Users\user\AppData\Local\Temp\3.exe" ..
20:52:11	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run 9902b29d6de7130c2f409ab27fb09fa7 "C:\Users\user\AppData\Local\Temp\3.exe" ..
20:52:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9902b29d6de7130c2f409ab27fb09fa7 "C:\Users\user\AppData\Local\Temp\3.exe" ..
20:52:29	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe
20:52:34	API Interceptor	412341x Sleep call for process: 3.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.209.71	dudick SystemDesk Important Crediential Notification 1.eml	Get hash	malicious	HTMLPhisher	Browse
	123.scr.exe	Get hash	malicious	Rags Stealer	Browse
	123.scr.exe	Get hash	malicious	Rags Stealer	Browse
	SecuriteInfo.com.FileRepMalware.dll	Get hash	malicious	Unknown	Browse
	case (426).xls	Get hash	malicious	Unknown	Browse
	case (61).xls	Get hash	malicious	Unknown	Browse
147.185.221.17	mFgIWyjDLH.exe	Get hash	malicious	Njrat	Browse
	diversion.exe	Get hash	malicious	Njrat	Browse
	diversion.exe	Get hash	malicious	Njrat	Browse
	Xworm_v3.1.exe	Get hash	malicious	Unknown	Browse
	Xworm_v3.1.exe	Get hash	malicious	Unknown	Browse
	zlR2uApll8.exe	Get hash	malicious	Nanocore	Browse
	XYwaFhn69G.exe	Get hash	malicious	XWorm	Browse
	api-ms-win-crt-environment-l1-1-0.exe	Get hash	malicious	Quasar	Browse
	Client.exe	Get hash	malicious	Quasar	Browse
	at3UORuZ0B.exe	Get hash	malicious	RevengeRAT	Browse
172.67.160.84	123.scr.exe	Get hash	malicious	Rags Stealer	Browse
	RP.sfx.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse
	3vj5tYFb6a.exe	Get hash	malicious	Snake Keylogger, zgRAT	Browse
	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse
	Yandex.bin.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse
	A6KiC17VqI.exe	Get hash	malicious	Snake Keylogger	Browse
	ljlZS3NiAP.exe	Get hash	malicious	Snake Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipbase.com	64drop.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	104.21.85.189
	123.scr.exe	Get hash	malicious	Unknown	Browse	104.21.85.189
	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	172.67.209.71
	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	172.67.209.71
	RP.sfx.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	104.21.85.189
	i6R4NsEd8t.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.85.189
	3vj5tYFb6a.exe	Get hash	malicious	Snake Keylogger, zgRAT	Browse	104.21.28.190
	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.147.81
	bcAE21roAv.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.147.81
	VegaStealer_v1.bin.exe	Get hash	malicious	Ades Stealer, NitroStealer	Browse	75.2.60.5
freegeoip.app	64drop.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	104.21.73.97
	123.scr.exe	Get hash	malicious	Unknown	Browse	104.21.73.97
	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	104.21.73.97
	123.scr.exe	Get hash	malicious	Rags Stealer	Browse	172.67.160.84
	RP.sfx.exe	Get hash	malicious	44Caliber Stealer, Rags Stealer	Browse	172.67.160.84
	i6R4NsEd8t.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.73.97
	3vj5tYFb6a.exe	Get hash	malicious	Snake Keylogger, zgRAT	Browse	172.67.160.84
	7nYkVlcnfx.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.160.84
	bcAE21roAv.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.73.97
	VegaStealer_v1.bin.exe	Get hash	malicious	Ades Stealer, NitroStealer	Browse	104.21.73.97

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	setup.exe	Get hash	malicious	LummaC	Browse	104.21.12.235
	JccyJc1Lds.exe	Get hash	malicious	Njrat	Browse	104.20.68.143
	XEG062awcu.elf	Get hash	malicious	Mirai	Browse	104.16.131.96
	file.exe	Get hash	malicious	LummaC	Browse	104.21.94.211
	file.exe	Get hash	malicious	LummaC	Browse	104.21.16.186
	https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b%2C8d23fb3%2C492093b&p1=//estudiodobrusin.com.ar/wp-estudiodobrusin/estudiodobrusin/ndkyndkyndkyndkyndky/cGF1bC5ib3JnQGVsZGVycy5jb20uYXU=	Get hash	malicious	Unknown	Browse	104.21.21.233
	damaged_items.wsf	Get hash	malicious	XWorm	Browse	104.20.68.143
	CustomerSupport [3.4].apk	Get hash	malicious	Unknown	Browse	172.67.174.84
	CustomerSupport [3.4].apk	Get hash	malicious	Unknown	Browse	104.21.88.87
	https://cdnstatic.thunderdepthsforger.top	Get hash	malicious	Unknown	Browse	172.67.139.22
SALSGIVERUS	XDemonsSkeetStyleLeak.jar	Get hash	malicious	Dynamic Stealer	Browse	147.185.221.16
	XDemonsSkeetStyleLeak.jar	Get hash	malicious	Dynamic Stealer	Browse	147.185.221.16
	mFgIWyjDLH.exe	Get hash	malicious	Njrat	Browse	147.185.221.17
	vUqZRQWMkX.elf	Get hash	malicious	Mirai	Browse	147.168.44.58
	huhu.mpsl.elf	Get hash	malicious	Mirai	Browse	147.168.203.96
	diversion.exe	Get hash	malicious	Njrat	Browse	147.185.221.17
	diversion.exe	Get hash	malicious	Njrat	Browse	147.185.221.17
	Xworm_v3.1.exe	Get hash	malicious	Unknown	Browse	147.185.221.17
	B.exe	Get hash	malicious	Cobian RAT	Browse	147.185.221.18
	Xworm_v3.1.exe	Get hash	malicious	Unknown	Browse	147.185.221.17
CLOUDFLARENETUS	setup.exe	Get hash	malicious	LummaC	Browse	104.21.12.235
	JccyJc1Lds.exe	Get hash	malicious	Njrat	Browse	104.20.68.143
	XEG062awcu.elf	Get hash	malicious	Mirai	Browse	104.16.131.96
	file.exe	Get hash	malicious	LummaC	Browse	104.21.94.211
	file.exe	Get hash	malicious	LummaC	Browse	104.21.16.186
	https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b%2C8d23fb3%2C492093b&p1=//estudiodobrusin.com.ar/wp-estudiodobrusin/estudiodobrusin/ndkyndkyndkyndkyndky/cGF1bC5ib3JnQGVsZGVycy5jb20uYXU=	Get hash	malicious	Unknown	Browse	104.21.21.233
	damaged_items.wsf	Get hash	malicious	XWorm	Browse	104.20.68.143
	CustomerSupport [3.4].apk	Get hash	malicious	Unknown	Browse	172.67.174.84
	CustomerSupport [3.4].apk	Get hash	malicious	Unknown	Browse	104.21.88.87
	https://cdnstatic.thunderdepthsforger.top	Get hash	malicious	Unknown	Browse	172.67.139.22

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	setup.exe	Get hash	malicious	LummaC	Browse	172.67.209.71 172.67.160.84
	damaged_items.wsf	Get hash	malicious	XWorm	Browse	172.67.209.71 172.67.160.84
	2fD17D9plg.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	172.67.209.71 172.67.160.84
	W57Mqdrelm.exe	Get hash	malicious	RedLine	Browse	172.67.209.71 172.67.160.84
	SecuriteInfo.com.Win32.RATX-gen.30107.2695.exe	Get hash	malicious	Remcos	Browse	172.67.209.71 172.67.160.84
	Grace Engineering and Technical Services.exe	Get hash	malicious	AgentTesla	Browse	172.67.209.71 172.67.160.84
	SecuriteInfo.com.Win64.TrojanX-gen.30335.3899.exe	Get hash	malicious	Unknown	Browse	172.67.209.71 172.67.160.84
	SecuriteInfo.com.Trojan.MulDropNET.68.25834.10722.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.209.71 172.67.160.84
	SecuriteInfo.com.Win64.TrojanX-gen.30335.3899.exe	Get hash	malicious	Unknown	Browse	172.67.209.71 172.67.160.84
	https://officedocverifiercom.godaddysites.com	Get hash	malicious	Unknown	Browse	172.67.209.71 172.67.160.84

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 7, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	0.643383182059925
Encrypted:	false
SSDEEP:	384:A1zkVmvQhyn+Zoz67kMMTNlH333JqN8j/LKXu5Uu/:AlM0sCyW
MD5:	F23F48363C7BAA0709698208A7E833A0
SHA1:	07D2AEE271A0F2BA14608FE5A9A677E2594D22CC
SHA-256:	51DFB72705CBEB6AF5A14F2BE20FC39172E86263E25704F50BEB292F776B7713
SHA-512:	F8F16198A96F047E320EF82026160EBD5A0836B48FC3496C427F90965CF3BF5FAB5EBE0FB9016E3BDE56657EB42627D7286AED3167A422D69F865524892C3DFA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\v6zchhhv.default-release\key4.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08438200565341271
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v4U:51zkVmvQhyn+Zoz67NU
MD5:	F7EEE7B0D281E250D1D8E36486F5A2C3
SHA1:	309736A27E794672BD1BDFBAC69B2C6734FC25CE
SHA-256:	378DD46FE8A8AAC2C430AE8A7C5C1DC3C2A343534A64A263EC9A4F1CE801985E
SHA-512:	CE102A41CA4E2A27CCB27F415D2D69A75A0058BA0F600C23F63B89F30FFC982BA48336140714C522B46CC6D13EDACCE3DF0D6685D02844B8DB0AD3378DB9CABB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\44\Information.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	623
Entropy (8bit):	4.091770284971255
Encrypted:	false
SSDEEP:	6:pYcCFWl4BjJTVIK923fypwSTeljUIAknnXmZu0GhOST7Y7V1nA67X:pYzdhgtSTeNDnXEV2ZT07V1A6r
MD5:	D55FD9941577BDB006F2CA7939E87843
SHA1:	B553830E24EA5D008F8512B9A359A8D821D4EAA1
SHA-256:	A5E77E9559E86744CEDCC151F776523BB5B0EB5CEAB0FAA83FBDDDDEBB044C0D
SHA-512:	BD13B95466A71C5910981C38D3F3949613956225C2FAE3AB28033C23203DC4101B9A6AFF1B76836E13BA48F7690102831B6051304817DD017BAE302DD4D9DDC5
Malicious:	false
Reputation:	low
Preview:	==================================================. Operating system: Windows 10 Pro (64 Bit). PC user: 721680/user. ClipBoard: . Launch: C:\Users\user\AppData\Local\Temp\1.exe. ==================================================. Screen resolution: 1280x1024. Current time: 17/02/2024 22:51:47. HWID: 23A6FBB218. ==================================================. CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz. RAM: 4094MB. GPU: C9FD68. ==================================================. IP Geolocation: Fail Fail. Log Date: 02/17/2024 8:51. BSSID: 00:50:56:a7:21:15. ==================================================

C:\Users\user\AppData\Local\44\Process.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4307
Entropy (8bit):	4.805904158095785
Encrypted:	false
SSDEEP:	24:XqBmnBQUHIBqBBqqBBqBBBB0BBBqBuqBqBqXsxBBxBqBpqYB+PtrqqBqqBpBBBq2:EzUt7H176ztgG5p6
MD5:	16463B329A2799E28B3F92933476C63F
SHA1:	CFDB46776B2F7652FA5697876F17923D5C997BF7
SHA-256:	F9366F41F64AF1E0F0F2CC02FA748E07D3B1CFC4F8E7145A7FED108DF0A79C23
SHA-512:	78B4859B10D437B206E25E7DC5418D54080020532B3D91871C6D9DF1B3CF5D598BE70BC2824438180F17CEFCC4ACC7B30BE29B3069D469AA6FD5D854E77BDC8D
Malicious:	false
Reputation:	low
Preview:	NAME: svchost..NAME: svchost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: upfc..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: RuntimeBroker..NAME: csrss..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: svchost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: svchost..NAME: svchost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: svchost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: conhost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: svchost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: sihost..NAME: svchost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: svchost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: svchost..NAME: dllhost..NAME: fontdrvhost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: fontdrvhost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: svchost..NAME: AyDpbcQrktAOlHrMBPpTZi..NAME: StartMenuExperienceHost..NAME: svchost..NAME: cscript..NAME: AyDpbcQrkt

C:\Users\user\AppData\Local\44\Screen.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	710642
Entropy (8bit):	7.927511630010842
Encrypted:	false
SSDEEP:	12288:fFYjDPCAlHHKH9GEJ2Qg8QaB2GIyYRPrsEeLmeogwvVq4TqY8CxIfLKsWYns7:NYjDPtlnKdVJ5g8QaMLyYxFgwAuqjCxr
MD5:	961DDDDA1B2524DADFD96CAF20D349CC
SHA1:	789904C3AA3E7150E2BE026E2A831957F526FCBB
SHA-256:	07D0F72DB9AF1750508452ACB52AC6A69AA1EE964DB03F693D6AB71C2BEFDB58
SHA-512:	FA09AD832B055177DF46C51D8ED56BCA37DC223AEC6579377C91E96F1E0BF19456F0B0AF80AA61C5D91C4494EEACFF0798BD11200100F4C617451E8CC06A7AB2
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....eG....}...ms.....y}.U.....2o.......H.D.......H.y....'$$.....G^... .z..Z.:..3.;g........1cF...IP.o.X..9...dy..O.!..Z..Nyv(...I....5..N.s...'>....n..I2.{:S'L.=....'2.....w\......~>'.>.....k.O>.V.~t$......{L.w.SG..Q..e......}.M.......a.....Z..H........._>.......c1U...}s...{[.}..j.C....{.2....@..i.Y..}w.L....y...{......gG.]?....w....i}bQ...S.....-..:..oK.....h ...3...f...f....@l.~.)s4V..C..........n.....,.......]us.y.M...Z-^u........ko.-1.+.}@.....<..=...Xu^...j).O.E).5Si~.5..K......k....>...>7....Z.o.c..E..6C_,M..sK..>..s}..5)g.?...u.........5Ug..s....{K1....K...Z.r..v...G......re.c.(......zl]...8,..j..i...vMs.\...\|e.[....=...KwK.wM..te......9...Wd.v.......t.t..vv.,.-....].u........g].>......-.).C.s..d..s=..;....S.].Y..eiLN.....<S......m..6.US[_..K.O.. ...v..........Z.e.5..m...j.x..%...uS....q....<.<.~g...........ru=...

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\3.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.364175471524945
Encrypted:	false
SSDEEP:	24:ML9E4KQEAE4KKUNt1qE4GIsCKDE4KGKZI6KhPKIE4TKBGKoPE4K6sXE4Npv:MxHKQEAHKKkt1qHGIsCYHKGSI6oPtHTy
MD5:	D70164A2669BAC5564AE9329650DB5AE
SHA1:	D918ED8E2C94480B29A5FD1403F32C9555CADB60
SHA-256:	1795A022ED26274E44D1C5FE93C7CEDD53D18378FA2DF5B6EF91408F234B8A95
SHA-512:	82E357E433C1AFB7026A4E6D146743A0720C6E67062349CAC2795EC70A6B76B210F84A64CFEAB94D406AAA55D98A5BEAF5054FED9D0A322B66ED10BE15DAB9B5
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906

C:\Users\user\AppData\Local\Temp\1.exe

Download File

Process:	C:\Users\user\Desktop\qdHMT36Tn9.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	546816
Entropy (8bit):	4.529560276622592
Encrypted:	false
SSDEEP:	6144:ef+BLtABPDLgj1xw1eO5rbMMzhgUsYqTXGG/5zJRb2IXe05f4VGWWxjdq:d161eO5rbHHsYqTXGOXXe+4k8
MD5:	0CE3051B867D50AA172D1B332F156E3E
SHA1:	F87DEFE312CB3A5EFEA3F845D187762E153BDDAB
SHA-256:	5AC29F18472F943F2EB3C256FDBFE251B04CA66AFC22FCBA65183B0509FEB529
SHA-512:	5169A3ACD3C79CC4D22BF3A1F4D9770797D2C31503BAB1022A153AD56C382E495DE2CE06A8A04B3BB4B2FB2C666575DCDEFA26533FF5AFFC4B6CE126E2166193
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: Joe Security Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: ditekSHen Rule: MALWARE_Win_A310Logger, Description: Detects A310Logger, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76% Antivirus: Virustotal, Detection: 72%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....l............"...0..@...........8... ...`....@.. ....................................`..................................7..O....`..............................<7..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............V..............@..B.................8......H............(..........................................................2r...p(....&....0..Z.......s".....rg..p~....o#....ry..p.o#....r...p~....o#...~....~.....(f.....o$...s%...o&....o'......0..V.......s".....rg..p.o#....ry..p.o#....r...p~....o#...~....~.....(f.....o$...s%...o&....o'......0..R.......s".....rg..p.o#....ry..p.o#....r...p~....o#....~.....(f.....o$...s%...o&....o'......0.............s(...%o)....}....%....io*...&o+...s".....r...p.o#....r...p.o#....r...p....s.

C:\Users\user\AppData\Local\Temp\3.exe

Download File

Process:	C:\Users\user\Desktop\qdHMT36Tn9.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.574290361725228
Encrypted:	false
SSDEEP:	384:K+xcaCisP/WRdL5kyc/5kvHHng6sZ8prAF+rMRTyN/0L+EcoinblneHQM3epzX6r:nxckD5nc/5k/VscrM+rMRa8NuU5t
MD5:	6D11195AF6CCA04EB53ECCF9AAF329DC
SHA1:	85F70D6FCFF5212649DEAF1D18E66D563727C186
SHA-256:	4C690A994E22EB6AA31AF6E552B610EA1FF01AC58622D56232AD6E820C2AA414
SHA-512:	76A59B8164A478691D14BE7E5D002280EC5453CB6D9F73387AD45E49755D03927F3814C42DF987A4DC61C942E9E7B25AB9559651981020BF53AD56A8E4E65C8B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\3.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\3.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Local\Temp\3.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\3.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100% Antivirus: Virustotal, Detection: 89%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Bv.e................................ ........@.. ....................................@.................................\|...O.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Temp\tmpFC74.tmp.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFCC3.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFD12.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFD13.tmp.tmpdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFD24.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFD63.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFD83.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFD94.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.574290361725228
Encrypted:	false
SSDEEP:	384:K+xcaCisP/WRdL5kyc/5kvHHng6sZ8prAF+rMRTyN/0L+EcoinblneHQM3epzX6r:nxckD5nc/5k/VscrM+rMRa8NuU5t
MD5:	6D11195AF6CCA04EB53ECCF9AAF329DC
SHA1:	85F70D6FCFF5212649DEAF1D18E66D563727C186
SHA-256:	4C690A994E22EB6AA31AF6E552B610EA1FF01AC58622D56232AD6E820C2AA414
SHA-512:	76A59B8164A478691D14BE7E5D002280EC5453CB6D9F73387AD45E49755D03927F3814C42DF987A4DC61C942E9E7B25AB9559651981020BF53AD56A8E4E65C8B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9902b29d6de7130c2f409ab27fb09fa7.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100% Antivirus: Virustotal, Detection: 89%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Bv.e................................ ........@.. ....................................@.................................\|...O.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.259721475252686
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qdHMT36Tn9.exe
File size:	471'910 bytes
MD5:	3e5ba25aa4f23ceb11be209d1967e341
SHA1:	c25a05acb5231776456d08fad7df0e48d92931c0
SHA256:	518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818
SHA512:	184243d51766bf8d292308e0177046f88e0eb55201eddc9d14670dd3d526c5ed6026c03c88227698670f451f43a3e4f1378f51f2334a9b54d83bb2bc677b0c04
SSDEEP:	6144:jE+yclwQKjdn+WPtYVJIoBfRT+tkbOSeC2xDjAzQeOOg7Y55HkVSGsc:jBdlwHRn+WlYV+8T+tkKC0EEE17HkV8c
TLSH:	56A4E113FAC1D0B2D03219321669CB61A6BC7C101F254BEB63D97D3DEA251D2AB317A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W...6...6...6....V..6....T.'6....U..6..)MZ..6..)M...6..)M...6..)M...6...N$..6...N4..6...6...7..'M...6..'M...6..'MX..6..'M...6.

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x421d50
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x651BC7F7 [Tue Oct 3 07:51:19 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	75e9596d74d063246ba6f3ac7c5369a0

Entrypoint Preview

Instruction
call 00007FB5F189140Bh
jmp 00007FB5F1890DBDh
int3
int3
int3
int3
int3
int3
push 00424F20h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [0044277Ch]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FB5F18834E1h
push 0043F388h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FB5F1893935h
int3
jmp 00007FB5F1895808h
push ebp
mov ebp, esp
and dword ptr [00466078h], 00000000h
sub esp, 24h
or dword ptr [004427B0h], 01h
push 0000000Ah
call dword ptr [004361D0h]
test eax, eax
je 00007FB5F18910F2h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x405c0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x405f4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x68000	0xe044	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x77000	0x255c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3e3b0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x388b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3fa9c	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x345cc	0x34600	b7a8b04ab2248443b05e8133fb3a9064	False	0.5887343377088305	data	6.708390817791953	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x36000	0xb410	0xb600	a418919d63b67e937555eec95d3b6bcb	False	0.45409083104395603	Applesoft BASIC program data, first line number 4	5.215945456388312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x42000	0x24758	0x1200	d8d5c95192b51ddad1857caa38e7daa9	False	0.4049479166666667	data	4.078919796039023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x67000	0x1a4	0x200	ee74a17c4eeb586c9811481b77498b43	False	0.4609375	data	3.5194570553957747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x68000	0xe044	0xe200	e1d0c28d23b6b5c7cae80fcd7a967218	False	0.6343853705752213	data	6.80236513212897	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x77000	0x255c	0x2600	699c6b2b1b2acad2d0f219d9328713af	False	0.783203125	data	6.6660836278877325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x68644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x6918c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x6a738	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	0.47832369942196534
RT_ICON	0x6aca0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	0.5410649819494585
RT_ICON	0x6b548	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	0.4933368869936034
RT_ICON	0x6c3f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	0.5390070921985816
RT_ICON	0x6c858	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.41393058161350843
RT_ICON	0x6d900	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	0.3479253112033195
RT_ICON	0x6fea8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9809269502193401
RT_DIALOG	0x73c1c	0x2ba	data	0.5286532951289399
RT_DIALOG	0x73ed8	0x13a	data	0.6560509554140127
RT_DIALOG	0x74014	0xf2	data	0.71900826446281
RT_DIALOG	0x74108	0x14a	data	0.6
RT_DIALOG	0x74254	0x314	data	0.47588832487309646
RT_DIALOG	0x74568	0x24a	data	0.6279863481228669
RT_STRING	0x747b4	0x1fc	data	0.421259842519685
RT_STRING	0x749b0	0x246	data	0.41924398625429554
RT_STRING	0x74bf8	0x1a6	data	0.514218009478673
RT_STRING	0x74da0	0xdc	data	0.65
RT_STRING	0x74e7c	0x470	data	0.3873239436619718
RT_STRING	0x752ec	0x164	data	0.5056179775280899
RT_STRING	0x75450	0x110	data	0.5772058823529411
RT_STRING	0x75560	0x158	data	0.4563953488372093
RT_STRING	0x756b8	0xe8	data	0.5948275862068966
RT_STRING	0x757a0	0xe6	data	0.5695652173913044
RT_GROUP_ICON	0x75888	0x68	data	0.7019230769230769
RT_MANIFEST	0x758f0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetTimeFormatW, GetDateFormatW, LocalFree, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapReAlloc, HeapAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
02/17/24-20:52:04.259395	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49707	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:49.072739	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49720	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:09.235022	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49724	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:15.853737	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49725	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:23.326434	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49749	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:11.034301	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49708	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:18.141345	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49748	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:07.732975	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49746	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:02.386885	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49745	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:12.949378	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49747	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:38.776331	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49719	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:51.562322	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49743	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:56.964928	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49744	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:16.567473	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49747	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:24.696429	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49717	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:31.906944	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49718	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:53.150930	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49722	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:17.604122	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49716	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:11.846735	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49725	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:28.458601	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49750	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:54.853217	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49755	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:46.089995	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49742	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:58.615681	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49723	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:40.466833	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49741	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:39.466746	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49752	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:05.382586	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49724	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:34.811467	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49740	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:59.597580	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49756	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:34.464701	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49751	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:28.798105	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49750	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:34.764199	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49751	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:52.098391	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49722	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:49.734616	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49754	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:45.642655	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49720	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:39.797300	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49752	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:44.790001	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49753	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:31.906944	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49718	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:28.653198	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49739	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:24.391981	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49717	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:35.919369	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49718	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:21.864454	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49738	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:17.298204	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49716	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:15.940296	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49737	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:38.776331	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49719	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:03.325082	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49735	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:58.433164	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49755	10652	192.168.2.5	147.185.221.17
02/17/24-20:56:01.071896	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49756	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:57.092450	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49734	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:09.959178	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49736	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:59.278876	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49756	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:44.467327	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49753	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:27.778338	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49717	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:17.604122	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49716	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:24.696429	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49717	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:11.034301	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49708	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:18.307570	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49716	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:25.040431	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49729	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:44.248452	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49732	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:25.770567	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49738	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:49.433586	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49754	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:04.259395	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49707	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:18.507651	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49728	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:50.736922	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49733	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:23.647835	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49749	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:54.388467	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49755	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:52.690799	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49733	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:28.982204	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49729	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:27.598799	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49749	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:22.343303	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49728	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:31.595838	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49718	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:38.473071	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49719	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:35.408526	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49730	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:32.523742	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49750	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:01.316397	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49744	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:55.861168	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49743	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:50.393995	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49742	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:06.615566	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49745	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:11.913957	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49746	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:19.572153	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49728	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:39.102451	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49740	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:18.199865	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49728	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:17.086051	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49747	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:22.416223	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49748	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:44.777989	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49741	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:09.235022	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49724	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:58.615681	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49723	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:05.034795	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49724	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:11.528070	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49725	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:51.799554	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49722	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:58.312088	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49723	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:28.983704	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49739	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:13.250021	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49747	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:10.263467	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49736	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:22.169858	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49738	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:57.269542	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49744	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:18.464218	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49748	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:51.047431	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49733	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:16.249447	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49737	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:37.752783	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49731	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:45.336723	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49720	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:57.407277	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49734	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:02.706342	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49745	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:31.237871	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49730	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:08.024603	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49746	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:03.647201	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49735	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:31.544107	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49730	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:40.792497	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49741	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:35.114530	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49740	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:44.566584	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49732	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:51.869617	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49743	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:38.074175	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49731	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:46.401491	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49742	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:54.912197	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49733	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:53.691251	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49754	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:58.692906	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49755	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:48.544889	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49732	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:01.281165	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49734	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:41.995232	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49731	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:07.631530	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49735	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:43.699808	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49752	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:48.795743	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49753	10652	192.168.2.5	147.185.221.17
02/17/24-20:56:01.071896	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49756	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:18.307570	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49716	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:20.056141	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49737	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:32.523742	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49750	10652	192.168.2.5	147.185.221.17
02/17/24-20:55:38.656173	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49751	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:35.408526	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49730	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:14.174404	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49736	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:25.770567	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49738	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:53.150930	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49722	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:52.098391	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49722	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:35.919369	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49718	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:33.408174	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49739	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:27.778338	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49717	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:04.094268	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49707	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:49.072739	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49720	10652	192.168.2.5	147.185.221.17
02/17/24-20:54:44.533872	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49741	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:45.642655	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49720	10652	192.168.2.5	147.185.221.17
02/17/24-20:53:24.727442	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49729	10652	192.168.2.5	147.185.221.17
02/17/24-20:52:10.711575	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49708	10652	192.168.2.5	147.185.221.17

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2024 20:51:55.878257036 CET	49705	443	192.168.2.5	172.67.160.84
Feb 17, 2024 20:51:55.878339052 CET	443	49705	172.67.160.84	192.168.2.5
Feb 17, 2024 20:51:55.878438950 CET	49705	443	192.168.2.5	172.67.160.84
Feb 17, 2024 20:51:55.897950888 CET	49705	443	192.168.2.5	172.67.160.84
Feb 17, 2024 20:51:55.898025990 CET	443	49705	172.67.160.84	192.168.2.5
Feb 17, 2024 20:51:56.094944954 CET	443	49705	172.67.160.84	192.168.2.5
Feb 17, 2024 20:51:56.095143080 CET	49705	443	192.168.2.5	172.67.160.84
Feb 17, 2024 20:51:56.098550081 CET	49705	443	192.168.2.5	172.67.160.84
Feb 17, 2024 20:51:56.098573923 CET	443	49705	172.67.160.84	192.168.2.5
Feb 17, 2024 20:51:56.099051952 CET	443	49705	172.67.160.84	192.168.2.5
Feb 17, 2024 20:51:56.150794029 CET	49705	443	192.168.2.5	172.67.160.84
Feb 17, 2024 20:51:56.190608978 CET	49705	443	192.168.2.5	172.67.160.84
Feb 17, 2024 20:51:56.237909079 CET	443	49705	172.67.160.84	192.168.2.5
Feb 17, 2024 20:51:56.307822943 CET	443	49705	172.67.160.84	192.168.2.5
Feb 17, 2024 20:51:56.307902098 CET	443	49705	172.67.160.84	192.168.2.5
Feb 17, 2024 20:51:56.308073997 CET	49705	443	192.168.2.5	172.67.160.84
Feb 17, 2024 20:51:56.311899900 CET	49705	443	192.168.2.5	172.67.160.84
Feb 17, 2024 20:51:56.407522917 CET	49706	443	192.168.2.5	172.67.209.71
Feb 17, 2024 20:51:56.407557011 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.407629013 CET	49706	443	192.168.2.5	172.67.209.71
Feb 17, 2024 20:51:56.407999039 CET	49706	443	192.168.2.5	172.67.209.71
Feb 17, 2024 20:51:56.408008099 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.604279041 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.604355097 CET	49706	443	192.168.2.5	172.67.209.71
Feb 17, 2024 20:51:56.607356071 CET	49706	443	192.168.2.5	172.67.209.71
Feb 17, 2024 20:51:56.607367992 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.607893944 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.608773947 CET	49706	443	192.168.2.5	172.67.209.71
Feb 17, 2024 20:51:56.649982929 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.864753962 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.864814997 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.864850044 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.864883900 CET	49706	443	192.168.2.5	172.67.209.71
Feb 17, 2024 20:51:56.864907980 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.865081072 CET	443	49706	172.67.209.71	192.168.2.5
Feb 17, 2024 20:51:56.865147114 CET	49706	443	192.168.2.5	172.67.209.71
Feb 17, 2024 20:51:56.877444029 CET	49706	443	192.168.2.5	172.67.209.71
Feb 17, 2024 20:52:03.803324938 CET	49707	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:03.958065033 CET	10652	49707	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:03.958420038 CET	49707	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:04.094268084 CET	49707	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:04.259139061 CET	10652	49707	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:04.259394884 CET	49707	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:04.464905977 CET	10652	49707	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:04.525959015 CET	49707	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:04.730724096 CET	10652	49707	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:08.484978914 CET	10652	49707	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:08.485060930 CET	49707	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:10.550303936 CET	49707	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:10.552369118 CET	49708	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:10.706362963 CET	10652	49708	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:10.706542015 CET	49708	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:10.711575031 CET	49708	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:10.755590916 CET	10652	49707	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:11.033710003 CET	10652	49708	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:11.034301043 CET	49708	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:11.135143995 CET	49708	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:11.244354963 CET	10652	49708	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:11.344330072 CET	10652	49708	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:15.133358955 CET	10652	49708	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:15.133440018 CET	49708	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:17.135401964 CET	49708	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:17.137360096 CET	49716	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:17.292742014 CET	10652	49716	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:17.292848110 CET	49716	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:17.298203945 CET	49716	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:17.347229958 CET	10652	49708	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:17.603837013 CET	10652	49716	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:17.604121923 CET	49716	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:17.728914976 CET	49716	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:17.821630955 CET	10652	49716	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:17.937527895 CET	10652	49716	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:18.307569981 CET	49716	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:18.564666033 CET	10652	49716	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:22.222095966 CET	10652	49716	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:22.222210884 CET	49716	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:24.229010105 CET	49716	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:24.231877089 CET	49717	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:24.385591030 CET	10652	49717	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:24.385720968 CET	49717	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:24.391980886 CET	49717	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:24.439565897 CET	10652	49716	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:24.696041107 CET	10652	49717	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:24.696429014 CET	49717	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:24.822500944 CET	49717	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:24.900566101 CET	10652	49717	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:25.026242018 CET	10652	49717	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:27.778337955 CET	49717	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:28.027070045 CET	10652	49717	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:29.419018030 CET	10652	49717	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:29.419226885 CET	49717	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:31.431946993 CET	49717	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:31.433222055 CET	49718	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:31.590214014 CET	10652	49718	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:31.590375900 CET	49718	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:31.595838070 CET	49718	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:31.639693975 CET	10652	49717	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:31.906858921 CET	10652	49718	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:31.906944036 CET	49718	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:32.041363955 CET	49718	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:32.111907005 CET	10652	49718	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:32.246042967 CET	10652	49718	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:35.919368982 CET	49718	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:36.175137043 CET	10652	49718	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:36.306291103 CET	10652	49718	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:36.306529999 CET	49718	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:38.306991100 CET	49718	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:38.309026003 CET	49719	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:38.464798927 CET	10652	49719	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:38.465003014 CET	49719	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:38.473071098 CET	49719	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:38.514771938 CET	10652	49718	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:38.776253939 CET	10652	49719	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:38.776330948 CET	49719	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:38.900559902 CET	49719	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:38.980006933 CET	10652	49719	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:39.106863022 CET	10652	49719	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:42.770190001 CET	10652	49719	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:42.770328045 CET	49719	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:45.175056934 CET	49719	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:45.176831007 CET	49720	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:45.331502914 CET	10652	49720	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:45.331768990 CET	49720	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:45.336723089 CET	49720	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:45.381556988 CET	10652	49719	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:45.642438889 CET	10652	49720	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:45.642654896 CET	49720	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:45.775716066 CET	49720	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:45.848845005 CET	10652	49720	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:45.979687929 CET	10652	49720	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:49.072738886 CET	49720	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:49.322222948 CET	10652	49720	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:49.632672071 CET	10652	49720	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:49.632872105 CET	49720	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:51.635169029 CET	49720	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:51.637377024 CET	49722	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:51.790968895 CET	10652	49722	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:51.791493893 CET	49722	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:51.799554110 CET	49722	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:51.842276096 CET	10652	49720	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:52.098084927 CET	10652	49722	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:52.098391056 CET	49722	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:52.228662968 CET	49722	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:52.306399107 CET	10652	49722	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:52.428129911 CET	10652	49722	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:53.150929928 CET	49722	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:53.405549049 CET	10652	49722	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:56.140037060 CET	10652	49722	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:56.140158892 CET	49722	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:58.150844097 CET	49722	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:58.152579069 CET	49723	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:58.307080030 CET	10652	49723	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:58.307310104 CET	49723	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:58.312088013 CET	49723	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:58.354350090 CET	10652	49722	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:58.615484953 CET	10652	49723	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:58.615680933 CET	49723	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:58.744502068 CET	49723	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:52:58.817080975 CET	10652	49723	147.185.221.17	192.168.2.5
Feb 17, 2024 20:52:58.950555086 CET	10652	49723	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:02.863755941 CET	10652	49723	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:02.863998890 CET	49723	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:04.869501114 CET	49723	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:04.871757984 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:05.028450012 CET	10652	49724	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:05.028675079 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:05.034795046 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:05.071413994 CET	10652	49723	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:05.382291079 CET	10652	49724	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:05.382586002 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:05.478848934 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:05.586395025 CET	10652	49724	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:05.682415009 CET	10652	49724	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:06.775908947 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:07.031120062 CET	10652	49724	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:07.119718075 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:07.376863003 CET	10652	49724	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:08.432328939 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:08.688009024 CET	10652	49724	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:08.688256025 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:08.939321041 CET	10652	49724	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:09.235022068 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:09.363004923 CET	10652	49724	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:09.363168955 CET	49724	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:09.447302103 CET	10652	49724	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:11.371463060 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:11.525527954 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:11.525625944 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:11.528069973 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:11.846514940 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:11.846735001 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:11.963012934 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:12.054819107 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:12.168240070 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:12.431763887 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:12.633151054 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:12.633295059 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:12.889139891 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:12.889461994 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:13.133672953 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:13.133816004 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:13.378859043 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:13.378957987 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:13.629370928 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:13.629473925 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:13.886955976 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:13.887079000 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:14.133286953 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:14.133506060 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:14.381263018 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:14.381445885 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:14.637864113 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:14.638062000 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:14.884608030 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:14.884705067 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:15.142636061 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:15.142765045 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:15.389355898 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:15.389482021 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:15.633225918 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:15.633811951 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:15.853044033 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:15.853737116 CET	49725	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:16.054097891 CET	10652	49725	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:18.040724039 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:18.194957972 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:18.197197914 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:18.199865103 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:18.507527113 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:18.507651091 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:18.650482893 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:18.709952116 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:18.851557016 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:19.572153091 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:19.823724031 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:19.824089050 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:20.070682049 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:20.070843935 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:20.314779043 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:20.315186977 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:20.563033104 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:20.563170910 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:20.820910931 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:20.827924013 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:21.082670927 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:21.082762957 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:21.328749895 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:21.328953028 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:21.591553926 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:21.591766119 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:21.848814964 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:21.848999977 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:22.093586922 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:22.093673944 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:22.343163967 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:22.343302965 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:22.551024914 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:22.551100969 CET	10652	49728	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:22.551178932 CET	49728	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:24.566061020 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:24.723184109 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:24.723392010 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:24.727442026 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:25.040277004 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:25.040431023 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:25.181726933 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:25.245522976 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:25.393929005 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:25.394109011 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:25.653295994 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:25.653595924 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:25.913202047 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:25.913393974 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:26.163317919 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:26.163444996 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:26.421350956 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:26.421457052 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:26.685365915 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:26.685544014 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:26.942101955 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:26.942485094 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:27.186585903 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:27.186861992 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:27.447607040 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:27.448019981 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:27.707565069 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:27.707832098 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:27.953515053 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:27.953655005 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:28.214423895 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:28.214616060 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:28.482047081 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:28.482268095 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:28.734658957 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:28.734872103 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:28.982053041 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:28.982203960 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:29.069514036 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:29.069731951 CET	49729	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:29.188515902 CET	10652	49729	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:31.079272032 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:31.233103037 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:31.233458042 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:31.237870932 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:31.543901920 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:31.544106960 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:31.749301910 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:31.853687048 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:32.062083006 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:32.062309980 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:32.310039997 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:32.310134888 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:32.568903923 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:32.569117069 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:32.831840038 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:32.831942081 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:33.090079069 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:33.090290070 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:33.349581957 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:33.349796057 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:33.597676039 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:33.597886086 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:33.859994888 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:33.860233068 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:34.123198986 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:34.123425007 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:34.384972095 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:34.385109901 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:34.640507936 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:34.640590906 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:34.904715061 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:34.904803038 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:35.159703016 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:35.159800053 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:35.408449888 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:35.408525944 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:35.541821003 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:35.541902065 CET	49730	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:35.615868092 CET	10652	49730	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:37.590137005 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:37.749561071 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:37.749804020 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:37.752783060 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:38.073827982 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:38.074174881 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:38.244345903 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:38.281172037 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:38.449259043 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:38.449451923 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:38.701236010 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:38.701497078 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:38.947386026 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:38.947705984 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:39.209460974 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:39.209604025 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:39.469614029 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:39.469813108 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:39.729541063 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:39.729773045 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:39.991463900 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:39.991591930 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:40.249284029 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:40.249648094 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:40.497689962 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:40.497926950 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:40.758028030 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:40.758244991 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:41.014816046 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:41.014991999 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:41.262904882 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:41.263163090 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:41.507492065 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:41.507786036 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:41.753937006 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:41.754040956 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:41.995016098 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:41.995232105 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:42.072560072 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:42.072787046 CET	49731	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:42.197036028 CET	10652	49731	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:44.089948893 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:44.245982885 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:44.246100903 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:44.248451948 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:44.566411018 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:44.566584110 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:44.744158030 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:44.770915031 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:44.949008942 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:44.949119091 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:45.205823898 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:45.205890894 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:45.465626955 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:45.465809107 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:45.723284006 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:45.725177050 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:45.987166882 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:45.987251043 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:46.241684914 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:46.243021011 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:46.495569944 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:46.498158932 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:46.749392986 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:46.749499083 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:46.995908976 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:46.996079922 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:47.241508961 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:47.241597891 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:47.502043962 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:47.502346992 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:47.764219046 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:47.764302969 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:48.024360895 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:48.024491072 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:48.285497904 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:48.285665989 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:48.544652939 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:48.544888973 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:48.569099903 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:48.569175959 CET	49732	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:48.749654055 CET	10652	49732	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:50.574613094 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:50.730832100 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:50.730933905 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:50.736922026 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:51.047156096 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:51.047430992 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:51.166021109 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:51.252845049 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:51.370645046 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:51.370850086 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:51.616071939 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:51.616266012 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:51.862253904 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:51.862473965 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:52.108798027 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:52.109158039 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:52.359778881 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:52.446846962 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:52.690597057 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:52.690798998 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:52.936820984 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:52.937005997 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:53.182303905 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:53.182434082 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:53.425636053 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:53.425743103 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:53.678710938 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:53.678839922 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:53.934927940 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:53.935033083 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:54.178977966 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:54.179130077 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:54.425112963 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:54.425220013 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:54.667834044 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:54.667931080 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:54.912087917 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:54.912197113 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:55.063247919 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:55.063340902 CET	49733	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:55.113395929 CET	10652	49733	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:56.934315920 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:57.090223074 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:57.090354919 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:57.092449903 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:57.407167912 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:57.407277107 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:57.541013002 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:57.612673998 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:57.750600100 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:57.751174927 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:58.002902985 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:58.003031969 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:58.264429092 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:58.267118931 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:58.520806074 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:58.520939112 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:58.780488968 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:58.780586958 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:59.027359962 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:59.027539968 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:59.286580086 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:59.286698103 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:59.533082008 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:59.533262014 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:53:59.778009892 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:53:59.778106928 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:00.023200035 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:00.023360968 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:00.269414902 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:00.269561052 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:00.512630939 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:00.512749910 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:00.775290012 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:00.775393009 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:01.020736933 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:01.020843029 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:01.281042099 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:01.281164885 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:01.409395933 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:01.409652948 CET	49734	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:01.486774921 CET	10652	49734	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:03.168478012 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:03.322765112 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:03.323004007 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:03.325082064 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:03.646836042 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:03.647201061 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:03.850836039 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:03.853599072 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:04.058958054 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:04.059453964 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:04.312968016 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:04.313221931 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:04.559066057 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:04.559294939 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:04.809282064 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:04.809541941 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:05.071363926 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:05.071671009 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:05.329044104 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:05.329366922 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:05.577105045 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:05.577486038 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:05.837254047 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:05.837564945 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:06.102005005 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:06.102227926 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:06.357547998 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:06.357748985 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:06.605218887 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:06.605573893 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:06.864809036 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:06.865025997 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:07.128036022 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:07.128345013 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:07.385421991 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:07.385644913 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:07.631247997 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:07.631530046 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:07.667356968 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:07.667583942 CET	49735	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:07.837599039 CET	10652	49735	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:09.799361944 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:09.954457998 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:09.954583883 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:09.959177971 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:10.263155937 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:10.263467073 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:10.431711912 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:10.469335079 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:10.637326956 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:10.637553930 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:10.897377014 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:10.897624969 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:11.145818949 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:11.145982981 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:11.398588896 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:11.398910046 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:11.651949883 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:11.652156115 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:11.914170980 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:11.914385080 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:12.169682980 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:12.170016050 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:12.415558100 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:12.415788889 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:12.675576925 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:12.675697088 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:12.919301033 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:12.919469118 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:13.167635918 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:13.168032885 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:13.426126957 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:13.426248074 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:13.673417091 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:13.673672915 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:13.919697046 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:13.919953108 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:14.174283028 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:14.174403906 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:14.247682095 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:14.247793913 CET	49736	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:14.381680965 CET	10652	49736	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:15.777966976 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:15.937953949 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:15.938126087 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:15.940295935 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:16.249342918 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:16.249447107 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:16.458317041 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:16.462945938 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:16.672349930 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:16.672574997 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:16.930090904 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:16.930193901 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:17.191700935 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:17.191937923 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:17.452157974 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:17.452316046 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:17.709988117 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:17.710103035 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:17.973198891 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:17.973412991 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:18.231436968 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:18.231544018 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:18.496815920 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:18.497040987 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:18.754559040 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:18.754681110 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:19.014127016 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:19.014280081 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:19.274760008 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:19.274988890 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:19.536247015 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:19.536459923 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:19.796886921 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:19.796971083 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:20.056025028 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:20.056140900 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:20.268802881 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:20.268858910 CET	10652	49737	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:20.268904924 CET	49737	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:21.707359076 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:21.861399889 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:21.861535072 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:21.864454031 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:22.169766903 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:22.169857979 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:22.373281956 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:22.431567907 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:22.639189959 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:22.931566000 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:23.134902000 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:23.135010958 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:23.384730101 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:23.384903908 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:23.640799046 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:23.640973091 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:23.889123917 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:23.889213085 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:24.130702972 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:24.130789042 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:24.376683950 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:24.376807928 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:24.623341084 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:24.623437881 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:24.866596937 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:24.866741896 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:25.117419004 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:25.117669106 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:25.376919031 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:25.377001047 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:25.625291109 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:25.770566940 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:26.020756960 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:26.185034990 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:26.185154915 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:28.494190931 CET	49738	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:28.496200085 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:28.650127888 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:28.650505066 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:28.653198004 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:28.697422028 CET	10652	49738	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:28.983500957 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:28.983704090 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:29.165965080 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:29.191047907 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:29.370927095 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:29.371195078 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:29.626751900 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:29.626950979 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:29.870528936 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:29.870640993 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:30.118293047 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:30.118590117 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:30.374048948 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:30.374196053 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:30.620354891 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:30.620584011 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:30.869512081 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:30.869816065 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:31.129965067 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:31.130105019 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:31.389075041 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:31.389168024 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:31.634524107 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:31.634814978 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:31.895589113 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:31.895855904 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:32.171916008 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:32.172138929 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:32.431797981 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:32.432005882 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:32.691164970 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:32.691262007 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:32.937437057 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:32.937659979 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:33.183367014 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:33.183464050 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:33.407875061 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:33.408174038 CET	49739	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:33.612544060 CET	10652	49739	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:34.653141022 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:34.808964968 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:34.809237957 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:34.811466932 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:35.114316940 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:35.114530087 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:35.327898026 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:35.353415966 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:35.558247089 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:35.558511972 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:35.806246996 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:35.806518078 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:36.065937042 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:36.066102028 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:36.323641062 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:36.323817015 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:36.572446108 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:36.572699070 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:36.832461119 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:36.832587004 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:37.079781055 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:37.080051899 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:37.333167076 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:37.333420992 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:37.595752001 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:37.595983982 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:37.843910933 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:37.844141960 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:38.095153093 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:38.095386028 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:38.340018988 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:38.340300083 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:38.590559959 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:38.590712070 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:38.835417986 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:38.835520983 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:39.102211952 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:39.102451086 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:39.144593000 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:39.144793987 CET	49740	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:39.306117058 CET	10652	49740	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:40.308212042 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:40.464580059 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:40.464662075 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:40.466833115 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:40.792373896 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:40.792496920 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:40.931504011 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:40.996088982 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:41.136121988 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:41.136209011 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:41.386754036 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:41.386887074 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:41.635557890 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:41.635658979 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:41.882059097 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:41.882231951 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:42.132298946 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:42.132420063 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:42.381509066 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:42.381655931 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:42.629775047 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:42.629920959 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:42.877628088 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:42.921386957 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:43.175997972 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:43.176120043 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:43.426126003 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:44.533871889 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:44.777776957 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:44.777988911 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:44.854079962 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:44.854171038 CET	49741	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:44.982117891 CET	10652	49741	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:45.933558941 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:46.087449074 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:46.087600946 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:46.089994907 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:46.401335955 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:46.401490927 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:46.605528116 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:46.665936947 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:46.871443033 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:47.165891886 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:47.371560097 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:47.371686935 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:47.625272989 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:47.625416994 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:47.883466959 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:47.883678913 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:48.129508972 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:48.129616022 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:48.377552032 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:48.377727032 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:48.623495102 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:48.623584986 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:48.872211933 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:48.872483969 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:49.121792078 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:49.121988058 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:49.381757975 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:49.381867886 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:49.627907038 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:49.628010988 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:49.877870083 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:49.877974033 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:50.141724110 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:50.141895056 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:50.393872976 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:50.393995047 CET	49742	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:50.600337029 CET	10652	49742	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:51.404196024 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:51.560065985 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:51.560261965 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:51.562321901 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:51.869492054 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:51.869616985 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:52.040977001 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:52.076112986 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:52.248761892 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:52.249012947 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:52.500504017 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:52.500650883 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:52.762500048 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:52.762742996 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:53.016710043 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:53.016964912 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:53.272751093 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:53.273025990 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:53.538069963 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:53.538346052 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:53.800544977 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:53.800774097 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:54.064259052 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:54.064462900 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:54.318550110 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:54.318825960 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:54.581645012 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:54.581871986 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:54.842593908 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:54.842999935 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:55.103080988 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:55.103405952 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:55.366446018 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:55.366636992 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:55.622953892 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:55.623151064 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:55.860969067 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:55.861167908 CET	49743	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:56.068669081 CET	10652	49743	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:56.808321953 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:56.962316990 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:56.962647915 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:56.964927912 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:57.269109964 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:57.269541979 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:57.462852955 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:57.482960939 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:57.675111055 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:57.675345898 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:57.931303978 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:57.931476116 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:58.193464994 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:58.193619967 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:58.451390982 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:58.451756954 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:58.712585926 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:58.712851048 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:58.973531008 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:58.973740101 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:59.232923031 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:59.233094931 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:59.493102074 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:59.493196011 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:54:59.753454924 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:54:59.753566027 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:00.021027088 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:00.021151066 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:00.275572062 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:00.275702000 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:00.535229921 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:00.535342932 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:00.798095942 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:00.798202991 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:01.056024075 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:01.056135893 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:01.316298008 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:01.316396952 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:01.353219986 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:01.353349924 CET	49744	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:01.526483059 CET	10652	49744	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:02.230214119 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:02.384249926 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:02.384382010 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:02.386884928 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:02.706034899 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:02.706341982 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:02.911626101 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:02.931466103 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:03.135231972 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:03.135329962 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:03.381526947 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:03.381690979 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:03.623171091 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:03.623271942 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:03.869399071 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:03.869524956 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:04.111351013 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:04.111676931 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:04.359992027 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:04.360102892 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:04.604033947 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:04.604124069 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:04.848995924 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:04.849448919 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:05.096199036 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:05.096288919 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:05.351567030 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:05.351999998 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:05.610109091 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:05.610246897 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:05.858594894 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:05.858931065 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:06.102865934 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:06.103038073 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:06.354091883 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:06.354196072 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:06.615479946 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:06.615566015 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:06.743663073 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:06.743743896 CET	49745	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:06.814441919 CET	10652	49745	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:07.574206114 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:07.729490042 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:07.729701996 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:07.732975006 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:08.024343967 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:08.024602890 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:08.165976048 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:08.230407000 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:08.370404005 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:08.370620966 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:08.616516113 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:08.616853952 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:08.863234997 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:08.863493919 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:09.110193014 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:09.110502958 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:09.354547977 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:09.354942083 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:09.600610018 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:09.600860119 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:09.864080906 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:09.864284992 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:10.128406048 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:10.128658056 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:10.383981943 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:10.384290934 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:10.643629074 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:10.643883944 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:10.890033960 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:10.890259981 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:11.148963928 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:11.149210930 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:11.408803940 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:11.408999920 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:11.654833078 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:11.655086994 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:11.913583040 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:11.913957119 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:12.019004107 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:12.019269943 CET	49746	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:12.122087955 CET	10652	49746	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:12.793101072 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:12.946794987 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:12.947025061 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:12.949378014 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:13.249932051 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:13.250020981 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:13.431451082 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:13.452867985 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:13.635077000 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:14.038759947 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:14.038759947 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:14.040894032 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:14.244647026 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:14.244699955 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:14.248429060 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:14.248568058 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:14.489196062 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:14.489285946 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:14.735217094 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:14.735325098 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:14.989214897 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:14.989306927 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:15.243323088 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:15.302731037 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:15.550308943 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:15.550517082 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:15.798989058 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:16.567472935 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:16.826793909 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:16.826914072 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:17.085838079 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:17.086050987 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:17.256274939 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:17.256412983 CET	49747	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:17.294886112 CET	10652	49747	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:17.982858896 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:18.138672113 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:18.138792038 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:18.141345024 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:18.464086056 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:18.464217901 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:18.666179895 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:18.743978977 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:18.947077990 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:18.947201967 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:19.153372049 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:19.153533936 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:19.400767088 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:19.400959969 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:19.647006035 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:19.647125959 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:19.898920059 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:19.899175882 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:20.143635988 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:20.143752098 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:20.391659021 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:20.391858101 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:20.637820005 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:20.638030052 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:20.885272980 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:20.885433912 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:21.144504070 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:21.144726038 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:21.391777992 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:21.391932011 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:21.653279066 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:21.653458118 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:21.910213947 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:21.910325050 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:22.159969091 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:22.160191059 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:22.415918112 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:22.416223049 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:22.490277052 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:22.490547895 CET	49748	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:22.619499922 CET	10652	49748	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:23.168051004 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:23.323913097 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:23.324012041 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:23.326433897 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:23.647685051 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:23.647835016 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:23.852615118 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:23.853300095 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:24.061141968 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:24.353399038 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:24.559154034 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:24.559248924 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:24.810519934 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:24.810724974 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:25.059547901 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:25.059938908 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:25.316889048 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:25.317009926 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:25.562304974 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:25.562462091 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:25.809125900 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:25.809336901 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:26.069164991 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:26.069271088 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:26.316513062 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:26.316726923 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:26.577327967 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:26.577600002 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:26.837866068 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:26.837980032 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:27.094427109 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:27.094650030 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:27.346463919 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:27.346600056 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:27.598709106 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:27.598798990 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:27.663475990 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:27.663623095 CET	49749	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:27.805082083 CET	10652	49749	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:28.292804956 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:28.455090046 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:28.455265999 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:28.458600998 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:28.797977924 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:28.798105001 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:28.931410074 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:29.003309965 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:29.135135889 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:29.135267019 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:29.379503012 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:29.379606009 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:29.625338078 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:29.625477076 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:29.874402046 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:29.874584913 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:30.132189989 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:30.132456064 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:30.392111063 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:30.392302036 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:30.641876936 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:30.641969919 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:30.900203943 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:30.900361061 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:31.161969900 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:31.162074089 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:31.419794083 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:31.419982910 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:31.666429043 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:31.666563034 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:31.925587893 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:31.925859928 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:32.173712969 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:32.274388075 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:32.523566008 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:32.523741961 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:32.768831968 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:32.786415100 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:32.786551952 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:34.306668043 CET	49750	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:34.308052063 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:34.462109089 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:34.462228060 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:34.464700937 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:34.510829926 CET	10652	49750	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:34.764075041 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:34.764199018 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:34.962651014 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:34.967803001 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:35.167161942 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:35.462656021 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:35.665916920 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:35.666049957 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:35.874517918 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:35.874692917 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:36.125422955 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:36.125583887 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:36.372279882 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:36.372378111 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:36.619980097 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:36.620160103 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:36.877244949 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:36.877418995 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:37.125348091 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:37.125538111 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:37.383241892 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:37.383558989 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:37.632704973 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:37.632824898 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:37.891243935 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:37.891458035 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:38.149529934 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:38.149629116 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:38.397407055 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:38.397684097 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:38.656016111 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:38.656172991 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:38.760905027 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:38.761013031 CET	49751	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:38.866038084 CET	10652	49751	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:39.309678078 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:39.463331938 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:39.463438034 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:39.466746092 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:39.797215939 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:39.797300100 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:39.931372881 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:40.004302025 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:40.135296106 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:40.540741920 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:40.742537022 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:40.742681980 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:40.946886063 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:40.947066069 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:41.205244064 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:41.205416918 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:41.463027000 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:41.463159084 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:41.706938028 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:41.707035065 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:41.950485945 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:41.950593948 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:42.199048996 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:42.199176073 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:42.446099997 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:42.446325064 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:42.706662893 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:42.706887007 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:42.963134050 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:42.963243008 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:43.211124897 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:43.211330891 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:43.452806950 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:43.452914000 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:43.699686050 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:43.699807882 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:43.797553062 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:43.797739983 CET	49752	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:43.903518915 CET	10652	49752	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:44.308806896 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:44.464638948 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:44.464926004 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:44.467327118 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:44.789803982 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:44.790000916 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:44.962666035 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:45.001802921 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:45.172564030 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:45.172779083 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:45.433520079 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:45.433808088 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:45.693511963 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:45.693924904 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:45.955898046 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:45.956129074 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:46.216240883 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:46.216535091 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:46.478065968 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:46.478321075 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:46.734956980 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:46.735207081 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:46.996505022 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:46.996763945 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:47.258415937 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:47.258610010 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:47.516705990 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:47.516809940 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:47.775058031 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:47.775281906 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:48.040671110 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:48.040848017 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:48.300259113 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:48.300389051 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:48.561943054 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:48.562191963 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:48.795455933 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:48.795742989 CET	49753	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:49.008965969 CET	10652	49753	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:49.277065039 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:49.431119919 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:49.431387901 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:49.433585882 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:49.734360933 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:49.734616041 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:49.931488037 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:49.937719107 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:49.937850952 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:50.134100914 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:50.142821074 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:50.142944098 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:50.396076918 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:50.396187067 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:50.641063929 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:50.641371965 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:50.903675079 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:50.903858900 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:51.163733959 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:51.163989067 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:51.421971083 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:51.422116041 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:51.667335987 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:51.667538881 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:51.916229963 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:51.916523933 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:52.172229052 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:52.172333956 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:52.422382116 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:52.422517061 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:52.678999901 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:52.679270029 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:52.925060034 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:52.925185919 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:53.174257994 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:53.174379110 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:53.433924913 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:53.434195042 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:53.691036940 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:53.691251040 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:53.775907993 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:53.776133060 CET	49754	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:53.896945000 CET	10652	49754	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:54.229800940 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:54.383810043 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:54.383951902 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:54.388467073 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:54.690383911 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:54.690481901 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:54.853216887 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:54.896589041 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:54.896703959 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:55.058526993 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:55.104425907 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:55.104512930 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:55.366537094 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:55.366648912 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:55.624155998 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:55.624233961 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:55.885986090 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:55.886204004 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:56.143315077 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:56.143420935 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:56.387343884 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:56.387490034 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:56.638863087 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:56.638971090 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:56.898714066 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:56.899172068 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:57.158324003 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:57.158386946 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:57.420257092 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:57.420855045 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:57.678471088 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:57.678534985 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:57.924283981 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:57.924357891 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:58.175760984 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:58.175823927 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:58.433090925 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:58.433163881 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:58.692789078 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:58.692905903 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:58.697133064 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:58.697211027 CET	49755	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:58.902854919 CET	10652	49755	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:59.120836020 CET	49756	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:59.276612997 CET	10652	49756	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:59.276745081 CET	49756	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:59.278876066 CET	49756	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:59.597484112 CET	10652	49756	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:59.597579956 CET	49756	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:55:59.807595015 CET	10652	49756	147.185.221.17	192.168.2.5
Feb 17, 2024 20:55:59.868881941 CET	49756	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:56:00.076385975 CET	10652	49756	147.185.221.17	192.168.2.5
Feb 17, 2024 20:56:00.076648951 CET	49756	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:56:00.286796093 CET	10652	49756	147.185.221.17	192.168.2.5
Feb 17, 2024 20:56:00.286904097 CET	49756	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:56:00.547760010 CET	10652	49756	147.185.221.17	192.168.2.5
Feb 17, 2024 20:56:00.547873974 CET	49756	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:56:00.808145046 CET	10652	49756	147.185.221.17	192.168.2.5
Feb 17, 2024 20:56:00.808273077 CET	49756	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:56:01.071790934 CET	10652	49756	147.185.221.17	192.168.2.5
Feb 17, 2024 20:56:01.071896076 CET	49756	10652	192.168.2.5	147.185.221.17
Feb 17, 2024 20:56:01.327915907 CET	10652	49756	147.185.221.17	192.168.2.5
Feb 17, 2024 20:56:03.598290920 CET	10652	49756	147.185.221.17	192.168.2.5
Feb 17, 2024 20:56:03.598654032 CET	49756	10652	192.168.2.5	147.185.221.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 17, 2024 20:51:55.758121014 CET	63618	53	192.168.2.5	1.1.1.1
Feb 17, 2024 20:51:55.869880915 CET	53	63618	1.1.1.1	192.168.2.5
Feb 17, 2024 20:51:56.315579891 CET	58619	53	192.168.2.5	1.1.1.1
Feb 17, 2024 20:51:56.406672955 CET	53	58619	1.1.1.1	192.168.2.5
Feb 17, 2024 20:52:03.638398886 CET	60057	53	192.168.2.5	1.1.1.1
Feb 17, 2024 20:52:03.799185038 CET	53	60057	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 17, 2024 20:51:55.758121014 CET	192.168.2.5	1.1.1.1	0x21c5	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)	false
Feb 17, 2024 20:51:56.315579891 CET	192.168.2.5	1.1.1.1	0xeb21	Standard query (0)	ipbase.com	A (IP address)	IN (0x0001)	false
Feb 17, 2024 20:52:03.638398886 CET	192.168.2.5	1.1.1.1	0xc68b	Standard query (0)	mary-cottage.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 17, 2024 20:51:55.869880915 CET	1.1.1.1	192.168.2.5	0x21c5	No error (0)	freegeoip.app	172.67.160.84	A (IP address)	IN (0x0001)	false
Feb 17, 2024 20:51:55.869880915 CET	1.1.1.1	192.168.2.5	0x21c5	No error (0)	freegeoip.app	104.21.73.97	A (IP address)	IN (0x0001)	false
Feb 17, 2024 20:51:56.406672955 CET	1.1.1.1	192.168.2.5	0xeb21	No error (0)	ipbase.com	172.67.209.71	A (IP address)	IN (0x0001)	false
Feb 17, 2024 20:51:56.406672955 CET	1.1.1.1	192.168.2.5	0xeb21	No error (0)	ipbase.com	104.21.85.189	A (IP address)	IN (0x0001)	false
Feb 17, 2024 20:52:03.799185038 CET	1.1.1.1	192.168.2.5	0xc68b	No error (0)	mary-cottage.gl.at.ply.gg	147.185.221.17	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

freegeoip.app

ipbase.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	172.67.160.84	443	4292	C:\Users\user\AppData\Local\Temp\1.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-17 19:51:56 UTC	67	OUT	GET /xml/ HTTP/1.1 Host: freegeoip.app Connection: Keep-Alive
2024-02-17 19:51:56 UTC	629	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 17 Feb 2024 19:51:56 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Sat, 17 Feb 2024 20:51:56 GMT Location: https://ipbase.com/xml/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AxnlunZTZPsnBDILR0cT3pRPIYvbelj5%2Fq4LlTVt3Oj5TiXmNg1VX6sSQMnbDw3pB%2Fzj96ISNU5trA6Lj6geCf%2FJm9z9%2FP%2BO%2Fmhj21ITPSbbySBcbH4D%2FyTg2MMu6Lv5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 857091608e380f65-EWR alt-svc: h3=":443"; ma=86400
2024-02-17 19:51:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	172.67.209.71	443	4292	C:\Users\user\AppData\Local\Temp\1.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-17 19:51:56 UTC	64	OUT	GET /xml/ HTTP/1.1 Host: ipbase.com Connection: Keep-Alive
2024-02-17 19:51:56 UTC	734	IN	HTTP/1.1 404 Not Found Date: Sat, 17 Feb 2024 19:51:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Age: 0 Cache-Control: public,max-age=0,must-revalidate Cache-Status: "Netlify Edge"; fwd=miss Vary: Accept-Encoding X-Nf-Request-Id: 01HPWA06KE7Q6YWZ13ESJ0RXWW CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nD%2FqN1usfuEjBpDyOMSgN0VjHHfat69gi1bbbPZrxArTy18PlvgkxYxYVNGKMPS9u%2FFiW4PZ3gXb3pLHaWjXqWWHDG4l2XDcRqYMbFkSMd2HRJoucncjOX0WYU2b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 85709163cd9543e2-EWR alt-svc: h3=":443"; ma=86400
2024-02-17 19:51:56 UTC	635	IN	Data Raw: 63 30 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d Data Ascii: c0a<!DOCTYPE html><html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"> <title>Page Not Found</title> <link href='https://fonts.googleapis.com
2024-02-17 19:51:56 UTC	1369	IN	Data Raw: 20 30 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 32 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 34 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 6d 61 69 6e 20 7b 0a 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 Data Ascii: 0; } h1 { margin: 0; font-size: 22px; line-height: 24px; } .main { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; height: 10
2024-02-17 19:51:56 UTC	1085	IN	Data Raw: 20 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 30 30 37 30 36 37 22 20 64 3d 22 4d 31 31 2e 39 39 39 38 38 33 36 2c 34 2e 30 39 33 37 30 38 30 33 20 4c 38 2e 35 35 38 30 39 35 31 37 2c 37 2e 34 33 32 39 34 39 35 33 20 43 38 2e 32 33 35 33 31 34 35 39 2c 37 2e 37 34 36 31 31 32 39 38 20 38 2e 32 33 35 33 31 34 35 39 2c 38 2e 32 35 33 38 38 37 33 36 20 38 2e 35 35 38 30 39 35 31 37 2c 38 2e 35 36 36 39 33 37 36 39 20 4c 31 32 2c 31 31 2e 39 30 36 32 39 32 31 20 4c 39 2e 38 34 31 38 37 38 37 31 2c 31 34 20 4c 34 2e 32 34 32 30 38 35 34 34 2c 38 2e 35 36 36 39 33 37 35 31 20 43 33 2e 39 31 39 33 30 34 38 35 2c 38 2e 32 35 33 38 38 37 31 39 20 33 2e 39 31 39 33 30 34 38 35 2c 37 2e 37 34 36 31 31 32 38 31 20 34 2e 32 34 32 30 38 35 34 34 2c 37 2e 34 33 32 39 34 39 Data Ascii: <path fill="#007067" d="M11.9998836,4.09370803 L8.55809517,7.43294953 C8.23531459,7.74611298 8.23531459,8.25388736 8.55809517,8.56693769 L12,11.9062921 L9.84187871,14 L4.24208544,8.56693751 C3.91930485,8.25388719 3.91930485,7.74611281 4.24208544,7.432949
2024-02-17 19:51:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:51:52
Start date:	17/02/2024
Path:	C:\Users\user\Desktop\qdHMT36Tn9.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\qdHMT36Tn9.exe
Imagebase:	0x560000
File size:	471'910 bytes
MD5 hash:	3E5BA25AA4F23CEB11BE209D1967E341
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000000.00000003.2011201227.00000000057F0000.00000004.00000020.00020000.00000000.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000003.2011201227.0000000005813000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:51:53
Start date:	17/02/2024
Path:	C:\Users\user\AppData\Local\Temp\1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1.exe"
Imagebase:	0x1f2cb290000
File size:	546'816 bytes
MD5 hash:	0CE3051B867D50AA172D1B332F156E3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000002.00000000.2015718646.000001F2CB292000.00000002.00000001.01000000.00000009.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2051820157.000001F2CD109000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: 00000002.00000002.2051820157.000001F2CD109000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000002.00000002.2051820157.000001F2CD1D3000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: Joe Security Rule: JoeSecurity_RagsStealer, Description: Yara detected Rags Stealer, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: Joe Security Rule: JoeSecurity_44CaliberStealer, Description: Yara detected 44Caliber Stealer, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: ditekSHen Rule: MALWARE_Win_A310Logger, Description: Detects A310Logger, Source: C:\Users\user\AppData\Local\Temp\1.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs Detection: 72%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:51:53
Start date:	17/02/2024
Path:	C:\Users\user\AppData\Local\Temp\3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\3.exe"
Imagebase:	0x5c0000
File size:	37'888 bytes
MD5 hash:	6D11195AF6CCA04EB53ECCF9AAF329DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000003.00000000.2017971668.00000000005C2000.00000002.00000001.01000000.0000000B.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000003.00000002.4480531198.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\3.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\3.exe, Author: unknown Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Local\Temp\3.exe, Author: Brian Wallace @botnet_hunter Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\3.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs Detection: 89%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	20:52:00
Start date:	17/02/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\3.exe" "3.exe" ENABLE
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:52:00
Start date:	17/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:52:11
Start date:	17/02/2024
Path:	C:\Users\user\AppData\Local\Temp\3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\3.exe" ..
Imagebase:	0x6c0000
File size:	37'888 bytes
MD5 hash:	6D11195AF6CCA04EB53ECCF9AAF329DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:52:20
Start date:	17/02/2024
Path:	C:\Users\user\AppData\Local\Temp\3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\3.exe" ..
Imagebase:	0xba0000
File size:	37'888 bytes
MD5 hash:	6D11195AF6CCA04EB53ECCF9AAF329DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:52:29
Start date:	17/02/2024
Path:	C:\Users\user\AppData\Local\Temp\3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\3.exe" ..
Imagebase:	0xd80000
File size:	37'888 bytes
MD5 hash:	6D11195AF6CCA04EB53ECCF9AAF329DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13%
Total number of Nodes:	1713
Total number of Limit Nodes:	41

Executed Functions

Function 0057EA07 Relevance: 46.0, APIs: 22, Strings: 4, Instructions: 453
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0057D5DD: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0057D6C7

Part of subcall function 0057C5DD: GetCurrentDirectoryW.KERNEL32(?,?), ref: 0057C5E5

SetFileAttributesW.KERNEL32(?,00000000,?,?,?,00000800,?,6033248F,?,00000000,00000001), ref: 0057EB53
_wcslen.LIBCMT ref: 0057EB8D
_wcslen.LIBCMT ref: 0057EBA1
_wcslen.LIBCMT ref: 0057EBC6
GetFileAttributesW.KERNEL32(?), ref: 0057EC0C
DeleteFileW.KERNEL32(?), ref: 0057EC1E
_swprintf.LIBCMT ref: 0057EC43
GetFileAttributesW.KERNEL32(?), ref: 0057EC52
MoveFileW.KERNEL32(?,?), ref: 0057EC6B
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 0057EC7F
_wcslen.LIBCMT ref: 0057ECFA
_wcslen.LIBCMT ref: 0057ED03
SetWindowTextW.USER32(?,?), ref: 0057ED62

Strings

%s.%d.tmp, xrefs: 0057EC36
Software\Microsoft\Windows\CurrentVersion, xrefs: 0057EE0B
ProgramFilesDir, xrefs: 0057EE36
<br>, xrefs: 0057ECC4

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: File$_wcslen$Attributes$Move$CurrentDeleteDirectoryEnvironmentExpandStringsTextWindow_swprintf
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2983673336-312220925
Opcode ID: 44f81ac2999e5889af0897e12dc57ec34e9ef10851a5a3b350e8ea4c5995326c
Instruction ID: 1b6ddc61550539ab002e9c6400dd3e0b26a9b80a84828225b78b83e6978f07b3
Opcode Fuzzy Hash: 44f81ac2999e5889af0897e12dc57ec34e9ef10851a5a3b350e8ea4c5995326c
Instruction Fuzzy Hash: 94F153729002499ADB31EFA4EC89EEF3BBCFF59310F04452AE909D7150EB709A49DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0058037C Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 208
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0057290A: GetModuleHandleW.KERNEL32 ref: 00572937
Part of subcall function 0057290A: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00572949
Part of subcall function 0057290A: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00572973

Part of subcall function 0057C5DD: GetCurrentDirectoryW.KERNEL32(?,?), ref: 0057C5E5

Part of subcall function 0057CCD9: OleInitialize.OLE32(00000000), ref: 0057CCF2
Part of subcall function 0057CCD9: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0057CD29
Part of subcall function 0057CCD9: SHGetMalloc.SHELL32(005AC460), ref: 0057CD33

GetCommandLineW.KERNEL32 ref: 005803C9
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 005803F3
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007402), ref: 00580404
UnmapViewOfFile.KERNEL32(00000000), ref: 00580455

Part of subcall function 0057FFDD: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0057FFFE
Part of subcall function 0057FFDD: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00580038

Part of subcall function 00571421: _wcslen.LIBCMT ref: 00571445

CloseHandle.KERNEL32(00000000), ref: 0058045C
GetModuleFileNameW.KERNEL32(00000000,005C2CC0,00000800), ref: 00580476
SetEnvironmentVariableW.KERNEL32(sfxname,005C2CC0), ref: 00580482
GetLocalTime.KERNEL32(?), ref: 0058048D
_swprintf.LIBCMT ref: 005804E1
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 005804F6
GetModuleHandleW.KERNEL32(00000000), ref: 005804FD
LoadIconW.USER32(00000000,00000064), ref: 00580514
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001DAE0,00000000), ref: 00580565
Sleep.KERNEL32(?), ref: 00580593
DeleteObject.GDI32 ref: 005805CC
DeleteObject.GDI32(?), ref: 005805DC
CloseHandle.KERNEL32 ref: 0058061F

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 005804D2
STARTDLG, xrefs: 0058055A
winrarsfxmappingfile.tmp, xrefs: 005803E7
sfxname, xrefs: 0058047D
pPZ, xrefs: 00580525
sfxstime, xrefs: 005804F1

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf_wcslen
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$pPZ$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3014515783-4221014823
Opcode ID: 5d9e1c20f9491f5fb023f517617b4effbb292f33f8ff49542641355af014495f
Instruction ID: 3ff0819cafbc05ceb80f523a1bb8ebd43ddd5f34f11bba063d0e72cc7fb65f9e
Opcode Fuzzy Hash: 5d9e1c20f9491f5fb023f517617b4effbb292f33f8ff49542641355af014495f
Instruction Fuzzy Hash: 1D712471504305AFD720AB61EC4EF6F3FA8BB95740F008419F949A21A2EF758D4CEB61

Uniqueness

Uniqueness Score: -1.00%

Function 0056F963 Relevance: 18.2, APIs: 3, Strings: 7, Instructions: 684COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000800,6033248F), ref: 0056F9CD

Part of subcall function 0056E208: _wcslen.LIBCMT ref: 0056E210

Part of subcall function 00572663: _wcslen.LIBCMT ref: 00572669

Part of subcall function 00573D10: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,6033248F,?,?,6033248F,00000001,0056DA04,00000000,6033248F,?,00010458,?,?), ref: 00573D2C

_wcslen.LIBCMT ref: 0056FD00
__fprintf_l.LIBCMT ref: 0056FE50

Strings

|lY, xrefs: 0056FCD1
*messages***, xrefs: 0056FB0A
$%s:, xrefs: 0056FE33
*messages***, xrefs: 0056FAD1
RTL, xrefs: 0056FE12
@%s:, xrefs: 0056FE3A, 0056FE46
,, xrefs: 0056FE8B

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen$ByteCharFileModuleMultiNameWide__fprintf_l
String ID: ,$$%s:$*messages***$*messages***$@%s:$RTL$|lY
API String ID: 2646189078-3569327146
Opcode ID: 0872d131bfea87c1c16990eb7d2e49dd2724bbb53deb1858bfd551d068a7051a
Instruction ID: 1599b2948098bc7d002b3089d63b2185ec3f09bf67270eceff59255e12ca2b5a
Opcode Fuzzy Hash: 0872d131bfea87c1c16990eb7d2e49dd2724bbb53deb1858bfd551d068a7051a
Instruction Fuzzy Hash: EB420371D00219EBDF24EFA4EC45AEEBBB4FF58310F50442AF909AB281EB715A45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0057C652 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,0057DA3D,00000066), ref: 0057C665
SizeofResource.KERNEL32(00000000,?,?,?,0057DA3D,00000066), ref: 0057C67C
LoadResource.KERNEL32(00000000,?,?,?,0057DA3D,00000066), ref: 0057C693
LockResource.KERNEL32(00000000,?,?,?,0057DA3D,00000066), ref: 0057C6A2
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0057DA3D,00000066), ref: 0057C6BD
GlobalLock.KERNEL32(00000000,?,?,?,?,?,0057DA3D,00000066), ref: 0057C6CE
GlobalUnlock.KERNEL32(00000000), ref: 0057C756

Part of subcall function 0057C5B6: GdipAlloc.GDIPLUS(00000010), ref: 0057C5BC

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0057C737
GlobalFree.KERNEL32(00000000), ref: 0057C75D

Strings

PNG, xrefs: 0057C656

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: d8d37277062d013a49fe22388826341273e397b3c4f485a3ba2ee8f05b7a4861
Instruction ID: 83b38b0af0c2008817807fcae6231e049862ee5762494aaa52a08ce32e93055a
Opcode Fuzzy Hash: d8d37277062d013a49fe22388826341273e397b3c4f485a3ba2ee8f05b7a4861
Instruction Fuzzy Hash: E3315E75600602ABD7149F22EC88D1B7FA8FF95751B05452EF90992261EF31D808FFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0056C4A8 Relevance: 7.6, APIs: 5, Instructions: 111
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,?,?,?,0056C39F,000000FF,?,?,?,?,005687BC,?,?,00000000), ref: 0056C4E6

Part of subcall function 0056DA1E: _wcslen.LIBCMT ref: 0056DA59

FindFirstFileW.KERNEL32(?,00000000,?,?,00000800,?,?,0056C39F,000000FF,?,?,?,?,005687BC,?,?), ref: 0056C516
GetLastError.KERNEL32(?,?,00000800,?,?,0056C39F,000000FF,?,?,?,?,005687BC,?,?,00000000,0000003A), ref: 0056C522
FindNextFileW.KERNEL32(?,?,00000000,?,?,?,0056C39F,000000FF,?,?,?,?,005687BC,?,?,00000000), ref: 0056C549
GetLastError.KERNEL32(?,?,0056C39F,000000FF,?,?,?,?,005687BC,?,?,00000000,0000003A,?,0000003A,00000802), ref: 0056C555

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 9db43d6a8df85ab1d0332ba305db17cb0174eda96da25c6cd55ca045973dd781
Instruction ID: b8ef7457a9c2af58b3a258ded0c54689b6fe2edc30ac035edadf2bf27981fd5d
Opcode Fuzzy Hash: 9db43d6a8df85ab1d0332ba305db17cb0174eda96da25c6cd55ca045973dd781
Instruction Fuzzy Hash: 774164B1508745AFC724EF24D8859EAFBE8FB98350F004A1EF5DAD3240D734A958DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0058A640 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0058A616,?,0059F7B0,0000000C,0058A76D,?,00000002,00000000), ref: 0058A661
TerminateProcess.KERNEL32(00000000,?,0058A616,?,0059F7B0,0000000C,0058A76D,?,00000002,00000000), ref: 0058A668
ExitProcess.KERNEL32 ref: 0058A67A

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b7335577eb7d270dd8ba9f7da46260906c8fb6de5f73119dcdf294b12cfcc268
Instruction ID: a2712770d3da58ffb50ab3f1d70f6f8723ac6aa6cbb84823f2761fb8261dd2f3
Opcode Fuzzy Hash: b7335577eb7d270dd8ba9f7da46260906c8fb6de5f73119dcdf294b12cfcc268
Instruction Fuzzy Hash: 60E0B631840108AFDF117F65DD4DA483F6AFBA0741F054416FC09AA136EB36ED4AEB95

Uniqueness

Uniqueness Score: -1.00%

Function 00569906 Relevance: 2.4, Strings: 1, Instructions: 1169COMMON

Download Yara Rule

Strings

__tmp_reference_source_, xrefs: 00569C0E

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen$AttributesFile_swprintf$CurrentH_prolog3Process__aulldiv_wcsrchr
String ID: __tmp_reference_source_
API String ID: 3636405837-685763994
Opcode ID: 5032675cc459eb623ce7eeeb857d709e7c5f06415fa43e610bcea8d73b069c1f
Instruction ID: 9392391799f99c9bf15e4b80c9551728baec2dfc37131ec59f7229623a36e237
Opcode Fuzzy Hash: 5032675cc459eb623ce7eeeb857d709e7c5f06415fa43e610bcea8d73b069c1f
Instruction Fuzzy Hash: DAA21970904285AEDF25DF64C889BFE7FB9BF45300F0845B9ED49AB282D7305A45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00578C7E Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: eeea85b86a97ef6500a248d19c22f17a5cee1883002a1a1dae3ccf591b881528
Instruction ID: 477f4b52296b1b203df857a42192377e6a1bc997eee210be9f3dcb5157ff4499
Opcode Fuzzy Hash: eeea85b86a97ef6500a248d19c22f17a5cee1883002a1a1dae3ccf591b881528
Instruction Fuzzy Hash: E4D1D2B1A483418FCB24DF28D84876BBFE5BF89304F08856DE88D9B242D774E904DB56

Uniqueness

Uniqueness Score: -1.00%

Function 0057290A Relevance: 101.8, APIs: 23, Strings: 35, Instructions: 327
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00572937
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00572949
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00572973
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00572C1D
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00572C37
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00572C4B
ReadFile.KERNEL32(00000000,?,00007FFE,$oY,00000000), ref: 00572C69
CloseHandle.KERNEL32(00000000), ref: 00572CCD
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00572CE6
CompareStringW.KERNEL32(00000400,00001001,poY,?,DXGIDebug.dll,?,$oY,?,00000000,?,00000800), ref: 00572D3A
GetFileAttributesW.KERNELBASE(?,?,$oY,00000800,?,00000000,?,00000800), ref: 00572D64
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 00572DA0

Part of subcall function 005728AB: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005728D4
Part of subcall function 005728AB: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00571309,Crypt32.dll,00000000,00571383,00000200,?,00571366,00000000,00000000,?), ref: 005728F4

_swprintf.LIBCMT ref: 00572E12
_swprintf.LIBCMT ref: 00572E5E
AllocConsole.KERNEL32 ref: 00572E66
GetCurrentProcessId.KERNEL32 ref: 00572E70
AttachConsole.KERNEL32(00000000), ref: 00572E77
_wcslen.LIBCMT ref: 00572E8C
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00572E9D
WriteConsoleW.KERNEL32(00000000), ref: 00572EA4
Sleep.KERNEL32(00002710), ref: 00572EAF
FreeConsole.KERNEL32 ref: 00572EB5
ExitProcess.KERNEL32 ref: 00572EBD

Strings

tqY, xrefs: 00572A71
XpY, xrefs: 00572A11
pY, xrefs: 00572A41
poY, xrefs: 00572D2C
xsY, xrefs: 00572B55
<rY, xrefs: 00572AC6
(pY, xrefs: 00572A01
DtY, xrefs: 00572BAD
SetDllDirectoryW, xrefs: 00572943
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00572E4C
LsY, xrefs: 00572B3F
@pY, xrefs: 00572A09
,qY, xrefs: 00572A59
$oY, xrefs: 00572C56, 00572C5A
DqY, xrefs: 00572A61
kernel32, xrefs: 0057292D
DXGIDebug.dll, xrefs: 00572D26
xrY, xrefs: 00572ADC
uxtheme.dll, xrefs: 00572DDF
$sY, xrefs: 00572B29
(tY, xrefs: 00572BA2
dwmapi.dll, xrefs: 005729D9, 00572DD5
<, xrefs: 00572D3A
ppY, xrefs: 00572A19
oY, xrefs: 005729E9
<oY, xrefs: 005729AE
XoY, xrefs: 005729B6
xtY, xrefs: 00572BC3
\tY, xrefs: 00572BB8
$rY, xrefs: 00572ABB
4sY, xrefs: 00572B34
\qY, xrefs: 00572A69
SetDefaultDllDirectories, xrefs: 0057296D
`rY, xrefs: 00572AD1
dsY, xrefs: 00572B4A

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite_wcslen
String ID: $oY$$rY$$sY$(pY$(tY$,qY$4sY$<$<oY$<rY$@pY$DXGIDebug.dll$DqY$DtY$LsY$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$XoY$XpY$\qY$\tY$`rY$dsY$dwmapi.dll$kernel32$poY$ppY$tqY$uxtheme.dll$xrY$xsY$xtY$oY$pY
API String ID: 270162209-564300713
Opcode ID: a50afde03d1cb083387d3aacb50c095c66188872a4559e718feab2b1f79da321
Instruction ID: 494c5da9f853b01dd6db460394202566c58d180edd6abb82a9cff93ecd76fb51
Opcode Fuzzy Hash: a50afde03d1cb083387d3aacb50c095c66188872a4559e718feab2b1f79da321
Instruction Fuzzy Hash: C5D16FB10183899BDB319F50D88DA9FBFECBB89304F50491EF58996251DBB0854CDBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0057DAE0 Relevance: 95.2, APIs: 47, Strings: 7, Instructions: 750windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00561366: GetDlgItem.USER32(00000000,00003021), ref: 005613AA
Part of subcall function 00561366: SetWindowTextW.USER32(00000000,005965F4), ref: 005613C0

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0057DC06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0057DC24
IsDialogMessageW.USER32(?,?), ref: 0057DC37
TranslateMessage.USER32(?), ref: 0057DC45
DispatchMessageW.USER32(?), ref: 0057DC4F
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 0057DC72
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 0057DC95
GetDlgItem.USER32(?,00000068), ref: 0057DCB8
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0057DCD3
SendMessageW.USER32(00000000,000000C2,00000000,005965F4), ref: 0057DCE6

Part of subcall function 0057F77B: _wcslen.LIBCMT ref: 0057F7A5

SetFocus.USER32(00000000), ref: 0057DCED
_swprintf.LIBCMT ref: 0057DD4C

Part of subcall function 00564C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00564C13

GetLastError.KERNEL32(?,00000000,00000000,00000000,?,00000800), ref: 0057DDAF
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,00000800), ref: 0057DDD7
GetTickCount.KERNEL32 ref: 0057DDF5
_swprintf.LIBCMT ref: 0057DE0D
GetLastError.KERNEL32(?,00000011), ref: 0057DE3F
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,00000000,00000000,00000000,?,00000800), ref: 0057DE92
_swprintf.LIBCMT ref: 0057DEC9
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007402,winrarsfxmappingfile.tmp,?,?,?,?,005B3482,00000200), ref: 0057DF1D
GetCommandLineW.KERNEL32(?,?,?,?,005B3482,00000200), ref: 0057DF33
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,005B3482,00000400,00000001,00000001,?,?,?,?,005B3482,00000200), ref: 0057DF8A
ShellExecuteExW.SHELL32(?), ref: 0057DFB2
Sleep.KERNEL32(00000064,?,?,?,?,005B3482,00000200), ref: 0057DFFA
UnmapViewOfFile.KERNEL32(?,?,0000421C,005B3482,00000400,?,?,?,?,005B3482,00000200), ref: 0057E023
CloseHandle.KERNEL32(?,?,?,?,?,005B3482,00000200), ref: 0057E02C
_swprintf.LIBCMT ref: 0057E05F
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0057E0BE
SetDlgItemTextW.USER32(?,00000065,005965F4), ref: 0057E0D5
GetDlgItem.USER32(?,00000065), ref: 0057E0DE
GetWindowLongW.USER32(00000000,000000F0), ref: 0057E0ED
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0057E0FC
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0057E1A9
_wcslen.LIBCMT ref: 0057E1FF
_swprintf.LIBCMT ref: 0057E229
SendMessageW.USER32(?,00000080,00000001,?), ref: 0057E273
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 0057E28D
GetDlgItem.USER32(?,00000068), ref: 0057E296
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 0057E2AC
GetDlgItem.USER32(?,00000066), ref: 0057E2C6
SetWindowTextW.USER32(00000000,005B589A), ref: 0057E2E8
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 0057E348
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0057E35B
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001D8C0,00000000,?), ref: 0057E3FE
EnableWindow.USER32(00000000,00000000), ref: 0057E4CC
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 0057E50E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0057E532

Strings

STARTDLG, xrefs: 0057DB2D
winrarsfxmappingfile.tmp, xrefs: 0057DEF3
__tmp_rar_sfx_access_check_%u, xrefs: 0057DDFC
"%s"%s, xrefs: 0057E04E
-el -s2 "-d%s" "-sp%s", xrefs: 0057DEB8
LICENSEDLG, xrefs: 0057E3F3
%s, xrefs: 0057E219

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Item$MessageText$Send$Window_swprintf$File$ErrorLast$DialogLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3247240745-1712381250
Opcode ID: a7ed808cd920f2abb9e265c166e9d40ea831289a063b975c15b3ceef4f60dc2d
Instruction ID: f371dde1c4d34252acaf8422d9ef06455098b59209b4c2143a29c4bf3afa0081
Opcode Fuzzy Hash: a7ed808cd920f2abb9e265c166e9d40ea831289a063b975c15b3ceef4f60dc2d
Instruction Fuzzy Hash: A342D270940749AEEB21AB60FC4EFBE3FB8BB69704F048055F509A61D1DB745A48FB21

Uniqueness

Uniqueness Score: -1.00%

Function 0057F7FC Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 103
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0057D864: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0057D875
Part of subcall function 0057D864: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0057D886
Part of subcall function 0057D864: IsDialogMessageW.USER32(00010458,?), ref: 0057D89A
Part of subcall function 0057D864: TranslateMessage.USER32(?), ref: 0057D8A8
Part of subcall function 0057D864: DispatchMessageW.USER32(?), ref: 0057D8B2

GetDlgItem.USER32(00000068,005C3CF0), ref: 0057F81F
ShowWindow.USER32(00000000,00000005,?,?,0057D099,00000001,?,?,0057DAB9,005982F0,005C3CF0,005C3CF0,00001000,005A50C4,00000000,?), ref: 0057F844
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0057F853
SendMessageW.USER32(00000000,000000C2,00000000,005965F4), ref: 0057F861
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0057F87B
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0057F895
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0057F8D9
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0057F8E4
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0057F8F7
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0057F91E
SendMessageW.USER32(00000000,000000C2,00000000,0059769C), ref: 0057F92D

Strings

\, xrefs: 0057F885

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 5103e769bb3098c3f748edd7172683b3d10e8278c951aae8644e1dea4d41e04d
Instruction ID: b14ba500e7d99f7ca90fe42d49f5d0ecacde6af20454e72afa55824f1f918f21
Opcode Fuzzy Hash: 5103e769bb3098c3f748edd7172683b3d10e8278c951aae8644e1dea4d41e04d
Instruction Fuzzy Hash: E831D4B1249B04AFE310DF24EC4AF6B7FACFF6A704F040919F5A19A1D1D7605908EB66

Uniqueness

Uniqueness Score: -1.00%

Function 0057FAFC Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0057FB35
ShellExecuteExW.SHELL32(?), ref: 0057FC78
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 0057FCB0
GetExitCodeProcess.KERNEL32(?,?), ref: 0057FCEC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 0057FD12
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 0057FD78

Strings

.exe, xrefs: 0057FD1C
.inf, xrefs: 0057FC34

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf
API String ID: 36480843-3750412487
Opcode ID: 89d55912220c3a6cdf021ffb4ed42d9fa9f5804548789226aed6e76303e949c6
Instruction ID: 7744df5b4897bb31e563faae9d77ecc76e39bfe506d6d1f72d442a818c5ac556
Opcode Fuzzy Hash: 89d55912220c3a6cdf021ffb4ed42d9fa9f5804548789226aed6e76303e949c6
Instruction Fuzzy Hash: 1E61C1701083849ED731DF60E844ABA7FE4BF98744F04882DF8C897250D7709D88EB52

Uniqueness

Uniqueness Score: -1.00%

Function 0058CFAB Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00587F99,00587F99,?,?,?,0058D1FC,00000001,00000001,62E85006), ref: 0058D005
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0058D1FC,00000001,00000001,62E85006,?,?,?), ref: 0058D08B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,62E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0058D185
__freea.LIBCMT ref: 0058D192

Part of subcall function 0058BC8E: RtlAllocateHeap.NTDLL(00000000,?,?,?,00586A24,?,0000015D,?,?,?,?,00587F00,000000FF,00000000,?,?), ref: 0058BCC0

__freea.LIBCMT ref: 0058D19B
__freea.LIBCMT ref: 0058D1C0

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: f3af074ea16822fe9b0db39bceb06738c3b73ce54f94a7a0e204e0314942812b
Instruction ID: bd7b4b792e56735e4104b93061c5b74b9180353f275bcbab3fe5d45730c01580
Opcode Fuzzy Hash: f3af074ea16822fe9b0db39bceb06738c3b73ce54f94a7a0e204e0314942812b
Instruction Fuzzy Hash: 0D519172600216AAEB25AE64CC49EBE7FF9FF84750F154629FD05E6180DB34DC44D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0057CB49 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0057CB6A
SHAutoComplete.SHLWAPI(?,00000010), ref: 0057CBA1

Part of subcall function 00574168: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,0056E084,00000000,.exe,?,?,00000800,?,?,?,0057AD5D), ref: 0057417E

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0057CB91

Strings

@Ut, xrefs: 0057CBA1
EDIT, xrefs: 0057CB75, 0057CB80, 0057CB8D

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @Ut$EDIT
API String ID: 4243998846-2065656831
Opcode ID: ab0ca373f59f962790231d8a63c0dac80d3c198d3a10c155659699d11fea6448
Instruction ID: ae1d751d445a113c4554d33df19d1636ccfc8bc7cba3079d7475834ed01b2063
Opcode Fuzzy Hash: ab0ca373f59f962790231d8a63c0dac80d3c198d3a10c155659699d11fea6448
Instruction Fuzzy Hash: EAF0C831601718EFDB209B249C0AF9F7FACEF9AB00F404059B949BB180D770DA05DAA5

Uniqueness

Uniqueness Score: -1.00%

Function 0057CCD9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005728AB: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005728D4
Part of subcall function 005728AB: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00571309,Crypt32.dll,00000000,00571383,00000200,?,00571366,00000000,00000000,?), ref: 005728F4

OleInitialize.OLE32(00000000), ref: 0057CCF2
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0057CD29
SHGetMalloc.SHELL32(005AC460), ref: 0057CD33

Strings

3So, xrefs: 0057CD0A
riched20.dll, xrefs: 0057CCE1

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3So
API String ID: 3498096277-3464455743
Opcode ID: 5247aff51cebc5eec9a8a451ef0b58cc2b6a1744f4e89b916074a8d40086567b
Instruction ID: fd128aaade6e4462dc2a56f6e184e25dc8ba0e596f2c2f0e3ff8ab535cae6baa
Opcode Fuzzy Hash: 5247aff51cebc5eec9a8a451ef0b58cc2b6a1744f4e89b916074a8d40086567b
Instruction Fuzzy Hash: 1CF0E7B190420DABCB10AF9A98499AFBFBCEF98705F00405AA815B2251DBB456499FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0056B2B0 Relevance: 7.6, APIs: 5, Instructions: 119
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00568846,?,00000005), ref: 0056B342
GetLastError.KERNEL32(?,?,00568846,?,00000005), ref: 0056B34F
CreateFileW.KERNEL32(?,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00568846,?,00000005), ref: 0056B382
GetLastError.KERNEL32(?,?,00568846,?,00000005), ref: 0056B38A
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00568846,?,00000005), ref: 0056B3D9

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: bbf98039d349bea0cd5667d555c12e8651520dc1b6053d3bf2ddeb9a7a2cd529
Instruction ID: 2f890a9b688170560e1701710da04728644e2d2e929bdbd2cdeadf95cb9b72f0
Opcode Fuzzy Hash: bbf98039d349bea0cd5667d555c12e8651520dc1b6053d3bf2ddeb9a7a2cd529
Instruction Fuzzy Hash: 91412A70644745AFE320DF24DC4979ABFD8BB54310F100E1AF9A1D72C1D7B0A999CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0057D864 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0057D875
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0057D886
IsDialogMessageW.USER32(00010458,?), ref: 0057D89A
TranslateMessage.USER32(?), ref: 0057D8A8
DispatchMessageW.USER32(?), ref: 0057D8B2

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 86d28cd48e37b581860cb856c3dd0e8244bb38ba381eaeb2770dce421212df32
Instruction ID: d79534b6d233635ee79b5310de2adb5f4bc90e7c8c4ba4778322950122487947
Opcode Fuzzy Hash: 86d28cd48e37b581860cb856c3dd0e8244bb38ba381eaeb2770dce421212df32
Instruction Fuzzy Hash: DAF0D07290521DABDF20ABE6EC4CDDB7F7CFE192517008415B51AE2050E728D50ADFB0

Uniqueness

Uniqueness Score: -1.00%

Function 0057FFDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0057FFFE
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00580038

Strings

sfxcmd, xrefs: 0057FFF9
sfxpar, xrefs: 00580033

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 9aabc5e3abbf0e7cb327d2d8536d7577a907b3d86a87576d424131b9ec9b8a46
Instruction ID: ebec36e140f060b3da64f1ccf58d470e50bcd39b07be495afa502473c9c6ad53
Opcode Fuzzy Hash: 9aabc5e3abbf0e7cb327d2d8536d7577a907b3d86a87576d424131b9ec9b8a46
Instruction Fuzzy Hash: BEF04671901235EBCB20BB909C0A9BF7B9CFF1EB40B400406BD01A7181DAB09D48EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00586232 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000011,00000000,00000800,?,005861E3,00000000,00000001,005C60C8,?,?,?,00586386,00000004,InitializeCriticalSectionEx,00599624,InitializeCriticalSectionEx), ref: 0058623F
GetLastError.KERNEL32(?,005861E3,00000000,00000001,005C60C8,?,?,?,00586386,00000004,InitializeCriticalSectionEx,00599624,InitializeCriticalSectionEx,00000000,?,0058613D), ref: 00586249
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,00585083), ref: 00586271

Strings

api-ms-, xrefs: 00586256

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 60610b8626f8a1be49be6a332cab35d8a2ffafd8893db29a680e407c76a02b31
Instruction ID: 698917a6589bd4c72616dd0bdf6f66e1acbe3dad157cd04efe0cef0a2d1bc103
Opcode Fuzzy Hash: 60610b8626f8a1be49be6a332cab35d8a2ffafd8893db29a680e407c76a02b31
Instruction Fuzzy Hash: 8CE04F38680304B7EF202F60EC0AF693F65BF10B51F110061FD0EB80E1EBA19958AA85

Uniqueness

Uniqueness Score: -1.00%

Function 0056B151 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,00000000,0056B662,?,?,00000000,?,?), ref: 0056B161
ReadFile.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,0056B662,?,?,00000000,?,?), ref: 0056B179
GetLastError.KERNEL32(?,?,?,00000000,0056B662,?,?,00000000,?,?), ref: 0056B1AB
GetLastError.KERNEL32(?,?,?,00000000,0056B662,?,?,00000000,?,?), ref: 0056B1CA

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: fe79d0a8bad3e3611d5192242c1b080f6f4b63c3faaa66d5806573453c9eecfd
Instruction ID: ab3a7f1ff3f608e616caf265cd1cc69a0d6f3ffa866871e94c7483c0231ade4f
Opcode Fuzzy Hash: fe79d0a8bad3e3611d5192242c1b080f6f4b63c3faaa66d5806573453c9eecfd
Instruction Fuzzy Hash: AD118270900614FBFB215F20CC286693FA9FB523A1F10492AF816C7290DB71DEC8DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0058D384 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,0058688D,00000000,00000000,?,0058D32B,0058688D,00000000,00000000,00000000,?,0058D528,00000006,FlsSetValue), ref: 0058D3B6
GetLastError.KERNEL32(?,0058D32B,0058688D,00000000,00000000,00000000,?,0058D528,00000006,FlsSetValue,0059AC00,FlsSetValue,00000000,00000364,?,0058BA77), ref: 0058D3C2
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0058D32B,0058688D,00000000,00000000,00000000,?,0058D528,00000006,FlsSetValue,0059AC00,FlsSetValue,00000000), ref: 0058D3D0

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 0b9f9666705c15f25ea4313ca6b3167d9e13703c2e8c5a979daf1fc977246d2d
Instruction ID: dfb35961643bfef371391549f7c11c6817a5e891d620817ff6879c188e22910d
Opcode Fuzzy Hash: 0b9f9666705c15f25ea4313ca6b3167d9e13703c2e8c5a979daf1fc977246d2d
Instruction Fuzzy Hash: A701D436611226ABCB216B699C84A577FE8FB147A17120E20FD16E71C0DF20D80487F1

Uniqueness

Uniqueness Score: -1.00%

Function 0058E077 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0058B9A5: GetLastError.KERNEL32(?,005A50C4,00586E12,005A50C4,?,?,0058688D,?,?,005A50C4), ref: 0058B9A9
Part of subcall function 0058B9A5: _free.LIBCMT ref: 0058B9DC
Part of subcall function 0058B9A5: SetLastError.KERNEL32(00000000,?,005A50C4), ref: 0058BA1D
Part of subcall function 0058B9A5: _abort.LIBCMT ref: 0058BA23

Part of subcall function 0058E19E: _abort.LIBCMT ref: 0058E1D0
Part of subcall function 0058E19E: _free.LIBCMT ref: 0058E204

Part of subcall function 0058DE0B: GetOEMCP.KERNEL32(00000000,?,?,0058E094,?), ref: 0058DE36

_free.LIBCMT ref: 0058E0EF
_free.LIBCMT ref: 0058E125

Strings

p,Z, xrefs: 0058E119

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: p,Z
API String ID: 2991157371-423584262
Opcode ID: 274ee780de66ba67b417af2d6cec430c2af192fcf152e5fea3587b22064b061f
Instruction ID: fe72f5b55d7b45c004c8c1a852f362103d26880b56dc4b328a7e6ec2c77d1d4c
Opcode Fuzzy Hash: 274ee780de66ba67b417af2d6cec430c2af192fcf152e5fea3587b22064b061f
Instruction Fuzzy Hash: 8431843190420AEFDB10FBA9D44AAA97FF5BF81320F254499ED04AB291DBB25D41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00573105 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_00013240,?,00000000,?), ref: 00573129
SetThreadPriority.KERNEL32(00000000,00000000), ref: 00573170

Part of subcall function 00567BAD: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00567BD5

Strings

CreateThread failed, xrefs: 00573135

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: c8da62deb24e484e97e1cf0d8daf45080080572ea9e9896012c749a58a4db899
Instruction ID: 317652ede0dce6030c9722deaa6350d6968276fb08c3062dd93c91bcf26b2e18
Opcode Fuzzy Hash: c8da62deb24e484e97e1cf0d8daf45080080572ea9e9896012c749a58a4db899
Instruction Fuzzy Hash: 3A014E753047066FD3207F50EC85F667FE8FB55721F10012EF685571C0DAA06844E664

Uniqueness

Uniqueness Score: -1.00%

Function 005705C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00567BEB,?,00561436,00567BEB), ref: 005705F8
LoadStringW.USER32(00567BEB,?,00561436), ref: 0057060F

Strings

pPZ, xrefs: 005705D6

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: LoadString
String ID: pPZ
API String ID: 2948472770-2595575036
Opcode ID: c29e68bdacf5e925cdb4c43e9731b2124e9a819412b1dde9e23286363e4f6dc0
Instruction ID: e63420f3772460554fdc1a79290bfbeca949e01b9941be393931ae2d8e5ec513
Opcode Fuzzy Hash: c29e68bdacf5e925cdb4c43e9731b2124e9a819412b1dde9e23286363e4f6dc0
Instruction Fuzzy Hash: 7EF0F231100619FFCF111F56EC18CAB7FAAFF5A394B048025FD0886131E3328864EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0056B9BA Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,0056F306,00000001,?,?,?,00000000,00577564,?,?,?,?), ref: 0056B9DE
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0056BA25
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,0056F306,00000001,?,?,?), ref: 0056BA51

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 8b0b4fd867a4e0722c717f5fcbd41c3f7f05e9cffd61d8c46a7503bd53a8141d
Instruction ID: 69953897c70fc96ca29b3e44489c40bb6bf3fa0fa545b5cd89dfa2cf6934ed65
Opcode Fuzzy Hash: 8b0b4fd867a4e0722c717f5fcbd41c3f7f05e9cffd61d8c46a7503bd53a8141d
Instruction Fuzzy Hash: 6531C271208316AFEB14CF20D848B6E7BA5FF81715F044A1DF58197290DB75AD88CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0056BEE1 Relevance: 4.6, APIs: 3, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 0056E1EC: _wcslen.LIBCMT ref: 0056E1F2

CreateDirectoryW.KERNELBASE(?,00000000,?,?,00000000,0056BBD0,?,00000001,00000000,?,?), ref: 0056BF12
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,00000000,0056BBD0,?,00000001,00000000,?,?), ref: 0056BF45
GetLastError.KERNEL32(?,?,?,00000000,0056BBD0,?,00000001,00000000,?,?), ref: 0056BF62

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 03e271a001d423c568bca8107d900cc10e28fb6c24268b0264d41efe341e0342
Instruction ID: 034eca12191099efd94e06599b348902a0479d9e49d8a6b67c9d5fc6582249d0
Opcode Fuzzy Hash: 03e271a001d423c568bca8107d900cc10e28fb6c24268b0264d41efe341e0342
Instruction Fuzzy Hash: 8311E531200215AAFB11AB748D49BFEBF98BF19700F004465F901E71A1DB24DEC5CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0058DEE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0058DF08

Strings

, xrefs: 0058DF4D

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 8bac7f5fcaf4dbbf78f21867c242816be3be3464e917cabdf9850746bff225a3
Instruction ID: 93ce761210285666d660e90bb513b3a5ccbcdf9d769fc282ffe445620a17eec7
Opcode Fuzzy Hash: 8bac7f5fcaf4dbbf78f21867c242816be3be3464e917cabdf9850746bff225a3
Instruction Fuzzy Hash: 86411C7050428C9ADF229F148C89BF6BFF9FF45304F1408EDE99AA6142D275AA45DF20

Uniqueness

Uniqueness Score: -1.00%

Function 0058D5BC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,62E85006,00000001,?,000000FF), ref: 0058D62D

Strings

LCMapStringEx, xrefs: 0058D5CD, 0058D5D7

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 8058aa67d9b0ff674dff61e8070f883a3877c1e63f6dd9344ab47a8598d27036
Instruction ID: 70280902dabb9995266af1a4c8d717e8c03e27ad512c2abc666261056107434a
Opcode Fuzzy Hash: 8058aa67d9b0ff674dff61e8070f883a3877c1e63f6dd9344ab47a8598d27036
Instruction Fuzzy Hash: 4B01133250420DBBCF026F91DD0ADAE7FB6FF48710F014115FE09251A0C6328931ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 0058D55A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0058CBBF), ref: 0058D5A5

Strings

InitializeCriticalSectionEx, xrefs: 0058D56B, 0058D575

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: e9a789dc6e2d8a22ef9ba189d2794dc02ab3f768ad51a828f5cdb040adde9108
Instruction ID: 619247c9c842139ce7e8250e315a95bb34bb4527937035bb9b98d38cb033d39f
Opcode Fuzzy Hash: e9a789dc6e2d8a22ef9ba189d2794dc02ab3f768ad51a828f5cdb040adde9108
Instruction Fuzzy Hash: 33F0B43164121CBBCF016FA5DD06DAD7FA5FB58710B004126FC052A1A0CE354E10EBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0058D3FF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0058D43E

Strings

FlsAlloc, xrefs: 0058D410, 0058D41A

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 5b87f625ed62d8a2951f2a6392fd699c7bb033dcf3e0d5102697f77fff24812a
Instruction ID: e86c0da746a61a134c139c443982bf1e469a297e5653a54add9aeb697e712634
Opcode Fuzzy Hash: 5b87f625ed62d8a2951f2a6392fd699c7bb033dcf3e0d5102697f77fff24812a
Instruction Fuzzy Hash: C7E05530641208A78A007BA89C06D2DBFB6EB98720F41012AFC0622290C9B06E00E3EA

Uniqueness

Uniqueness Score: -1.00%

Function 005810A8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005810BA

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Strings

3So, xrefs: 005810A8, 005810B4

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3So
API String ID: 1269201914-1105799393
Opcode ID: 991fe697326c00d15a9060999b7c3ed6f3e390a15a0b0bd3b783d4c759e56075
Instruction ID: 7904a361ff24395c51743a3135d69f79ad24cdafc710f94ef793a6aeb1984e7a
Opcode Fuzzy Hash: 991fe697326c00d15a9060999b7c3ed6f3e390a15a0b0bd3b783d4c759e56075
Instruction Fuzzy Hash: 5EB092A1299101AD32143185AD0AC360A0CF0C4B103609A2EF804E0480A4402C890732

Uniqueness

Uniqueness Score: -1.00%

Function 0058E240 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0058DE0B: GetOEMCP.KERNEL32(00000000,?,?,0058E094,?), ref: 0058DE36

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0058E0D9,?,00000000), ref: 0058E2B4
GetCPInfo.KERNEL32(00000000,0058E0D9,?,?,?,0058E0D9,?,00000000), ref: 0058E2C7

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 41cfe34bd2484590dc8919650c624fa39a8a01ee740db09dcf46dc35a813559d
Instruction ID: 9eb3b65fffa249df70a682c112c871ba8afceec51aa2b6c3474bfeee2fbc460d
Opcode Fuzzy Hash: 41cfe34bd2484590dc8919650c624fa39a8a01ee740db09dcf46dc35a813559d
Instruction Fuzzy Hash: 905147709002069FDB21BF75C8866BBBFF5FF41300F14486ED896AB261DB35A945DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0056B45F Relevance: 3.1, APIs: 2, Instructions: 140COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,00000800,?,?,00000000,?,?,0056B43B,00000800,00000800,00000000,?,?,0056A31D,?), ref: 0056B5EB
GetLastError.KERNEL32(?,?,0056A31D,?,?,?,?,?,?,?,?), ref: 0056B5FA

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 19e2db81a1fe360727e76d58bc0709a9b77bee2064762eeed6b0872a67a64380
Instruction ID: ddf111a96352f4ad95d2a9dbff10e83f9c578055ea4e6a7c78652301acb9d7f3
Opcode Fuzzy Hash: 19e2db81a1fe360727e76d58bc0709a9b77bee2064762eeed6b0872a67a64380
Instruction Fuzzy Hash: 4441F671604345CBEB209F64D4849EA7BE5FFA8321F100A2DE846C3242FBB5DCC58B91

Uniqueness

Uniqueness Score: -1.00%

Function 0056B01E Relevance: 3.1, APIs: 2, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000000,00000000,00000002,00000000,00000000,?,00000000,?,?,?,0056B967,?,?,005687FD), ref: 0056B0A4
CreateFileW.KERNEL32(?,?,00000000,00000000,00000002,00000000,00000000,?,?,00000800,?,?,0056B967,?,?,005687FD), ref: 0056B0D4

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1a027c714621c5ac14078f35d8c5cd65826a83dcb445d7cd4284dd84c091b70e
Instruction ID: 446ba4a2f30ab86da176f6b0ca8cdb15f254f4b44edb47aea1c836115c45e92f
Opcode Fuzzy Hash: 1a027c714621c5ac14078f35d8c5cd65826a83dcb445d7cd4284dd84c091b70e
Instruction Fuzzy Hash: 67218C71504345AFE3309B25CC89BB7BBDCFB98320F004A1AF9A5C71D1D774A9888B62

Uniqueness

Uniqueness Score: -1.00%

Function 0056B7E2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?), ref: 0056B7FC
SetFileTime.KERNELBASE(?,?,?,?), ref: 0056B8B0

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: f49f9b6acb25e7f4245a8aa69c6baf2b712e8b39fc3d5a486a619870c7ce44ad
Instruction ID: 8166a79e1d67b0a306302768f528a90e10d74215134240eb08c3791da9a4a4c2
Opcode Fuzzy Hash: f49f9b6acb25e7f4245a8aa69c6baf2b712e8b39fc3d5a486a619870c7ce44ad
Instruction Fuzzy Hash: 3721E1312492429BE715DF64C895ABBBFE8BFA5304F08491DF4C5C7141D329E94CE762

Uniqueness

Uniqueness Score: -1.00%

Function 00561FB0 Relevance: 3.1, APIs: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00561FB7
_wcslen.LIBCMT ref: 00562052

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: H_prolog3_wcslen
String ID:
API String ID: 3746244732-0
Opcode ID: 2e20eced0b006186fe656fd88346aca2a6a8901e1532113035c643931260c5e8
Instruction ID: 462876af6d1586e8566f21be37ed0cbb772f49073846d3cd5d236660bdf26432
Opcode Fuzzy Hash: 2e20eced0b006186fe656fd88346aca2a6a8901e1532113035c643931260c5e8
Instruction Fuzzy Hash: 3821593590061AEFCF21AF94C899AEDBFB2BF48310F14442DF446B72A1CB355A51DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00586192 Relevance: 3.1, APIs: 2, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000001,005C60C8,?,?,?,00586386,00000004,InitializeCriticalSectionEx,00599624,InitializeCriticalSectionEx,00000000,?,0058613D,005C60C8,00000FA0), ref: 00586215
GetProcAddress.KERNEL32(00000000,?), ref: 0058621F

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID:
API String ID: 3013587201-0
Opcode ID: 353f377a5f06dc216c9a8750ec7068d7f21732c14d42f7c2c2222b72c5228b39
Instruction ID: e6d63a1d84585d6f7787b93aa7450bf43b9158cee693a9a2b52df85d31385bde
Opcode Fuzzy Hash: 353f377a5f06dc216c9a8750ec7068d7f21732c14d42f7c2c2222b72c5228b39
Instruction Fuzzy Hash: D011D0356001159FCF22EFA4EC848AA7BA5FF5536072501A9EE17EB211E730ED01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0056B8C0 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 0056B907
GetLastError.KERNEL32 ref: 0056B914

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0fddf8fb4c560de7e52a167ca58eefcac846b3adc015e03ac3ffeeaf5c4f5086
Instruction ID: b5e26164e33685d8f75013cc20f76c1173a237e6815b3de18c3215e6b886d49f
Opcode Fuzzy Hash: 0fddf8fb4c560de7e52a167ca58eefcac846b3adc015e03ac3ffeeaf5c4f5086
Instruction Fuzzy Hash: 7311A530A10705ABF7349629C889B667BE8BB45370F504B29E252D36D0E770ED85D750

Uniqueness

Uniqueness Score: -1.00%

Function 0058BB34 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0058BB55

Part of subcall function 0058BC8E: RtlAllocateHeap.NTDLL(00000000,?,?,?,00586A24,?,0000015D,?,?,?,?,00587F00,000000FF,00000000,?,?), ref: 0058BCC0

HeapReAlloc.KERNEL32(00000000,?,?,?,?,005A50C4,0056190A,?,?,00000007,?,?,?,00561476,?,00000000), ref: 0058BB91

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 576b6e5921c04601334b387acf4b9dfc48d7bf51b1a7c78f6f248374200d0cab
Instruction ID: 2cfa9f67a3e8e81ed963b8ab0b2c905983e3d5e3d1e315b7b7f0e0d6754c17a1
Opcode Fuzzy Hash: 576b6e5921c04601334b387acf4b9dfc48d7bf51b1a7c78f6f248374200d0cab
Instruction Fuzzy Hash: 5AF06231500616ABFB213A66AC05F6B3F5CBFC2BB2B154116FC55B61A5DF20DC0193A9

Uniqueness

Uniqueness Score: -1.00%

Function 0056C2E5 Relevance: 3.0, APIs: 2, Instructions: 38COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,?,00000001,?,0056BF5E,?,?), ref: 0056C305

Part of subcall function 0056DA1E: _wcslen.LIBCMT ref: 0056DA59

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0056BF5E,?,?), ref: 0056C334

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: eccad203ff4d17958eba3c2a40236dac529bb2e57812134973922a89091d9af2
Instruction ID: c252641821216ff76d3f6d317c3f8dc57c2e6616d1b4c995595be1f4cf34a5d1
Opcode Fuzzy Hash: eccad203ff4d17958eba3c2a40236dac529bb2e57812134973922a89091d9af2
Instruction Fuzzy Hash: A2F0903160121AEBDB00AF759C49AEE7BACFF19304F408496B945E7250DA31DE499B64

Uniqueness

Uniqueness Score: -1.00%

Function 0056BC65 Relevance: 3.0, APIs: 2, Instructions: 36fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,0056B14B,?,00000000,0056AF6E,6033248F,00000000,0059517A,000000FF,?,00568882,?,?), ref: 0056BC82

Part of subcall function 0056DA1E: _wcslen.LIBCMT ref: 0056DA59

DeleteFileW.KERNEL32(?,?,?,00000800,?,0056B14B,?,00000000,0056AF6E,6033248F,00000000,0059517A,000000FF,?,00568882,?), ref: 0056BCAE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: afd11b35c5b678691526fdee7a9eea6a3549ae7a39fbc1c10a90a2439600cf4f
Instruction ID: 2d53f4660c9ffac3e655d70da45d953901dc83cf22448a1855f8658388e0ee1a
Opcode Fuzzy Hash: afd11b35c5b678691526fdee7a9eea6a3549ae7a39fbc1c10a90a2439600cf4f
Instruction Fuzzy Hash: 78F0543560121A9BE700EF649D46EDE77ACAF19701F444066FA01E3141DF71EE8D9BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0058030B Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00580341

Part of subcall function 00564C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00564C13

SetDlgItemTextW.USER32(00000065,?), ref: 00580358

Part of subcall function 0057D864: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0057D875
Part of subcall function 0057D864: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0057D886
Part of subcall function 0057D864: IsDialogMessageW.USER32(00010458,?), ref: 0057D89A
Part of subcall function 0057D864: TranslateMessage.USER32(?), ref: 0057D8A8
Part of subcall function 0057D864: DispatchMessageW.USER32(?), ref: 0057D8B2

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: a9befe64af9391420c204f2cca1103b6ea705411760751ea90e9f48d17cb5a1a
Instruction ID: 94e0751d595af04c5771d71f1038c3cec1d79f473c851d653ec359f658905bf9
Opcode Fuzzy Hash: a9befe64af9391420c204f2cca1103b6ea705411760751ea90e9f48d17cb5a1a
Instruction Fuzzy Hash: 6BF0B47151020CABDB01FF69EC0EEEF7FACAF4E305F040052B605A3192DA349A059F65

Uniqueness

Uniqueness Score: -1.00%

Function 0056BCDD Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,0056BCD4,?,00568607,?), ref: 0056BCFA

Part of subcall function 0056DA1E: _wcslen.LIBCMT ref: 0056DA59

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,?,0056BCD4,?,00568607,?), ref: 0056BD24

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 026b422de1863b9c51d140f5e35f6a73bd284d3ca1802699dd10a4f01cd1597b
Instruction ID: 1f88673a6912d55eb5422f8e7d6dfbe3c8b8f8c3f973b0124bb3ab68ee860a41
Opcode Fuzzy Hash: 026b422de1863b9c51d140f5e35f6a73bd284d3ca1802699dd10a4f01cd1597b
Instruction Fuzzy Hash: 6DF0B4316002185BCB10EB789D49AEEBBBCFB4D760F010165FA01E7280DB709E499B94

Uniqueness

Uniqueness Score: -1.00%

Function 00573184 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000002,00000002,?,005731C7,0056D526), ref: 00573191
GetProcessAffinityMask.KERNEL32(00000000,?,005731C7), ref: 00573198

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: ebfd296402662950fec02bf0af5868064258151c8ad25ff1e8e4dfc9100275d6
Instruction ID: e7cb68b748da8354413e97f47048fdaf2ad8c20693b3b9bc1d30e1790213289f
Opcode Fuzzy Hash: ebfd296402662950fec02bf0af5868064258151c8ad25ff1e8e4dfc9100275d6
Instruction Fuzzy Hash: 82E0D872B00105679F0987A4AC198EB77DDFA54264310807AA507D3200FA34DE09F6A0

Uniqueness

Uniqueness Score: -1.00%

Function 005728AB Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005728D4
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00571309,Crypt32.dll,00000000,00571383,00000200,?,00571366,00000000,00000000,?), ref: 005728F4

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: d155d144a23349e581b9f206fc1b8f2f212e0fbd872bbf7d2503294c293c7ba1
Instruction ID: 974d5da13b8cf4287bf8dccaba1f40c701d5ed1d44d42ed690018e331bc2f0f5
Opcode Fuzzy Hash: d155d144a23349e581b9f206fc1b8f2f212e0fbd872bbf7d2503294c293c7ba1
Instruction Fuzzy Hash: 61F0B475A00209ABCB00EB64DC4DDDFB7BCEF89701F000466B605E3100CA74EA499B64

Uniqueness

Uniqueness Score: -1.00%

Function 0057CD3F Relevance: 3.0, APIs: 2, Instructions: 31comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,0059505D,000000FF), ref: 0057CD7D
OleUninitialize.OLE32(?,?,?,?,0059505D,000000FF), ref: 0057CD82

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: e89b97bccf9897b46cb8fa29cd8d1f0fa9127a905129303cddc556eba177a178
Instruction ID: d9f0d0cde85c81fe01d3f21245304e66f0dbe8c39f0e1cc0a9207a8f92f00157
Opcode Fuzzy Hash: e89b97bccf9897b46cb8fa29cd8d1f0fa9127a905129303cddc556eba177a178
Instruction Fuzzy Hash: D9F05E76604A44EFCB01DF19DC05F5AFBA8FB4DB20F04426AE816D37A0DB34A905CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0057C34D Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0057C36E
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0057C375

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: f69718df8e9c7a32e0b60c94d5751df3fb8bc509f294ebda66f5a81f03fa6ac9
Instruction ID: 1ff9c34d6bc51fc514182b0591f0ee251e8f650c8a9a0f87aa2a8946cc4876e5
Opcode Fuzzy Hash: f69718df8e9c7a32e0b60c94d5751df3fb8bc509f294ebda66f5a81f03fa6ac9
Instruction Fuzzy Hash: 7FE06D71400608EFCB10EF95C844B99BFF8FB05350F10C41FE89AA3200D270AE409B54

Uniqueness

Uniqueness Score: -1.00%

Function 005851AC Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005851CA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 005851D5

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 7f41f318f7957baa17299f2dbddb1170da9c78ca7ff2f5c09ccd50ace5867a62
Instruction ID: 202339e239de01dd1d67b5724d555529a62fd4a4785e62263a141fff224faabc
Opcode Fuzzy Hash: 7f41f318f7957baa17299f2dbddb1170da9c78ca7ff2f5c09ccd50ace5867a62
Instruction Fuzzy Hash: 9DD0A728544F0248CD1036B4280F76A2F40BA527B17B01A45EC61B65C1FE114940E711

Uniqueness

Uniqueness Score: -1.00%

Function 00561341 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00561356
ShowWindow.USER32(00000000), ref: 0056135D

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: f4aca1e1a53d353cc154c478c44866d3c6d3467087fac8d2988f6ab3f6ac4cc0
Instruction ID: e1dfd1c0757618291a8a534a16cbee9bde41f9089e53e776b6499574d6ee77ab
Opcode Fuzzy Hash: f4aca1e1a53d353cc154c478c44866d3c6d3467087fac8d2988f6ab3f6ac4cc0
Instruction Fuzzy Hash: F4C0123205CA08BECB010BB0DC09C2ABBA8ABA8212F19CA48F0B6C1060C239C014EF11

Uniqueness

Uniqueness Score: -1.00%

Function 00561B63 Relevance: 1.8, APIs: 1, Instructions: 311COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00561B6A

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 948048c1726853acf18c9e0464421fba53fe43cb58549024a0c3e7d61fb54336
Instruction ID: 5a93c9a94eba7870a9d8fabfe685ab292c8c0d6d6dafcb17b7ef25f6e342dbf3
Opcode Fuzzy Hash: 948048c1726853acf18c9e0464421fba53fe43cb58549024a0c3e7d61fb54336
Instruction Fuzzy Hash: 06C19D74A04A519BEF24CF2484887BD7FA5BF56310F1C04B9EC069B396CB359E44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0056147C Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00561483

Part of subcall function 00566AE8: __EH_prolog3.LIBCMT ref: 00566AEF

Part of subcall function 0056EE0F: __EH_prolog3.LIBCMT ref: 0056EE16

Part of subcall function 0056668F: __EH_prolog3.LIBCMT ref: 00566696

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 0af89743cad3b3c991aa6b815c1436a48aeb8a6e152b85c77d5ebd87e0a592d5
Instruction ID: 4e14d8d76db6ec5af8f33066e3a5e0b89de3fbe1fb597b9985b3f0e9c3c655c5
Opcode Fuzzy Hash: 0af89743cad3b3c991aa6b815c1436a48aeb8a6e152b85c77d5ebd87e0a592d5
Instruction Fuzzy Hash: DD4124B0A067818ECB14DF2994842D97FE2BF59300F0801BEEC5EDF28AD7715615CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00575617 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0057561E

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: eff89e2ec1b1cee26b06f9aa3613df4491185ccf738efb4e4ca35f619419151f
Instruction ID: 23ac9fd80424be54fbbdb166970b9f8ea5da51bebe0ddf717a031d63d7f3694c
Opcode Fuzzy Hash: eff89e2ec1b1cee26b06f9aa3613df4491185ccf738efb4e4ca35f619419151f
Instruction Fuzzy Hash: A22106B1E40A129BDB14FFB59C4965A7EACFB44314F44413AE909EB681F7B099008B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0058D2E8 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0058D348

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: e80ead7760b245cbd0ebb88a1480de8a38c5078be3e4d9dc3b52940490e0d8f6
Instruction ID: f8deb55fe4ccf2fb810c4ffcaf9eb82fb2160e84afacc3962db0be014edb3b5a
Opcode Fuzzy Hash: e80ead7760b245cbd0ebb88a1480de8a38c5078be3e4d9dc3b52940490e0d8f6
Instruction Fuzzy Hash: 3E110A33A006259B9F21BE2CEC4195E7BF5FB953607164A20FC15BB294DE30DC0197E2

Uniqueness

Uniqueness Score: -1.00%

Function 0058EAC9 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0058D786: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0058B9D3,00000001,00000364,?,0058688D,?,?,005A50C4), ref: 0058D7C7

_free.LIBCMT ref: 0058EB35

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction ID: 2d551ca2a061e00127d58734a10c2fe1e8625214310c852b86edf236827fdecd
Opcode Fuzzy Hash: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction Fuzzy Hash: 9C01D6722003456BE325DF69D88695AFFFDFB85370F25051DE995A32C0EA70A805C774

Uniqueness

Uniqueness Score: -1.00%

Function 0056AB81 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0056AB88

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 5d25f93540c246e659c1c170b229adfc9362d70b1773096a552146bdb66f1e94
Instruction ID: 326486b47bfd293fe5b9ec5d93efba04e904d031d087e47081e8647800ef13f7
Opcode Fuzzy Hash: 5d25f93540c246e659c1c170b229adfc9362d70b1773096a552146bdb66f1e94
Instruction Fuzzy Hash: E701C43AD0062A9BCF21EE64C896DBEBB72BF84700B014519FD02B7252CB308C018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0058D786 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0058B9D3,00000001,00000364,?,0058688D,?,?,005A50C4), ref: 0058D7C7

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 37dc854083b1c8b56b8ecd2ce9aa7e4a24d935378d83672b6c0edb0f42a67503
Instruction ID: e93d7a442767eb0483adc78ce5561a3ce20252497ca29e7104ddc43100e21686
Opcode Fuzzy Hash: 37dc854083b1c8b56b8ecd2ce9aa7e4a24d935378d83672b6c0edb0f42a67503
Instruction Fuzzy Hash: A9F0B432200621A6FB217B629C45B6B7FE9FF807A0F144012EC09F65DACA20DC0083F1

Uniqueness

Uniqueness Score: -1.00%

Function 0056668F Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00566696

Part of subcall function 005711A5: __EH_prolog3.LIBCMT ref: 005711AC

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: d5990222bcc5b2a55329d3ff01f64d066a21da1d6ea7d865fc2a40e054ade416
Instruction ID: 8e3061790c6b4984c9ec37f1a47c43ba629c76392cd6ed567933f7fb4e582008
Opcode Fuzzy Hash: d5990222bcc5b2a55329d3ff01f64d066a21da1d6ea7d865fc2a40e054ade416
Instruction Fuzzy Hash: 7E017C70805745CAD714FBB8915A6DDFFE4BFA0300F10444EA46E53292CFB42B04D722

Uniqueness

Uniqueness Score: -1.00%

Function 0058BC8E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00586A24,?,0000015D,?,?,?,?,00587F00,000000FF,00000000,?,?), ref: 0058BCC0

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b3da0a66d084a7c09be86ec89da696f4d99ceb6f12bb4c526cae3476033bcb89
Instruction ID: f102f2fc23103fea0e3297a973e0db1b8b4a7ba5ddff36ed3150a2ca344ce801
Opcode Fuzzy Hash: b3da0a66d084a7c09be86ec89da696f4d99ceb6f12bb4c526cae3476033bcb89
Instruction Fuzzy Hash: 2AE06D3520062396FB3137659C15B6B3E9CFFA13A0F190122EC06B61A2CF65CC0583E5

Uniqueness

Uniqueness Score: -1.00%

Function 0056AFD0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,0056AF75,6033248F,00000000,0059517A,000000FF,?,00568882,?,?), ref: 0056AFEB

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: dd0b0dd94a2d870c4399dc5538495a67618f90751b52ed1f2b51e2996a740ccb
Instruction ID: bb99fa279859f62b997906db76a7e0c0c7acaa50648c24d42ed36bf3e81c364d
Opcode Fuzzy Hash: dd0b0dd94a2d870c4399dc5538495a67618f90751b52ed1f2b51e2996a740ccb
Instruction Fuzzy Hash: 81F0BE70082B468EEB308A20C44C792BBE4BB12325F041B1EC0E3439E0D360A9CD9A42

Uniqueness

Uniqueness Score: -1.00%

Function 0056C37A Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0056C4A8: FindFirstFileW.KERNELBASE(?,?,00000000,?,?,?,0056C39F,000000FF,?,?,?,?,005687BC,?,?,00000000), ref: 0056C4E6
Part of subcall function 0056C4A8: FindFirstFileW.KERNEL32(?,00000000,?,?,00000800,?,?,0056C39F,000000FF,?,?,?,?,005687BC,?,?), ref: 0056C516
Part of subcall function 0056C4A8: GetLastError.KERNEL32(?,?,00000800,?,?,0056C39F,000000FF,?,?,?,?,005687BC,?,?,00000000,0000003A), ref: 0056C522

FindClose.KERNELBASE(00000000,000000FF,?,?,?,?,005687BC,?,?,00000000,0000003A,?,0000003A,00000802), ref: 0056C3A5

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: e1283396ac58ea9456967357342425a77422ecad4deefcf07c195d5d9e34b4f1
Instruction ID: f9d447a44f8cae680a82b9bf3ce205bfcb24e9b9631d6aa9efa9b7c21c6bb3b6
Opcode Fuzzy Hash: e1283396ac58ea9456967357342425a77422ecad4deefcf07c195d5d9e34b4f1
Instruction Fuzzy Hash: 66F08235008791AADA225BB498097D67FA07F66332F00CE4AF1FD53292C6B56498DB32

Uniqueness

Uniqueness Score: -1.00%

Function 00572EE4 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00572F19

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: e9136fbd11b13f6bf0a14193873f1ec20cb05f27e4a21bc66a64cf68856d5cc4
Instruction ID: 633146322ef29fe9f348d9795b8fcaa9b1c4019f98c4b5b6dba4c9b025811262
Opcode Fuzzy Hash: e9136fbd11b13f6bf0a14193873f1ec20cb05f27e4a21bc66a64cf68856d5cc4
Instruction Fuzzy Hash: 89D0C20168815215D6223325780EBBD1E4A7FC6321F084066B00C671939B4A0C4AB2A2

Uniqueness

Uniqueness Score: -1.00%

Function 0057C5B6 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 0057C5BC

Part of subcall function 0057C34D: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0057C36E

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: bb184948fac70443b701d804218a49dfe2ebbc7c187f1a67eea2f7faab0ba8dc
Instruction ID: 77587cf34faa2c427671f9213705c04c0ac0d99fdebad6e7ef46e5d641aa09d4
Opcode Fuzzy Hash: bb184948fac70443b701d804218a49dfe2ebbc7c187f1a67eea2f7faab0ba8dc
Instruction Fuzzy Hash: 08D0C730654209B7DF416B65DC0697E7ED9FB40340F00C4697D45D5151EEB2DA507A51

Uniqueness

Uniqueness Score: -1.00%

Function 0058017F Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 005801A4

Part of subcall function 0057D864: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0057D875
Part of subcall function 0057D864: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0057D886
Part of subcall function 0057D864: IsDialogMessageW.USER32(00010458,?), ref: 0057D89A
Part of subcall function 0057D864: TranslateMessage.USER32(?), ref: 0057D8A8
Part of subcall function 0057D864: DispatchMessageW.USER32(?), ref: 0057D8B2

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 0c47bf293a9062ca8885649ce2aae2d135a0a989f8610962095feb39a8adda19
Instruction ID: 5a9dc6f05dcff12a2f09b1f052d2bd6569450ac40b4034ddf9bbd9410c806ee5
Opcode Fuzzy Hash: 0c47bf293a9062ca8885649ce2aae2d135a0a989f8610962095feb39a8adda19
Instruction Fuzzy Hash: 48D09E35148300AADB012B52DD0AF1A7EB2BB9DB05F404554B288340F286629D25BF16

Uniqueness

Uniqueness Score: -1.00%

Function 00580A98 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 00580AC0

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 6ee1cc8cd5d22a72efdbf87de17fcfe0540de8a4c64f223cc5903dbaae1f387f
Instruction ID: bc5e4142032948fda2309eabad85e1782606aa685139128281dba6d99cbc7fa8
Opcode Fuzzy Hash: 6ee1cc8cd5d22a72efdbf87de17fcfe0540de8a4c64f223cc5903dbaae1f387f
Instruction Fuzzy Hash: 9CD0A930102B048DD284BBA08C8EB242A90B328308BC82404BC06B60D0E7A0ADCCA705

Uniqueness

Uniqueness Score: -1.00%

Function 0056B288 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,0056B18A,?,?,?,00000000,0056B662,?,?,00000000,?,?), ref: 0056B294

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f9488600538d114b031959a7e1f6f784cf9ae1a9b5f24e82e93de89aeb5ce525
Instruction ID: c4c29d71aba462ac247debe2a400f925370252779aaf48d48c971732016f105a
Opcode Fuzzy Hash: f9488600538d114b031959a7e1f6f784cf9ae1a9b5f24e82e93de89aeb5ce525
Instruction Fuzzy Hash: D2C01238400104969E709A2898A949C7BA2FE623A67B48294C028CA0A2C7238CCBFA00

Uniqueness

Uniqueness Score: -1.00%

Function 0058067C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e7ec3a61d937cf5ada3294832500fb283f0376becdd23f5347626bb487a94399
Instruction ID: 2bc4c951abae77f0e0a4c4bde2c06bea14df3c8f9ad3baebfad3b1ff1eaf9aa0
Opcode Fuzzy Hash: e7ec3a61d937cf5ada3294832500fb283f0376becdd23f5347626bb487a94399
Instruction Fuzzy Hash: F0B0128535D007BE315431855C07C3F0D0CF0C0B10332993EF804E00C0B4401C484231

Uniqueness

Uniqueness Score: -1.00%

Function 005806DD Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0da49aa09a4be72297b9370305f876f19c05ac0fe160ec3ce3013655581d3ddf
Instruction ID: 0c1217013c4a69cc76bcfb40503afa9d41599c68d84504db23b9cc47f2834bd4
Opcode Fuzzy Hash: 0da49aa09a4be72297b9370305f876f19c05ac0fe160ec3ce3013655581d3ddf
Instruction Fuzzy Hash: DCB09285259142AD32C8618A5C06D3E0948F0C4B10321992AF808D0180A44018884231

Uniqueness

Uniqueness Score: -1.00%

Function 005806D3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b049f1e0d93a2b995450df94b8a86fdb6c7651dc2e4a1f6c2596e0e9e5fc691e
Instruction ID: 51cf5538f109b31fd5a88d8a1d8f0658a761a9c3028cb800857a8778b23ae78d
Opcode Fuzzy Hash: b049f1e0d93a2b995450df94b8a86fdb6c7651dc2e4a1f6c2596e0e9e5fc691e
Instruction Fuzzy Hash: D2B09285259003AD318865895C06D3E0948F0C4B10321D82AF808D0180A44018484231

Uniqueness

Uniqueness Score: -1.00%

Function 005806C9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 017cd6efe2f97f0f0fea7ba7cb16285c1d84aecf87240ddaf779383ec174a017
Instruction ID: e3d7bd057e072a44c2a60b919ebb9407a6c49951f70c41c7843c3fdb5f7a97db
Opcode Fuzzy Hash: 017cd6efe2f97f0f0fea7ba7cb16285c1d84aecf87240ddaf779383ec174a017
Instruction Fuzzy Hash: B8B012C935D107AD318471899C07D3F0D4CF0C4B10331983EF808D01C0F4401C484331

Uniqueness

Uniqueness Score: -1.00%

Function 005806FB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8c52c2a4fff9438302e82ffe07c345086470835e7938a3ba85466887bdb4aba0
Instruction ID: bd24ed173fb0fda82d391841997eae01ec477824a004c44a355d83040b08d293
Opcode Fuzzy Hash: 8c52c2a4fff9438302e82ffe07c345086470835e7938a3ba85466887bdb4aba0
Instruction Fuzzy Hash: 46B09296259002AD318461895C06D3E0948F0C4B10321A82AF808D0080A44018484231

Uniqueness

Uniqueness Score: -1.00%

Function 005806F1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 10f83e7c02c34c547671c371f78301e690f1c0476240f565465e65e79a0e9bb6
Instruction ID: c50eef7f12f71cdfe477c5cdcd74e68e74c5106c4d8c689193451fb196ef1d22
Opcode Fuzzy Hash: 10f83e7c02c34c547671c371f78301e690f1c0476240f565465e65e79a0e9bb6
Instruction Fuzzy Hash: 1DB09285259002AD318861995C06D3E0948F0C4B10321982AF809D0180A44018484231

Uniqueness

Uniqueness Score: -1.00%

Function 005806E7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1192692c605eaba54644a5c396a33a8b0fa6430f76021d0328c020a18b4a082f
Instruction ID: 3de1478b2232cce7189661e8808f27e1ab1b34e82a8752819b5b50cf9ccf09c0
Opcode Fuzzy Hash: 1192692c605eaba54644a5c396a33a8b0fa6430f76021d0328c020a18b4a082f
Instruction Fuzzy Hash: 55B09285259002AD3188618A5D06D3E0948F0C4B10321982AF818D0180A440184D5231

Uniqueness

Uniqueness Score: -1.00%

Function 00580697 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5439e3535ec14fbfcc8103011a2cf66c8707f45afd92b62b386a675592a55f06
Instruction ID: b5adaee57b1705ecee8924096f6b8b6facba1b969f771923bdc4622a83fb8cdd
Opcode Fuzzy Hash: 5439e3535ec14fbfcc8103011a2cf66c8707f45afd92b62b386a675592a55f06
Instruction Fuzzy Hash: 06B0129535D403AD3184718A9D07D3F0D6CF0C4B103319A7EFC18D00C0F4401C494331

Uniqueness

Uniqueness Score: -1.00%

Function 005806B5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7ba1e8d881b570f63546d1c45a86a47aa6cf622eed6fbd4f0957f4e74318ce58
Instruction ID: 19072fc416c8ec10bddd0fd0820619acc9e079d65a588f5c40f9368b04852d65
Opcode Fuzzy Hash: 7ba1e8d881b570f63546d1c45a86a47aa6cf622eed6fbd4f0957f4e74318ce58
Instruction Fuzzy Hash: AEB0128935D203AD36C4718A9C07D3F0D5CF0C4B10331993EF808D01C0F4401C888331

Uniqueness

Uniqueness Score: -1.00%

Function 005806AB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 635f1f3a446f91f0a190e204cfd8471f97c558f94ad1e336fb81dd02aefdfc16
Instruction ID: cf9532355a436f810baf60c64f3187a21164c9eea7ceb7de7c4a7b6fc7a8826f
Opcode Fuzzy Hash: 635f1f3a446f91f0a190e204cfd8471f97c558f94ad1e336fb81dd02aefdfc16
Instruction Fuzzy Hash: 6FB09289259102AD318461899C06D3F0948F0C4B10321982AF808D0180A4402C484231

Uniqueness

Uniqueness Score: -1.00%

Function 005806A1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 50fb01e25900081cbf3b7a87e411154bc0155f15abc5a3ceda12411a2a932240
Instruction ID: 3b30c5e896dadc5faeec249a8471bc15aaac814e8eee5d18919e9fe6ecddc663
Opcode Fuzzy Hash: 50fb01e25900081cbf3b7a87e411154bc0155f15abc5a3ceda12411a2a932240
Instruction Fuzzy Hash: 03B0129536D103AD318471899C07D3F0D6CF0C4B10331993FF808D00C0F4401C484331

Uniqueness

Uniqueness Score: -1.00%

Function 0058075F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4f5f94ee7f272fb82c894d6480c5a5d778a7966595eb6acc9586cc38dda8cde1
Instruction ID: 923de5c22eac4c90609663957dda5f4229e1b7a1eb448f34295552cabe3b0736
Opcode Fuzzy Hash: 4f5f94ee7f272fb82c894d6480c5a5d778a7966595eb6acc9586cc38dda8cde1
Instruction Fuzzy Hash: 2EB09295259002AD3184618A5D06D3E0988F0C4B10321982AF818D0080A4401C494231

Uniqueness

Uniqueness Score: -1.00%

Function 00580719 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cafd4d7994d93805dca5d7e0c0f919fe4d2dd181c7dab50d37eba9bae448f923
Instruction ID: d87a029f68c3929d39dbb458f48d02d1faae03700e74714fa0059782f3cf721a
Opcode Fuzzy Hash: cafd4d7994d93805dca5d7e0c0f919fe4d2dd181c7dab50d37eba9bae448f923
Instruction Fuzzy Hash: BAB0129535D003AD3184718A5C07D3F0D4CF0C4B10331A83EF808D00C0F4401C484331

Uniqueness

Uniqueness Score: -1.00%

Function 0058070F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 73abcd8f3ac59be7ab5166985aed4ca3dd74899f32bb185a81c32993e595348b
Instruction ID: 2a0fbaf37f83c7ac31650bc002e5b5e14113cc9bcbce1803ff3eeffaae3ab496
Opcode Fuzzy Hash: 73abcd8f3ac59be7ab5166985aed4ca3dd74899f32bb185a81c32993e595348b
Instruction Fuzzy Hash: 3AB0129535D003AD3184718A5D07D3F0D4CF0C4B10331A83EFC18D00C0F4401D494331

Uniqueness

Uniqueness Score: -1.00%

Function 0058072D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d77fa88f4aa8937d8267a8db070bcae2574f2c8e055996f4dd6b53513c42499e
Instruction ID: 2c18c9da78f7c9f04ffca1072a0326efc977b1925c5a3036ec0b057e4e46136b
Opcode Fuzzy Hash: d77fa88f4aa8937d8267a8db070bcae2574f2c8e055996f4dd6b53513c42499e
Instruction Fuzzy Hash: 2BB0129535E103AD32C4728A5C07D3F0D4CF0C4B10331A93EF808D00C0F4405C884331

Uniqueness

Uniqueness Score: -1.00%

Function 005808CE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005808A7

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5c71c0e6b5ee82bb97d94cc33f65561862a779c5fb54bf9301ef1b300cdf4b1d
Instruction ID: efc3039afba7796f46c591eb11ebd875daa7ffb853eae5dab60515a75fd47146
Opcode Fuzzy Hash: 5c71c0e6b5ee82bb97d94cc33f65561862a779c5fb54bf9301ef1b300cdf4b1d
Instruction Fuzzy Hash: 09B012C239D105AC358871895C0AE3A1E4CF0C4B11330982EFC08E01C1E4401C880B31

Uniqueness

Uniqueness Score: -1.00%

Function 005808C4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005808A7

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 69eaffa4ff97a07391c3414aad89c7ad0fd41c36a22085526a23bc3cb4708bb8
Instruction ID: 07badf13de1d76084287ab9e544ad8245413878396f56ab631992e7fad16bbd7
Opcode Fuzzy Hash: 69eaffa4ff97a07391c3414aad89c7ad0fd41c36a22085526a23bc3cb4708bb8
Instruction Fuzzy Hash: A1B0128235D201AC3A88718A5C0AD3A1E5CF0C4B11330992EFC08E01C1E4401CCC4B31

Uniqueness

Uniqueness Score: -1.00%

Function 005808F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005808A7

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 44d27b64efbaa46748f888996f7cff1a40668b6abfd0e344b2cad36448061b01
Instruction ID: 7571c2ec5b98e70c2b3558704a2a075488a10a9cee5df1c733d946aeac420629
Opcode Fuzzy Hash: 44d27b64efbaa46748f888996f7cff1a40668b6abfd0e344b2cad36448061b01
Instruction Fuzzy Hash: 84B0128236D001AC358871889C0EE3A1E5CF0C4B113309A2FF808E00C1E4401C880B31

Uniqueness

Uniqueness Score: -1.00%

Function 005809EA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005809FC

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4f49100c80da7bbfbe4332031c1b6fa89c3286a2d4841b3a95cc110553333cb1
Instruction ID: a104d3c81683b066d9ae3fa7da976f165a52add35a1c86ca25336e50f7e7ad9d
Opcode Fuzzy Hash: 4f49100c80da7bbfbe4332031c1b6fa89c3286a2d4841b3a95cc110553333cb1
Instruction Fuzzy Hash: E8B012C739E002BC35443188EE0AC360E0CF8C0B28330D93EF810F00C2A8511C090731

Uniqueness

Uniqueness Score: -1.00%

Function 00580A70 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00580A5D

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0ae83b4f5a6c4635738ad2285e6d189018e672b746b3212a7619f9eae67499f5
Instruction ID: 71c76f0728704a37becb672609f2a9808151ed0007bc40f8436ce08e33b4dd34
Opcode Fuzzy Hash: 0ae83b4f5a6c4635738ad2285e6d189018e672b746b3212a7619f9eae67499f5
Instruction Fuzzy Hash: 51B0929129A101AC328861D99D16D360A88F0C4B10320A82AF804D0080A882180A4231

Uniqueness

Uniqueness Score: -1.00%

Function 00580A0F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005809FC

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b8498ab3d84e6cbf8668f1d08e9f22d320f74e91d2427681b89a2377adc412b9
Instruction ID: 9ac9c2ceebfb3bbcce74705e9da4c38b3b675f8f6442aa400b3d137a793d3417
Opcode Fuzzy Hash: b8498ab3d84e6cbf8668f1d08e9f22d320f74e91d2427681b89a2377adc412b9
Instruction Fuzzy Hash: C9B012C239D001AC35847198EE0AD370E4CF0C4B10330D93EF804F10C1E4411C0D0731

Uniqueness

Uniqueness Score: -1.00%

Function 00580A05 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005809FC

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7f21c296e911ed7ee5942d4c403623fe62daf8fce03faaa169dc1069842072b8
Instruction ID: 860b7aca179a95e2c866f4c570ac621b1a8e0a4cf06fd0a943a3477011546e37
Opcode Fuzzy Hash: 7f21c296e911ed7ee5942d4c403623fe62daf8fce03faaa169dc1069842072b8
Instruction Fuzzy Hash: D6B012C239D101AC36847199ED0AD360E4CF0C4B103309A3EF804F11C1E4411C4C0731

Uniqueness

Uniqueness Score: -1.00%

Function 00580A23 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005809FC

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 56dc6819f128eb2b7db9406a2f5446ef6697d4e28a4c4995604309a781a1d689
Instruction ID: 9a3395d13b1d1f4a85fb210b39a2876400b42fa1548c5aacaba569dfebcb43aa
Opcode Fuzzy Hash: 56dc6819f128eb2b7db9406a2f5446ef6697d4e28a4c4995604309a781a1d689
Instruction Fuzzy Hash: D5B09282399001AC35846188ED0AD360A58F0C4B10320992AF804E2081E44018080731

Uniqueness

Uniqueness Score: -1.00%

Function 00580A8E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00580A5D

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a3b85b5ad464f421150239071958cb3fb83c5782d714296d7516fb910ed004a4
Instruction ID: f95cc1876480ef6dc65258da385d660ff44047f16af869b22c892be822e0871a
Opcode Fuzzy Hash: a3b85b5ad464f421150239071958cb3fb83c5782d714296d7516fb910ed004a4
Instruction Fuzzy Hash: 07B0929129A101AC328865D89C16D360A88F0C4B10321A82AF804D1080A88118094231

Uniqueness

Uniqueness Score: -1.00%

Function 00580A84 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00580A5D

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4bd9bbbe1ccc387c1bdb6464fcbbf037fb1fa1df93ab29e000312a6c26fc9dc0
Instruction ID: 4f9476084ee5aecd5e8edb3ee4055c72c0567729fb251e93889241224dbc280e
Opcode Fuzzy Hash: 4bd9bbbe1ccc387c1bdb6464fcbbf037fb1fa1df93ab29e000312a6c26fc9dc0
Instruction Fuzzy Hash: 0AB012D13AE201FC33C871D9DC16D360E8CF0C4B10331A92EF804D00C0E8811C494331

Uniqueness

Uniqueness Score: -1.00%

Function 005806C4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7049ede4a35df810c919eb831ea4c704d187c1b1849646b98f7c09ed733fcfd2
Instruction ID: a957d871f9a013df02f0d2dd04eec421b2053a13096aae9199008731de2dd46f
Opcode Fuzzy Hash: 7049ede4a35df810c919eb831ea4c704d187c1b1849646b98f7c09ed733fcfd2
Instruction Fuzzy Hash: 20A0019A2AA543BD35997296AD1BC3F0A1CF4C4B65332AD2AF81AE40D1B88428995231

Uniqueness

Uniqueness Score: -1.00%

Function 0058075A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fccac6f66cd38c3a0badb786fc40307049e1aca7cf1173b743baba8c852b16aa
Instruction ID: a957d871f9a013df02f0d2dd04eec421b2053a13096aae9199008731de2dd46f
Opcode Fuzzy Hash: fccac6f66cd38c3a0badb786fc40307049e1aca7cf1173b743baba8c852b16aa
Instruction Fuzzy Hash: 20A0019A2AA543BD35997296AD1BC3F0A1CF4C4B65332AD2AF81AE40D1B88428995231

Uniqueness

Uniqueness Score: -1.00%

Function 00580750 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bc853ad55e1094b703a944e4874b13691a10ccc568eab1278acc09230d0e12d2
Instruction ID: a957d871f9a013df02f0d2dd04eec421b2053a13096aae9199008731de2dd46f
Opcode Fuzzy Hash: bc853ad55e1094b703a944e4874b13691a10ccc568eab1278acc09230d0e12d2
Instruction Fuzzy Hash: 20A0019A2AA543BD35997296AD1BC3F0A1CF4C4B65332AD2AF81AE40D1B88428995231

Uniqueness

Uniqueness Score: -1.00%

Function 00580746 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4edb97087785d3c8c12bad2eec240af55a0601510db4e5b6b770cc4cdee2aacd
Instruction ID: a957d871f9a013df02f0d2dd04eec421b2053a13096aae9199008731de2dd46f
Opcode Fuzzy Hash: 4edb97087785d3c8c12bad2eec240af55a0601510db4e5b6b770cc4cdee2aacd
Instruction Fuzzy Hash: 20A0019A2AA543BD35997296AD1BC3F0A1CF4C4B65332AD2AF81AE40D1B88428995231

Uniqueness

Uniqueness Score: -1.00%

Function 00580778 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 070d3217e5eb11cad7744a95bd06ee42401c34528c0bc2a6637edf847af4fa2f
Instruction ID: a957d871f9a013df02f0d2dd04eec421b2053a13096aae9199008731de2dd46f
Opcode Fuzzy Hash: 070d3217e5eb11cad7744a95bd06ee42401c34528c0bc2a6637edf847af4fa2f
Instruction Fuzzy Hash: 20A0019A2AA543BD35997296AD1BC3F0A1CF4C4B65332AD2AF81AE40D1B88428995231

Uniqueness

Uniqueness Score: -1.00%

Function 0058076E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c6b7c80e08a4cffa8ed88af8b82aae0e568f4d5de999382ca9b047fe8fc903b3
Instruction ID: a957d871f9a013df02f0d2dd04eec421b2053a13096aae9199008731de2dd46f
Opcode Fuzzy Hash: c6b7c80e08a4cffa8ed88af8b82aae0e568f4d5de999382ca9b047fe8fc903b3
Instruction Fuzzy Hash: 20A0019A2AA543BD35997296AD1BC3F0A1CF4C4B65332AD2AF81AE40D1B88428995231

Uniqueness

Uniqueness Score: -1.00%

Function 0058070A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4a986b08399da5741ea068f95bf46ce0606211d8363031e44a9ab25afc74cfa3
Instruction ID: a957d871f9a013df02f0d2dd04eec421b2053a13096aae9199008731de2dd46f
Opcode Fuzzy Hash: 4a986b08399da5741ea068f95bf46ce0606211d8363031e44a9ab25afc74cfa3
Instruction Fuzzy Hash: 20A0019A2AA543BD35997296AD1BC3F0A1CF4C4B65332AD2AF81AE40D1B88428995231

Uniqueness

Uniqueness Score: -1.00%

Function 0058073C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 180b85b1182dc62934e1bcb46e5dd3294e3f395ab796a2a6ec85b3b4b4f4867f
Instruction ID: a957d871f9a013df02f0d2dd04eec421b2053a13096aae9199008731de2dd46f
Opcode Fuzzy Hash: 180b85b1182dc62934e1bcb46e5dd3294e3f395ab796a2a6ec85b3b4b4f4867f
Instruction Fuzzy Hash: 20A0019A2AA543BD35997296AD1BC3F0A1CF4C4B65332AD2AF81AE40D1B88428995231

Uniqueness

Uniqueness Score: -1.00%

Function 00580728 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7a6a57d35d26a291403960ead3f427e93b76e41e7fd509a6d9610f61c389e863
Instruction ID: a957d871f9a013df02f0d2dd04eec421b2053a13096aae9199008731de2dd46f
Opcode Fuzzy Hash: 7a6a57d35d26a291403960ead3f427e93b76e41e7fd509a6d9610f61c389e863
Instruction Fuzzy Hash: 20A0019A2AA543BD35997296AD1BC3F0A1CF4C4B65332AD2AF81AE40D1B88428995231

Uniqueness

Uniqueness Score: -1.00%

Function 00580782 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0058068E

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d40cb3a6d1cb77dea76bba00ab5f69f002ecc741cf8fdcbcca509d99aabe7b95
Instruction ID: a957d871f9a013df02f0d2dd04eec421b2053a13096aae9199008731de2dd46f
Opcode Fuzzy Hash: d40cb3a6d1cb77dea76bba00ab5f69f002ecc741cf8fdcbcca509d99aabe7b95
Instruction Fuzzy Hash: 20A0019A2AA543BD35997296AD1BC3F0A1CF4C4B65332AD2AF81AE40D1B88428995231

Uniqueness

Uniqueness Score: -1.00%

Function 005808DD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005808A7

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 95f3569015a3b95e19fa880d01a65ce4ecba7978d8edf83baa285938f022ac70
Instruction ID: 359a5b12e8557a9ed092a84601c24ecdb42ab3376126a27681edfe77af57d9b1
Opcode Fuzzy Hash: 95f3569015a3b95e19fa880d01a65ce4ecba7978d8edf83baa285938f022ac70
Instruction Fuzzy Hash: 6CA00296259112BC355971555D06C3A1A1CF4C4B553319D1DF805D40C1644418895671

Uniqueness

Uniqueness Score: -1.00%

Function 005808F1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005808A7

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 85f278d83ec373accc72763d9231e40998be3fe10c0573dbd5198e67ce99a258
Instruction ID: 359a5b12e8557a9ed092a84601c24ecdb42ab3376126a27681edfe77af57d9b1
Opcode Fuzzy Hash: 85f278d83ec373accc72763d9231e40998be3fe10c0573dbd5198e67ce99a258
Instruction Fuzzy Hash: 6CA00296259112BC355971555D06C3A1A1CF4C4B553319D1DF805D40C1644418895671

Uniqueness

Uniqueness Score: -1.00%

Function 005808E7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005808A7

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5e95016b8ef31ff506e28ca4f3e6f2721e4c85b3a62b22d02220b2fa7ff4597e
Instruction ID: 359a5b12e8557a9ed092a84601c24ecdb42ab3376126a27681edfe77af57d9b1
Opcode Fuzzy Hash: 5e95016b8ef31ff506e28ca4f3e6f2721e4c85b3a62b22d02220b2fa7ff4597e
Instruction Fuzzy Hash: 6CA00296259112BC355971555D06C3A1A1CF4C4B553319D1DF805D40C1644418895671

Uniqueness

Uniqueness Score: -1.00%

Function 0058089A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005808A7

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5224052e8670d86e5330eb5accf7b40db4869dbda891210c7063a80c48526ba1
Instruction ID: 9c51cee8cd646076a4797c76aead0d10a2fefad8a4a34f28806fe9da839c64cc
Opcode Fuzzy Hash: 5224052e8670d86e5330eb5accf7b40db4869dbda891210c7063a80c48526ba1
Instruction Fuzzy Hash: 6AA002962551117C355971555D06C3A2A1CF4C0B15331996DF809E40C5644418895671

Uniqueness

Uniqueness Score: -1.00%

Function 005808BF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005808A7

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4b624e3a48d93b63f7314230add37f71f4e6e06e9dd281ecd4426e8ac275da77
Instruction ID: 359a5b12e8557a9ed092a84601c24ecdb42ab3376126a27681edfe77af57d9b1
Opcode Fuzzy Hash: 4b624e3a48d93b63f7314230add37f71f4e6e06e9dd281ecd4426e8ac275da77
Instruction Fuzzy Hash: 6CA00296259112BC355971555D06C3A1A1CF4C4B553319D1DF805D40C1644418895671

Uniqueness

Uniqueness Score: -1.00%

Function 005808B5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005808A7

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2fc1c62a5ccacbbe862bc6cd5ad3771aefc93a5a59159af6316f0634a9ae4fd6
Instruction ID: 359a5b12e8557a9ed092a84601c24ecdb42ab3376126a27681edfe77af57d9b1
Opcode Fuzzy Hash: 2fc1c62a5ccacbbe862bc6cd5ad3771aefc93a5a59159af6316f0634a9ae4fd6
Instruction Fuzzy Hash: 6CA00296259112BC355971555D06C3A1A1CF4C4B553319D1DF805D40C1644418895671

Uniqueness

Uniqueness Score: -1.00%

Function 00580A50 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00580A5D

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 242d163145e0b7f0099b25372698e21fb917441929e832d54aa9c977e144e4ac
Instruction ID: 89a81bf12d72332cdc7fbf77ee67a8a93a34ff8fbc4f52cb3bf76179f8eb8e14
Opcode Fuzzy Hash: 242d163145e0b7f0099b25372698e21fb917441929e832d54aa9c977e144e4ac
Instruction Fuzzy Hash: 7AA002D5296501BC354975D5DD1AD360B5DF4C0B15731A919F945E40C1788118495231

Uniqueness

Uniqueness Score: -1.00%

Function 00580A46 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005809FC

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6555ee5c1ea2cd701cc02bea2c57ba15d7bef89f4c6dd581313585407d003a93
Instruction ID: 13a4d98a09b5fc9f4b19c7c38db70b3f017791b4bf5238041b76bf358bf33b58
Opcode Fuzzy Hash: 6555ee5c1ea2cd701cc02bea2c57ba15d7bef89f4c6dd581313585407d003a93
Instruction Fuzzy Hash: C7A001D63AA102BC79897695EE5AC7A0A1DF4C4B65331AE2AF806E50C2A89128495331

Uniqueness

Uniqueness Score: -1.00%

Function 00580A7F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00580A5D

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1f6f83cf7fa58d7b4ed1b795f75900c83b6e9f99926fb87e447c43ee559e29ec
Instruction ID: f3e6f227a7fcdac2699e73c4116ee0f2b3f32622af3397c281c25c4fca875bad
Opcode Fuzzy Hash: 1f6f83cf7fa58d7b4ed1b795f75900c83b6e9f99926fb87e447c43ee559e29ec
Instruction Fuzzy Hash: 0BA002D529A502FC354975D5DD16C360A5DF4C4B55731AD19F845D40C1688118495231

Uniqueness

Uniqueness Score: -1.00%

Function 00580A6B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00580A5D

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 976a3a4e988e53b324f0e5deebe315a2f6bce3e5ffa617ef76ebe92ff46235da
Instruction ID: f3e6f227a7fcdac2699e73c4116ee0f2b3f32622af3397c281c25c4fca875bad
Opcode Fuzzy Hash: 976a3a4e988e53b324f0e5deebe315a2f6bce3e5ffa617ef76ebe92ff46235da
Instruction Fuzzy Hash: 0BA002D529A502FC354975D5DD16C360A5DF4C4B55731AD19F845D40C1688118495231

Uniqueness

Uniqueness Score: -1.00%

Function 00580A1E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005809FC

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 693c8f571d41774a930a918074ec28dc9bac17164a4e4dbfdaa7596dfc6963bb
Instruction ID: 13a4d98a09b5fc9f4b19c7c38db70b3f017791b4bf5238041b76bf358bf33b58
Opcode Fuzzy Hash: 693c8f571d41774a930a918074ec28dc9bac17164a4e4dbfdaa7596dfc6963bb
Instruction Fuzzy Hash: C7A001D63AA102BC79897695EE5AC7A0A1DF4C4B65331AE2AF806E50C2A89128495331

Uniqueness

Uniqueness Score: -1.00%

Function 00580A3C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005809FC

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5f2fa34cf4131b90bc21659326176b8f3ea9987f12af8ee656620f08d47d6608
Instruction ID: 13a4d98a09b5fc9f4b19c7c38db70b3f017791b4bf5238041b76bf358bf33b58
Opcode Fuzzy Hash: 5f2fa34cf4131b90bc21659326176b8f3ea9987f12af8ee656620f08d47d6608
Instruction Fuzzy Hash: C7A001D63AA102BC79897695EE5AC7A0A1DF4C4B65331AE2AF806E50C2A89128495331

Uniqueness

Uniqueness Score: -1.00%

Function 00580A32 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005809FC

Part of subcall function 00580D3A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00580DAD
Part of subcall function 00580D3A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00580DBE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2cc56ef8144b543fcca6cb8a6f08d1fdc29ecbabaa5733e12715ff8f9ca154c5
Instruction ID: 13a4d98a09b5fc9f4b19c7c38db70b3f017791b4bf5238041b76bf358bf33b58
Opcode Fuzzy Hash: 2cc56ef8144b543fcca6cb8a6f08d1fdc29ecbabaa5733e12715ff8f9ca154c5
Instruction Fuzzy Hash: C7A001D63AA102BC79897695EE5AC7A0A1DF4C4B65331AE2AF806E50C2A89128495331

Uniqueness

Uniqueness Score: -1.00%

Function 0057CBB6 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?), ref: 0057CBBA

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: c732182d698157bd68cd955a29eb0b80a4dcf6b575c2979c62974b8e4e4058bc
Instruction ID: 5e20fd4211508cd03c428ac34aa79f110667b086fc5da03749805a24c10d4501
Opcode Fuzzy Hash: c732182d698157bd68cd955a29eb0b80a4dcf6b575c2979c62974b8e4e4058bc
Instruction Fuzzy Hash: 06A011302002008B82000B328F0AA0EBAAAAFA2A00F02C02AA00280030CB328828FA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0057E560 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 240windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00561366: GetDlgItem.USER32(00000000,00003021), ref: 005613AA
Part of subcall function 00561366: SetWindowTextW.USER32(00000000,005965F4), ref: 005613C0

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0057E602
EndDialog.USER32(?,00000006), ref: 0057E615
GetDlgItem.USER32(?,0000006C), ref: 0057E631
SetFocus.USER32(00000000), ref: 0057E638
SetDlgItemTextW.USER32(?,00000065,?), ref: 0057E66C
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0057E69F
FindFirstFileW.KERNEL32(?,?), ref: 0057E6B5

Part of subcall function 0057CBC8: FileTimeToSystemTime.KERNEL32(?,?), ref: 0057CBEE
Part of subcall function 0057CBC8: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 0057CC05
Part of subcall function 0057CBC8: SystemTimeToFileTime.KERNEL32(?,?), ref: 0057CC19
Part of subcall function 0057CBC8: FileTimeToSystemTime.KERNEL32(?,?), ref: 0057CC2A
Part of subcall function 0057CBC8: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0057CC42
Part of subcall function 0057CBC8: GetTimeFormatW.KERNEL32(00000400,?,?,00000000,00000000,00000032), ref: 0057CC66
Part of subcall function 0057CBC8: _swprintf.LIBCMT ref: 0057CC85

_swprintf.LIBCMT ref: 0057E704

Part of subcall function 00564C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00564C13

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0057E717
FindClose.KERNEL32(00000000), ref: 0057E71E
_swprintf.LIBCMT ref: 0057E773
SetDlgItemTextW.USER32(?,00000068,?), ref: 0057E786
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0057E7A0
_swprintf.LIBCMT ref: 0057E7D9
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0057E7EC
_swprintf.LIBCMT ref: 0057E83C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0057E84F

Part of subcall function 0057D0AB: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0057D0E1
Part of subcall function 0057D0AB: GetNumberFormatW.KERNEL32(00000400,00000000,?,005A272C,?,?), ref: 0057D12A

Strings

-X, xrefs: 0057E68C
REPLACEFILEDLG, xrefs: 0057E59C
%s %s, xrefs: 0057E6F1, 0057E6FD, 0057E769, 0057E7CF, 0057E832

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Item$Time$Text$_swprintf$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusInfoLocalLocaleNumberSpecificWindow__vswprintf_c_l
String ID: %s %s$-X$REPLACEFILEDLG
API String ID: 3464475507-1360726122
Opcode ID: d5044c3d863a52503db3b099cd0ab0a42496d117821cdfcfd6b53c3e0f9f6d4f
Instruction ID: 93619fe32daea59b4f30f4ac588b45646e255304406ea510f7097f0b6f613bff
Opcode Fuzzy Hash: d5044c3d863a52503db3b099cd0ab0a42496d117821cdfcfd6b53c3e0f9f6d4f
Instruction Fuzzy Hash: A07194B2548348BEE3319B64EC4EFFF7BACBB8D700F044919B64DD2581D6715908AB62

Uniqueness

Uniqueness Score: -1.00%

Function 00567FD3 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 365fileCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0056807F
_wcslen.LIBCMT ref: 00568112

Part of subcall function 00568C95: GetCurrentProcess.KERNEL32(00000020,?), ref: 00568CB2
Part of subcall function 00568C95: GetLastError.KERNEL32 ref: 00568CF6
Part of subcall function 00568C95: CloseHandle.KERNEL32(?), ref: 00568D05

Part of subcall function 0056BC65: DeleteFileW.KERNELBASE(?,?,?,?,0056B14B,?,00000000,0056AF6E,6033248F,00000000,0059517A,000000FF,?,00568882,?,?), ref: 0056BC82
Part of subcall function 0056BC65: DeleteFileW.KERNEL32(?,?,?,00000800,?,0056B14B,?,00000000,0056AF6E,6033248F,00000000,0059517A,000000FF,?,00568882,?), ref: 0056BCAE

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 005681C1
CloseHandle.KERNEL32(00000000), ref: 005681DD
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000,?,?,?,?,?,?,?,6033248F,00000000), ref: 00568329

Part of subcall function 0056B7E2: FlushFileBuffers.KERNEL32(?), ref: 0056B7FC
Part of subcall function 0056B7E2: SetFileTime.KERNELBASE(?,?,?,?), ref: 0056B8B0

Part of subcall function 0056AFD0: FindCloseChangeNotification.KERNELBASE(?,?,?,0056AF75,6033248F,00000000,0059517A,000000FF,?,00568882,?,?), ref: 0056AFEB

Part of subcall function 0056C2E5: SetFileAttributesW.KERNELBASE(?,00000000,?,00000001,?,0056BF5E,?,?), ref: 0056C305
Part of subcall function 0056C2E5: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0056BF5E,?,?), ref: 0056C334

Strings

UNC\, xrefs: 005680D2
\??\, xrefs: 005680A1
SeCreateSymbolicLinkPrivilege, xrefs: 0056803E
SeRestorePrivilege, xrefs: 00568034

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: File$Close$AttributesCreateDeleteHandle_wcslen$BuffersChangeCurrentErrorFindFlushLastNotificationProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 243576179-3508440684
Opcode ID: db80690398f2bb5b9704f341a7cb5630df6cce309dc0a33db98974ccca14147b
Instruction ID: fe9c0d70bcdde1b73d92384a659470f0702bd30d04ca4d29510e29b85bdacae5
Opcode Fuzzy Hash: db80690398f2bb5b9704f341a7cb5630df6cce309dc0a33db98974ccca14147b
Instruction Fuzzy Hash: B0D186B1900249AFDB25DF64CC85BFE7BACBF44700F04461AFA55E7241EB74AA44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0058FF3E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00590084

Strings

1#QNAN, xrefs: 0059128A
1#INF, xrefs: 00591291
1#IND, xrefs: 0059127C
1#SNAN, xrefs: 00591283

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c130d0c1d07439312ec7f34c29a24de420d32c5f5ee4963668eefd1e145d6275
Instruction ID: a3eb4778514e1016679f3d33754389a9aee68bf4ba2e3b49d5c5db265fba9685
Opcode Fuzzy Hash: c130d0c1d07439312ec7f34c29a24de420d32c5f5ee4963668eefd1e145d6275
Instruction Fuzzy Hash: 4FC23871E046298FDF248E28DD447EABBB5FB84304F1559EAD84DE7280E775AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00563AB7 Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 677COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00563F3A

Strings

CMT, xrefs: 00564288
h%u, xrefs: 00563F2C
hc%u, xrefs: 00563F80

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _swprintf
String ID: CMT$h%u$hc%u
API String ID: 589789837-3282847064
Opcode ID: e5d0b375aa6ba91931ddee1eb33fb8ed8fea357f2bb6f35504f39bb8eba7118d
Instruction ID: 590aab423b46ef3c15bc0516fd2db0f93274af126dc6f3893b7a070b68b1a8dc
Opcode Fuzzy Hash: e5d0b375aa6ba91931ddee1eb33fb8ed8fea357f2bb6f35504f39bb8eba7118d
Instruction Fuzzy Hash: FE42F231A016459FDF24DF74C89ABEE7FA5BF55300F044479F84A9B282DB706A89CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00562FCB Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 830COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 005635C3

Part of subcall function 00573D10: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,6033248F,?,?,6033248F,00000001,0056DA04,00000000,6033248F,?,00010458,?,?), ref: 00573D2C

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0056370D

Strings

CMT, xrefs: 00563738

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1610651222-2756464174
Opcode ID: 9e6a36d50a0d2addfa0fcdcba2880db0e510b50a9a2523f8c1bbc5862375fdb7
Instruction ID: e5a7c4a2a5ae17e4796d0c68d5c55235c7732a6bb4083b698979c0d538a89802
Opcode Fuzzy Hash: 9e6a36d50a0d2addfa0fcdcba2880db0e510b50a9a2523f8c1bbc5862375fdb7
Instruction Fuzzy Hash: 0F621571A002458FDF19DF78C8996EE7FB1BF55300F08057EEC4A9B282DA709A45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00581FCA Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00581FD6
IsDebuggerPresent.KERNEL32 ref: 005820A2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005820C2
UnhandledExceptionFilter.KERNEL32(?), ref: 005820CC

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 75bda8276407cd64073b9767f591c29aac9d7812e9f0e5230a044e4bc88a7156
Instruction ID: b32bbdcfa89df87e21fb2f72eae7d3a2a84629fe21f4d870af078ec2147e0fd1
Opcode Fuzzy Hash: 75bda8276407cd64073b9767f591c29aac9d7812e9f0e5230a044e4bc88a7156
Instruction Fuzzy Hash: A2312975D05219DBDB20EFA4D989BCCBBB8BF18300F1040AAE44DAB250EB715A88DF04

Uniqueness

Uniqueness Score: -1.00%

Function 00580B80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00580AC5,0000001C,00580CBA,00000000,?,?,?,?,?,?,?,00580AC5,00000004,005C5D24,00580D4A), ref: 00580B91
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00580AC5,00000004,005C5D24,00580D4A), ref: 00580BAC

Strings

D, xrefs: 00580BA0

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: af93423289846a22b8b44618c190bcc6fa9c97a8f24770c87fe175ccb9d0fd5a
Instruction ID: 58ac0acc1e4b47f8e62841aca6f5aa49c656947ae7676e129ef4e5e240d2a9c1
Opcode Fuzzy Hash: af93423289846a22b8b44618c190bcc6fa9c97a8f24770c87fe175ccb9d0fd5a
Instruction Fuzzy Hash: 5401F7326001096FCB14EF29DC05FEE7BA9AFC4329F0CC125AD59E7284D634E809C780

Uniqueness

Uniqueness Score: -1.00%

Function 0058647F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00586577
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00586581
UnhandledExceptionFilter.KERNEL32(-00000325,?,?,?,?,?,00000000), ref: 0058658E

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 480fdadae2927f4f3a43e653e00deadb2e9648d2e1115dde83a85bb5623f2c67
Instruction ID: 9aa19ff20b3b2de3ca6521afea0994c76c991f826a02e6a8bb36e4e0855a6200
Opcode Fuzzy Hash: 480fdadae2927f4f3a43e653e00deadb2e9648d2e1115dde83a85bb5623f2c67
Instruction Fuzzy Hash: 4031C4759012299BCB21EF68DD8979CBBB8BF58310F5041DAE81CA7261EB309F85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0058D998 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 0058DB2B

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: d18e281b06335db0bca4d4f64f855bdbd5972f2109ac44930ae8eb3042429477
Instruction ID: 17ce1fdae6ed9e15bd1f0520cabb19c9c2d23f4d70803ae4cef31e81a7597b58
Opcode Fuzzy Hash: d18e281b06335db0bca4d4f64f855bdbd5972f2109ac44930ae8eb3042429477
Instruction Fuzzy Hash: 4231C7719002496FCB28AE79CC89EFB7FFDEB85314F144198F859E7291E6309D448B60

Uniqueness

Uniqueness Score: -1.00%

Function 0058FA90 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce33ea9f4ec23801448980fb748551bc40d278e625499f9c7663d63746eea6e2
Instruction ID: 627777dc45f809ab894674ea8f9873ba5133b381c005e062bf493ed18b22de57
Opcode Fuzzy Hash: ce33ea9f4ec23801448980fb748551bc40d278e625499f9c7663d63746eea6e2
Instruction Fuzzy Hash: 8C021B71E012199BDF14DFA9C8806ADBBF5FF88324F25826AD919F7345D730AE418B90

Uniqueness

Uniqueness Score: -1.00%

Function 0057D0AB Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0057D0E1
GetNumberFormatW.KERNEL32(00000400,00000000,?,005A272C,?,?), ref: 0057D12A

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: abd85328a920bb2afe11a03e6135a3f998d25f2d7c49a105afb28ba2470842b8
Instruction ID: ebbe6ab8f939f0561a46995318f603c4c105869c3f6c5846e397b93a6a0fe16b
Opcode Fuzzy Hash: abd85328a920bb2afe11a03e6135a3f998d25f2d7c49a105afb28ba2470842b8
Instruction Fuzzy Hash: 15115B75210308AFD711DF64EC46FAA77BCFF69700F00842AF905E7291D670AA49EB65

Uniqueness

Uniqueness Score: -1.00%

Function 00567BFF Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00567D6C,?,00000400), ref: 00567BFF
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00567C20

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 270e58a25a51675bfb95b32f400c8624036645fb7c838b83cf0151b860f90236
Instruction ID: fbba2631fd1381062f034c347f98d4ddd9f0494a63075ebbfbc02e0fe45bf1e7
Opcode Fuzzy Hash: 270e58a25a51675bfb95b32f400c8624036645fb7c838b83cf0151b860f90236
Instruction Fuzzy Hash: 60D0C771349304BFFA110A604C4AF2A7B59BB59B55F15C805B755D60E0D7709428F619

Uniqueness

Uniqueness Score: -1.00%

Function 00594044 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0059403F,?,?,00000008,?,?,00593CDF,00000000), ref: 00594271

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 4a9bfb744a409aa3cbef2d2aca73a3d8c43614e946e3070d0d56bb6307abc83e
Instruction ID: ce7e19502bd66b7faf1776a63699004f4524cf885ca61f445d28ceffa8445544
Opcode Fuzzy Hash: 4a9bfb744a409aa3cbef2d2aca73a3d8c43614e946e3070d0d56bb6307abc83e
Instruction Fuzzy Hash: 6CB119356206099FDB19CF28C48AB657FA0FF45365F298658E899CF2A1C335ED92CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0056D076 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0056D0A7

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1b7885071024cfff294fe7e89ede597de66662dc2c03a746a4351b24ecdebe45
Instruction ID: a441d4dc20ea1bf87e7bf79cda39f17081c57b47f017d7847d8475e14f3eb21c
Opcode Fuzzy Hash: 1b7885071024cfff294fe7e89ede597de66662dc2c03a746a4351b24ecdebe45
Instruction Fuzzy Hash: 19014B75A00608CBDB24CF68EC89A9D7BB1BB69314F204619DA1A97391EB34A90DDF50

Uniqueness

Uniqueness Score: -1.00%

Function 00564C6E Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

gj, xrefs: 00564D3E

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: fd5c4d362bb4d62ed5dd7a11d4b93ea8e764872f4cdc141aae695097d684401c
Instruction ID: d99e435b79e0fb44b57914f4abce81113cd59e7994277113010424dd63495479
Opcode Fuzzy Hash: fd5c4d362bb4d62ed5dd7a11d4b93ea8e764872f4cdc141aae695097d684401c
Instruction Fuzzy Hash: 9CD128B2A083458FC754CF6AD88065AFBE1FFC9308F55492EE998D7301D734A959CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0058215D Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00022170,00581BC5), ref: 00582162

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bc002bc9519cf912aa771709272cc8bb1863114c7af33140c05978a76568d2f7
Instruction ID: 0248015e7670ccc1aa2792a56a942865a5b663a52348cab268cd7f8aec1a9540
Opcode Fuzzy Hash: bc002bc9519cf912aa771709272cc8bb1863114c7af33140c05978a76568d2f7
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 005727A9 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

, xrefs: 005727DC

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 934ccf0cd4b67d897cb7c2438ec395f92651c0feaeced376863ec7c5dca47e2e
Instruction ID: f8a2b0082f54f64715febdecaf724f1d543d7367941a7d2d00656f393b9dbfc7
Opcode Fuzzy Hash: 934ccf0cd4b67d897cb7c2438ec395f92651c0feaeced376863ec7c5dca47e2e
Instruction Fuzzy Hash: 2C113AB19047069BD72C8F69A95676ABBE4FB00314F20C82ED4AAE2281D371A540EB41

Uniqueness

Uniqueness Score: -1.00%

Function 0058E680 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0058E680

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 231fdede450ba7f764c4ba806e85109f300d29be0bc0439eeb6196603b3c4e56
Instruction ID: c4c676a9b790ed47f908b61ea984a9841c7d3e7758632e3916c25b76f5ccf8c7
Opcode Fuzzy Hash: 231fdede450ba7f764c4ba806e85109f300d29be0bc0439eeb6196603b3c4e56
Instruction Fuzzy Hash: 7DA011302002008F83008F32AA082083AE8EA22280302802AA00AC0220EA2A8228BF00

Uniqueness

Uniqueness Score: -1.00%

Function 005782D0 Relevance: .8, Instructions: 807COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c3c98ec23a744960941777bc03b1281d3b488c6a7f7634cefa33c0df39adee
Instruction ID: 110dccea9329268fb45a5b6a651509038834663ff319137b43ed535309d7ea8f
Opcode Fuzzy Hash: 90c3c98ec23a744960941777bc03b1281d3b488c6a7f7634cefa33c0df39adee
Instruction Fuzzy Hash: B8623331644B859FCB29CF28D8946BA7FE1BF91304F18C96DD89E8B342DB30A945E711

Uniqueness

Uniqueness Score: -1.00%

Function 0057976F Relevance: .8, Instructions: 781COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e008b3fe25645c420bb524d8f5ec445355e06715b0fa383b64c6e5b3b3f0fe45
Instruction ID: 1c4a358ec753d9d74675d46225618c800a9e15fc295486364e4ad8d37635e3d0
Opcode Fuzzy Hash: e008b3fe25645c420bb524d8f5ec445355e06715b0fa383b64c6e5b3b3f0fe45
Instruction Fuzzy Hash: D062C4716082469FCB19CF28D4905A8BFE1BF95304F08C56DEC9D8B346D734E945EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00571476 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b613aa6936206879556b4b98a40ab473639d5810861dad884f2e1ee316ea20b
Instruction ID: 5b3eb530201420ab9883242293f8d3de7813b86f973954f5736a87256d854254
Opcode Fuzzy Hash: 7b613aa6936206879556b4b98a40ab473639d5810861dad884f2e1ee316ea20b
Instruction Fuzzy Hash: 59525B726087018FC718CF19C891A6AF7E1FFCC304F498A2DE9959B255D734EA19CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00579111 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ea20011ace4b16a9fb2f361c0749c8a9162b95d96fec11e6352733853cb0b8
Instruction ID: 694cfe88fe58fab5bb8c39cfa89d3053910bb0975f75c520c752765c6c92b216
Opcode Fuzzy Hash: 34ea20011ace4b16a9fb2f361c0749c8a9162b95d96fec11e6352733853cb0b8
Instruction Fuzzy Hash: C61204B06147068FC728CF28D494BB9BBE1FF84304F10892EE99BC7681D378A995DB55

Uniqueness

Uniqueness Score: -1.00%

Function 0056E394 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ee176bc2e466c92e161cc9e29ea8fc5051119d69197c3a3f2f5a670d0181b84
Instruction ID: 558af663f9a10418c2e0f902c3f4e8f0a8d23d2ec3dc79a28250027b0e9b850d
Opcode Fuzzy Hash: 1ee176bc2e466c92e161cc9e29ea8fc5051119d69197c3a3f2f5a670d0181b84
Instruction Fuzzy Hash: 80F17979A0A3528FC724CF28C58A62ABFE5FFD9704F144A2EE485D7252D730E905CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00570949 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d43532d6e86dd4cd3941f3ecb8292771172016e56662b51e77c1badd920e11
Instruction ID: 1ed5e19f4e2cee11672d2bae777a836dca4a7fb2ff3b4e20084a93fb717f0acc
Opcode Fuzzy Hash: 48d43532d6e86dd4cd3941f3ecb8292771172016e56662b51e77c1badd920e11
Instruction Fuzzy Hash: 16E148749183918FC344CF29D49042BBBF0BB9A300F4A495EF9D497352D334EA59DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 005760F7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24092efe62d424cd3216e4ebe9e7bacb40e96a48e43bb28165a4c3ae8af820e3
Instruction ID: df62250a809e9bda553f8955006bc36ea1ee12bda581e349f69535f05ffb27e0
Opcode Fuzzy Hash: 24092efe62d424cd3216e4ebe9e7bacb40e96a48e43bb28165a4c3ae8af820e3
Instruction Fuzzy Hash: A0916AB0204B468BD724EF68E895BFA7FD5BB90304F104C2DE59F87282EB749544E751

Uniqueness

Uniqueness Score: -1.00%

Function 00576445 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4cca48a9374fd1daa150efee777656cfe635c97c04d9d71bcc5fab648253d3
Instruction ID: 95f8f50aff059ad56ac60a6a14939f99459d59bc2b7b6297d8bf533b239c9cc2
Opcode Fuzzy Hash: 7f4cca48a9374fd1daa150efee777656cfe635c97c04d9d71bcc5fab648253d3
Instruction Fuzzy Hash: 84816F717047424FDB24EE28E4C1BBD7FD5BBD4304F50883DE98E8B282DA708884A795

Uniqueness

Uniqueness Score: -1.00%

Function 00587967 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e55466e6450d3e1f8b181c6fc235256c9e8eb33070c9ff6d95d1ccc00834e22
Instruction ID: bd1da3ffb284800f8c26f6398c0bf1942c95001306ab55a9028aa9796a521759
Opcode Fuzzy Hash: 1e55466e6450d3e1f8b181c6fc235256c9e8eb33070c9ff6d95d1ccc00834e22
Instruction Fuzzy Hash: B5616D7164C60D66DE3CBA288859BBE6F99FB8D700F34081AEC83FB281E511DE818355

Uniqueness

Uniqueness Score: -1.00%

Function 00587738 Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: b1143ef3fa5f866a5ca2782c604b22519661b7621502cd4100c8c321083aed30
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 8451886160C64E57DB38B968845E7BE2F85FB5D300F380919DC82F7282D615ED02CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00570FAC Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb8474eac3346fd6fa087a8c0c25b53bdfde2b1fb4f2657615dc0dc0a1de3c4
Instruction ID: 71441d52952ef93da451957a75f2ccdd8c4c265f6e664406614a03b368f7f691
Opcode Fuzzy Hash: ffb8474eac3346fd6fa087a8c0c25b53bdfde2b1fb4f2657615dc0dc0a1de3c4
Instruction Fuzzy Hash: 8D5114315083D64FC711DF3C94884AEBFE0BEDA314F4A8999E4D94B242D221E68ADB56

Uniqueness

Uniqueness Score: -1.00%

Function 00572125 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3174f13cfea80075fb98e3fcfac22e5a3fe9995f15e96e7859fee2abfc45b684
Instruction ID: 20a04b318711b6f621b75fea4f472d66b86111f79d777765d574a3bcaa749705
Opcode Fuzzy Hash: 3174f13cfea80075fb98e3fcfac22e5a3fe9995f15e96e7859fee2abfc45b684
Instruction Fuzzy Hash: A451E1B1A087119FC748CF19D88055AF7E1FF88314F058A2EE899E3341DB30E959CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00575E86 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a36805445e229c2b90d29c9fa108318b87a70c956e41b8f0a663b46aa5c9b3d3
Instruction ID: a15e1dde5828109a5f38a1a4cfd6e4c0f2b61f6689cdbd25b60b76a3cb80252f
Opcode Fuzzy Hash: a36805445e229c2b90d29c9fa108318b87a70c956e41b8f0a663b46aa5c9b3d3
Instruction Fuzzy Hash: 7E31DEB1614B168FCB14EF28D85116EBFE0FB95300F14892DE89AD7342D774E909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00570244 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 240COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00570284

Part of subcall function 00564C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00564C13

Part of subcall function 00573F47: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0056F801,00000000,00000000,?,005A5070,?,0056F801,?,?,00000050,?), ref: 00573F64

_strlen.LIBCMT ref: 005702A5
SetDlgItemTextW.USER32(?,005A2274,?), ref: 005702FE
GetWindowRect.USER32(?,?), ref: 00570334
GetClientRect.USER32(?,?), ref: 00570340
GetWindowLongW.USER32(?,000000F0), ref: 005703EB
GetWindowRect.USER32(?,?), ref: 0057041B
SetWindowTextW.USER32(?,?), ref: 0057044A
GetSystemMetrics.USER32(00000008), ref: 00570452
GetWindow.USER32(?,00000005), ref: 0057045D
GetWindowRect.USER32(00000000,?), ref: 0057048D
GetWindow.USER32(00000000,00000002), ref: 005704FF

Strings

$%s:, xrefs: 0057026D
d, xrefs: 00570360
CAPTION, xrefs: 00570432
t"Z, xrefs: 005702B9

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d$t"Z
API String ID: 2407758923-929387701
Opcode ID: ab6429c099eeb5975869c41a0fb13527a1c694386bb8855095ea251c600bda5a
Instruction ID: 8c5aac61396c76c8f28e0c83f0164e9b8224f4d44d762ca9f908b54dddc637cb
Opcode Fuzzy Hash: ab6429c099eeb5975869c41a0fb13527a1c694386bb8855095ea251c600bda5a
Instruction Fuzzy Hash: 6D819872608305AFD714DF68DD89E6FBBE9FB88704F04591DFA8893290D634A908DB52

Uniqueness

Uniqueness Score: -1.00%

Function 0058F172 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0058F1B6

Part of subcall function 0058ED51: _free.LIBCMT ref: 0058ED6E
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058ED80
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058ED92
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058EDA4
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058EDB6
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058EDC8
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058EDDA
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058EDEC
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058EDFE
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058EE10
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058EE22
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058EE34
Part of subcall function 0058ED51: _free.LIBCMT ref: 0058EE46

_free.LIBCMT ref: 0058F1AB

Part of subcall function 0058BAFA: RtlFreeHeap.NTDLL(00000000,00000000,?,0058EEE6,?,00000000,?,00000000,?,0058EF0D,?,00000007,?,?,0058F30A,?), ref: 0058BB10
Part of subcall function 0058BAFA: GetLastError.KERNEL32(?,?,0058EEE6,?,00000000,?,00000000,?,0058EF0D,?,00000007,?,?,0058F30A,?,?), ref: 0058BB22

_free.LIBCMT ref: 0058F1CD
_free.LIBCMT ref: 0058F1E2
_free.LIBCMT ref: 0058F1ED
_free.LIBCMT ref: 0058F20F
_free.LIBCMT ref: 0058F222
_free.LIBCMT ref: 0058F230
_free.LIBCMT ref: 0058F23B
_free.LIBCMT ref: 0058F273
_free.LIBCMT ref: 0058F27A
_free.LIBCMT ref: 0058F297
_free.LIBCMT ref: 0058F2AF

Strings

h)Z, xrefs: 0058F25E

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: h)Z
API String ID: 161543041-1987929227
Opcode ID: af969559e64fb8605b596966623a50e6a85ad93f2beb9a450319cec7bb935999
Instruction ID: ee7121c24eb81b30601c1a90fe0c3e86829165b5f2058768d4efa1790092ef8d
Opcode Fuzzy Hash: af969559e64fb8605b596966623a50e6a85ad93f2beb9a450319cec7bb935999
Instruction Fuzzy Hash: CD313935600602DFEB24FA79D84AB9A7BE9FF84310F204529E84AF7251DF71AD90CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0057F9EE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0057FA20
GetClassNameW.USER32(00000000,?,00000800), ref: 0057FA4C

Part of subcall function 00574168: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,0056E084,00000000,.exe,?,?,00000800,?,?,?,0057AD5D), ref: 0057417E

GetWindowLongW.USER32(00000000,000000F0), ref: 0057FA68
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0057FA7F
GetObjectW.GDI32(00000000,00000018,?), ref: 0057FA93
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0057FABC
DeleteObject.GDI32(00000000), ref: 0057FAC3
GetWindow.USER32(00000000,00000002), ref: 0057FACC

Strings

STATIC, xrefs: 0057FA52

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 5e15452dc667466abaf11c75e6a007dbb14cd5e210dbbac42bed93bb89270c50
Instruction ID: 577b079792c73999456d0a7acd730170ea9c49ac930060bacf47fdd145bbf288
Opcode Fuzzy Hash: 5e15452dc667466abaf11c75e6a007dbb14cd5e210dbbac42bed93bb89270c50
Instruction Fuzzy Hash: 52214832544B117FE620EB30AC4EFAF3F9CBF98700F044424F949A6091DB708905AFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0058B8B1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0058B8C5

Part of subcall function 0058BAFA: RtlFreeHeap.NTDLL(00000000,00000000,?,0058EEE6,?,00000000,?,00000000,?,0058EF0D,?,00000007,?,?,0058F30A,?), ref: 0058BB10
Part of subcall function 0058BAFA: GetLastError.KERNEL32(?,?,0058EEE6,?,00000000,?,00000000,?,0058EF0D,?,00000007,?,?,0058F30A,?,?), ref: 0058BB22

_free.LIBCMT ref: 0058B8D1
_free.LIBCMT ref: 0058B8DC
_free.LIBCMT ref: 0058B8E7
_free.LIBCMT ref: 0058B8F2
_free.LIBCMT ref: 0058B8FD
_free.LIBCMT ref: 0058B908
_free.LIBCMT ref: 0058B913
_free.LIBCMT ref: 0058B91E
_free.LIBCMT ref: 0058B92C

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9900495e5dc5e45cf7d4c990e14d7a6ac9996c83fd142f8729f139987b641765
Instruction ID: 992585b11a72e4dfe5e0ed667107bc8d049fc063d04482b269e3780381a7f887
Opcode Fuzzy Hash: 9900495e5dc5e45cf7d4c990e14d7a6ac9996c83fd142f8729f139987b641765
Instruction Fuzzy Hash: D711937A100149AFDB05FF59C996CD93FB9FF84350B0180A5FE099B222DB71EA519B80

Uniqueness

Uniqueness Score: -1.00%

Function 00585451 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00585570
___TypeMatch.LIBVCRUNTIME ref: 0058567E
_UnwindNestedFrames.LIBCMT ref: 005857D0
CallUnexpected.LIBVCRUNTIME ref: 005857EB
_abort.LIBCMT ref: 005857F0

Strings

csm, xrefs: 005854FB
csm, xrefs: 0058548E
csm, xrefs: 005855A7

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 0f66b1adbeffeb217f0b27c1dc6ac6cd85caf0064a1abd9d38181c53cb0a45cd
Instruction ID: 978ee67b97fb702f40f7f715f96e0f9a43c4fd931945e5b8f62c142932175ce9
Opcode Fuzzy Hash: 0f66b1adbeffeb217f0b27c1dc6ac6cd85caf0064a1abd9d38181c53cb0a45cd
Instruction Fuzzy Hash: 5CB12371800A0AEBCF25EFA4D8859AEBFB5FF44310B548559EC01BB212E731EA51CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0056CE64 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 202COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0056CE6B
VariantClear.OLEAUT32(?), ref: 0056D015

Strings

Name, xrefs: 0056CFE9
fX, xrefs: 0056CE88
SELECT * FROM Win32_OperatingSystem, xrefs: 0056CF2C
Windows 10, xrefs: 0056CFFB
ROOT\CIMV2, xrefs: 0056CE99
WQL, xrefs: 0056CF3E

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ClearH_prolog3Variant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10$fX
API String ID: 3629354427-3828771283
Opcode ID: a7bc985895e4611aa8615c1f5a6582ff538cf03583b1c48383440203fe314f9e
Instruction ID: 4153d76dd5b8801985eecc067057ffc3076e84950d395ecbb53a11973c40a702
Opcode Fuzzy Hash: a7bc985895e4611aa8615c1f5a6582ff538cf03583b1c48383440203fe314f9e
Instruction Fuzzy Hash: 2E712974A002199FDF14DFA4CC98DBEBFB9BF88710B140569E546E72A0DB34AD05DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00591CDD Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00592452,00000000,00000000,00000000,00000000,00000000,?), ref: 00591D1F
__fassign.LIBCMT ref: 00591D9A
__fassign.LIBCMT ref: 00591DB5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00591DDB
WriteFile.KERNEL32(?,00000000,00000000,R$Y,00000000,?,?,?,?,?,?,?,?,?,00592452,00000000), ref: 00591DFA
WriteFile.KERNEL32(?,00000000,00000001,R$Y,00000000,?,?,?,?,?,?,?,?,?,00592452,00000000), ref: 00591E33

Strings

R$Y, xrefs: 00591DEE, 00591E26, 00591DF1, 00591E29

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: R$Y
API String ID: 1324828854-1931881274
Opcode ID: d96bbdbe184ee471a1a807caa0420fe7aa44f420a9597b89e9d10cf75bd29767
Instruction ID: 68cbffe3a73730bdd295ec07a89c6f612017ee422fd4cd81b87fd3e678f7a527
Opcode Fuzzy Hash: d96bbdbe184ee471a1a807caa0420fe7aa44f420a9597b89e9d10cf75bd29767
Instruction Fuzzy Hash: 8851AE71E0065AAFDF10CFA8D885AEEBFB8FF19300F18451AE955E7291E7309944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0057B631 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0057B656
_wcslen.LIBCMT ref: 0057B6F6
GlobalAlloc.KERNEL32(00000040,?), ref: 0057B705
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 0057B726

Strings

<html>, xrefs: 0057B675, 0057B6AE
</html>, xrefs: 0057B6D7
utf-8"></head>, xrefs: 0057B68B
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 0057B680

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-4209811716
Opcode ID: d64a8bb76253b7df4f80cdfb168f7fede5343dedd34e51a0f26ba3561de0be5f
Instruction ID: 3e82a59e1067615954dfe9078c0f13e70b115855d9d19b15eaab27bcb9887673
Opcode Fuzzy Hash: d64a8bb76253b7df4f80cdfb168f7fede5343dedd34e51a0f26ba3561de0be5f
Instruction Fuzzy Hash: 8C3126321083067AFB19BB30AC0AF6F7F5CFF95320F14451EF905A6192FB64990893A5

Uniqueness

Uniqueness Score: -1.00%

Function 0057D8C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00561366: GetDlgItem.USER32(00000000,00003021), ref: 005613AA
Part of subcall function 00561366: SetWindowTextW.USER32(00000000,005965F4), ref: 005613C0

EndDialog.USER32(?,00000001), ref: 0057D910
SendMessageW.USER32(?,00000080,00000001,?), ref: 0057D937
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0057D950
SetWindowTextW.USER32(?,?), ref: 0057D961
GetDlgItem.USER32(?,00000065), ref: 0057D96A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0057D97E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0057D994

Strings

LICENSEDLG, xrefs: 0057D8D4

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: d66e16cb7bec071fceea4f5b76c37171550120e20a2ffb325c134d17d2ea55d4
Instruction ID: b3d8f621f42a60df7d49e0c3db3b7abbdf6978cd330134470385801cd005040f
Opcode Fuzzy Hash: d66e16cb7bec071fceea4f5b76c37171550120e20a2ffb325c134d17d2ea55d4
Instruction Fuzzy Hash: 28219E32204619BFD7116F26FC4DE7B3E7CFF5AB41F048414F704A25A0CA529904BA71

Uniqueness

Uniqueness Score: -1.00%

Function 0056BF89 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0056BFA3

Part of subcall function 005734D7: GetSystemTime.KERNEL32(?,00000000), ref: 005734EF
Part of subcall function 005734D7: SystemTimeToFileTime.KERNEL32(?,?), ref: 005734FD

Part of subcall function 00573480: __aulldiv.LIBCMT ref: 00573489

__aulldiv.LIBCMT ref: 0056BFCF
GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,?,?), ref: 0056BFD6
_swprintf.LIBCMT ref: 0056C001

Part of subcall function 00564C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00564C13

_wcslen.LIBCMT ref: 0056C00B
_swprintf.LIBCMT ref: 0056C061
_wcslen.LIBCMT ref: 0056C06B

Strings

%u.%03u, xrefs: 0056BFF1, 0056C055

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Time_wcslen$System__aulldiv_swprintf$CurrentFileProcess__vswprintf_c_l
String ID: %u.%03u
API String ID: 2956649372-1114938957
Opcode ID: acaf04ded31dde54cc079ac82a1d784643d6a325400899d04c53f1653fb91513
Instruction ID: 27874436616864d671f3e63917518d1614575100a9636f55e75d837ebdf5d6d3
Opcode Fuzzy Hash: acaf04ded31dde54cc079ac82a1d784643d6a325400899d04c53f1653fb91513
Instruction Fuzzy Hash: F8216F72A043419BC714EF65CC8AEAF7BDCBBD4750F40491EF488D3251DA309A088BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0057CBC8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 0057CBEE
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 0057CC05
SystemTimeToFileTime.KERNEL32(?,?), ref: 0057CC19
FileTimeToSystemTime.KERNEL32(?,?), ref: 0057CC2A
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0057CC42
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,00000000,00000032), ref: 0057CC66
_swprintf.LIBCMT ref: 0057CC85

Strings

%s %s, xrefs: 0057CC7C

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific_swprintf
String ID: %s %s
API String ID: 385609497-2939940506
Opcode ID: fdb09f780c05ea52824f9a23fe5935663928d1b6eb428d5751903b9c61a42d5f
Instruction ID: 2ddab98db508c2eb6a24521944895330b7dae707db29f7ae13061b83c2ee9cea
Opcode Fuzzy Hash: fdb09f780c05ea52824f9a23fe5935663928d1b6eb428d5751903b9c61a42d5f
Instruction Fuzzy Hash: BD212AB250024DABDB21DFA1DD48EEE77BCFB59300F10456ABA19D7012E6309A09DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00582360 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0056CEA9,0056CEAB,00000000,00000000,6033248F,00000001,00000000,00000000,?,0056CD87,?,00000004,0056CEA9,ROOT\CIMV2), ref: 005823E9
MultiByteToWideChar.KERNEL32(00000000,00000000,0056CEA9,?,00000000,00000000,?,?,0056CD87,?,00000004,0056CEA9), ref: 00582464
SysAllocString.OLEAUT32(00000000), ref: 0058246F
_com_issue_error.COMSUPP ref: 00582498
_com_issue_error.COMSUPP ref: 005824A2
GetLastError.KERNEL32(80070057,6033248F,00000001,00000000,00000000,?,0056CD87,?,00000004,0056CEA9,ROOT\CIMV2), ref: 005824A7
_com_issue_error.COMSUPP ref: 005824BA
GetLastError.KERNEL32(00000000,?,0056CD87,?,00000004,0056CEA9,ROOT\CIMV2), ref: 005824D0
_com_issue_error.COMSUPP ref: 005824E3

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 4ace7f545f82960341b449c79c7be3e0cf3a7fce108aa7cecd74a25f922d4215
Instruction ID: 1ac2eb84464deab3185164e5e5fb9e0111303782094c9a3c6a0f4a62e95f049c
Opcode Fuzzy Hash: 4ace7f545f82960341b449c79c7be3e0cf3a7fce108aa7cecd74a25f922d4215
Instruction Fuzzy Hash: 7741EA71A00305ABDB10AF64DC49BAEBFA8FB44710F10462AFD05F7291DB359904CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0058C06A Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0058C0F5
__alldvrm.LIBCMT ref: 0058C2F6
__alldvrm.LIBCMT ref: 0058C318

Strings

=zX, xrefs: 0058C080, 0058C0DB, 0058C0F4, 0058C27A
=zX, xrefs: 0058C2B7
=zX, xrefs: 0058C074

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: =zX$=zX$=zX
API String ID: 1036877536-88687947
Opcode ID: d14ae59a6c47695d102f38ce8bebab2561187863f3de3b9f7c7780fcd14afeb7
Instruction ID: 97709130835208fa76e48141490a8e22cde1d7df79eb8bdeee8c8268f85d7361
Opcode Fuzzy Hash: d14ae59a6c47695d102f38ce8bebab2561187863f3de3b9f7c7780fcd14afeb7
Instruction Fuzzy Hash: 31A148769003869FDB15EF58C8917AEBFE4FF51350F144569EC85BB282C6348942C760

Uniqueness

Uniqueness Score: -1.00%

Function 00584F20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00584F57
___except_validate_context_record.LIBVCRUNTIME ref: 00584F5F
_ValidateLocalCookies.LIBCMT ref: 00584FE8
__IsNonwritableInCurrentImage.LIBCMT ref: 00585013
_ValidateLocalCookies.LIBCMT ref: 00585068

Strings

MX, xrefs: 00585005, 0058500E, 0058501F
csm, xrefs: 00584FFD

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: MX$csm
API String ID: 1170836740-3008780516
Opcode ID: e942994cc0a29fef7135e9ed69ec74520666df117a6e5b89ec02c51f88624079
Instruction ID: 56ed7c85567c82d0bed0cada78ae97cbda4bb40331eef03308bf9726ee356022
Opcode Fuzzy Hash: e942994cc0a29fef7135e9ed69ec74520666df117a6e5b89ec02c51f88624079
Instruction Fuzzy Hash: 6D418134A0021ADFCF10EF68C889A9EBFB5BF45314F14815AED15AB392DB319A15CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005732F8 Relevance: 12.1, APIs: 8, Instructions: 131timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0057331D

Part of subcall function 0056D076: GetVersionExW.KERNEL32(?), ref: 0056D0A7

FileTimeToLocalFileTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 00573340
FileTimeToSystemTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 00573352
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00573363
SystemTimeToFileTime.KERNEL32(?,?), ref: 00573373
SystemTimeToFileTime.KERNEL32(?,?), ref: 00573383
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 005733BE
__aullrem.LIBCMT ref: 00573464

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 62983f254620eb9d5706021a16de5be690c3452ef1d006190345af67f63a7e1d
Instruction ID: d827d1ed2f0a802da9b67c93d1d596208c9e0cdff78aae376f3e95cecb587304
Opcode Fuzzy Hash: 62983f254620eb9d5706021a16de5be690c3452ef1d006190345af67f63a7e1d
Instruction Fuzzy Hash: 785137B1508305AFC714DF65D88496BBBE9FB88714F00892EF59AC2210E734EA49EB52

Uniqueness

Uniqueness Score: -1.00%

Function 0057BC7E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0057BC8A

Strings

<style>, xrefs: 0057BDB0
</style>, xrefs: 0057BDD2
>, xrefs: 0057BCCB
</p>, xrefs: 0057BD68
<br>, xrefs: 0057BD7E

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 831ee9133f374d0ba57b7432a3eede6690419b07d3fbf4985ddce2ee8efa7fd3
Instruction ID: 6be89e80621efeb15a6fadaf9836b2ef3455cdc05610aa828b9b8e08df00ac8a
Opcode Fuzzy Hash: 831ee9133f374d0ba57b7432a3eede6690419b07d3fbf4985ddce2ee8efa7fd3
Instruction Fuzzy Hash: E4510A5664032756FB306A1978127B67BD5FFA4790F68C42BFDC8CB2C0FB548D41A251

Uniqueness

Uniqueness Score: -1.00%

Function 0056ACE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 149fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00000800), ref: 0056AD2B
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 0056AD4A

Part of subcall function 0056E208: _wcslen.LIBCMT ref: 0056E210

Part of subcall function 00574168: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,0056E084,00000000,.exe,?,?,00000800,?,?,?,0057AD5D), ref: 0057417E

_swprintf.LIBCMT ref: 0056ADEC

Part of subcall function 00564C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00564C13

MoveFileW.KERNEL32(?,?), ref: 0056AE5E
MoveFileW.KERNEL32(?,?), ref: 0056AE9E

Strings

rtmp%d, xrefs: 0056ADD5

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: FileMoveNamePath$CompareLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 2133196417-3303766350
Opcode ID: 3757cd97c14a8f024213674ac7f585dba279df094593ccc7ce3fbc000504e8e5
Instruction ID: 710069d29049aeacaee6f14f70cb6f6680532730688930467ca26615a85c6738
Opcode Fuzzy Hash: 3757cd97c14a8f024213674ac7f585dba279df094593ccc7ce3fbc000504e8e5
Instruction Fuzzy Hash: 41516275900659A6DF20EB60CC89EEF7BBCBF45340F0408A5B556E3141EB359E88DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0057BE55 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 0057BE8A
GetWindowRect.USER32(?,?), ref: 0057BED1
ShowWindow.USER32(?,00000005,00000000), ref: 0057BF6C
SetWindowTextW.USER32(?,00000000), ref: 0057BF74
ShowWindow.USER32(00000000,00000005), ref: 0057BF8A

Strings

RarHtmlClassName, xrefs: 0057BF31

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: e7adda6909da843f0602fd2a6b40a80ad2b311efafdcb15f4228260a2df25c00
Instruction ID: 2e643a4626e8ec13684e687e5cb349cf8efea8aa3b1afe3a11cef4a6a0315560
Opcode Fuzzy Hash: e7adda6909da843f0602fd2a6b40a80ad2b311efafdcb15f4228260a2df25c00
Instruction Fuzzy Hash: 4A419B72508205AFDB109F64AC48B6B7FACFB9C700F198559F949AA252DB30D804DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0057B8D5 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0057B8DE
_wcslen.LIBCMT ref: 0057B913

Strings

, xrefs: 0057B930
<br>, xrefs: 0057B95F
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 0057B907
 , xrefs: 0057B9A1

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 80ef542f4051fe05b07eae00beb4dc3dece206d03c3878ffc172a0fa958f939c
Instruction ID: a6b831ab17062d775b9e8e4d949275ceb9adf5bea0cf1866c69f558d81d29a70
Opcode Fuzzy Hash: 80ef542f4051fe05b07eae00beb4dc3dece206d03c3878ffc172a0fa958f939c
Instruction Fuzzy Hash: 2231302264430656FA34BB54BC42B77BBB4FB90350F50842FFBA9A72C0FB51AD445391

Uniqueness

Uniqueness Score: -1.00%

Function 0058EEF4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0058EEB8: _free.LIBCMT ref: 0058EEE1

_free.LIBCMT ref: 0058EF42

Part of subcall function 0058BAFA: RtlFreeHeap.NTDLL(00000000,00000000,?,0058EEE6,?,00000000,?,00000000,?,0058EF0D,?,00000007,?,?,0058F30A,?), ref: 0058BB10
Part of subcall function 0058BAFA: GetLastError.KERNEL32(?,?,0058EEE6,?,00000000,?,00000000,?,0058EF0D,?,00000007,?,?,0058F30A,?,?), ref: 0058BB22

_free.LIBCMT ref: 0058EF4D
_free.LIBCMT ref: 0058EF58
_free.LIBCMT ref: 0058EFAC
_free.LIBCMT ref: 0058EFB7
_free.LIBCMT ref: 0058EFC2
_free.LIBCMT ref: 0058EFCD

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction ID: 5425b3b305ed0f069a44a0f7262080300cad64c4e230e13d9ff952cf8dfb8819
Opcode Fuzzy Hash: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction Fuzzy Hash: 5B11EA72940B06AAF520F7B1CC0BFCB7FBC7F84700F404815FA9A76292DA75A5094754

Uniqueness

Uniqueness Score: -1.00%

Function 00568C95 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00568CB2
GetLastError.KERNEL32 ref: 00568CF6
CloseHandle.KERNEL32(?), ref: 00568D05

Strings

JX, xrefs: 00568CEC
@X, xrefs: 00568CB9
^X, xrefs: 00568CD7

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CloseCurrentErrorHandleLastProcess
String ID: @X$JX$^X
API String ID: 1009092642-3346770594
Opcode ID: e23b65d5095cbbf173ea760c2bd099255e477212facf80488fb48ca81d45fb12
Instruction ID: d49b41d9505164b2398631959013ee600a2840deae402cee5dfabbfecf5ff1cf
Opcode Fuzzy Hash: e23b65d5095cbbf173ea760c2bd099255e477212facf80488fb48ca81d45fb12
Instruction Fuzzy Hash: D301ADB1601219AFDB109FA5DD8EEBFBBBCFB19344F404419A501E3190DA719D49EB70

Uniqueness

Uniqueness Score: -1.00%

Function 00580ACB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00580B46,00580AA9,00580D4A), ref: 00580AE2
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00580AF8
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00580B0D

Strings

ReleaseSRWLockExclusive, xrefs: 00580B02
AcquireSRWLockExclusive, xrefs: 00580AF2
KERNEL32.DLL, xrefs: 00580ADD

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: b255fecefefe064ba6e6c59667973f2bfa167f8552b8f8427e2d680ae8fbbc90
Instruction ID: c33ead2df07b27e8a84332fd40913905da98ce20d0fc9663869a8bc24bedb00e
Opcode Fuzzy Hash: b255fecefefe064ba6e6c59667973f2bfa167f8552b8f8427e2d680ae8fbbc90
Instruction Fuzzy Hash: 4AF0A4313517215B4BA0BFE45C8997F2EC8BA22356332183A9D42E21C0EA50DC8DA3E0

Uniqueness

Uniqueness Score: -1.00%

Function 0057418A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00574192
_wcslen.LIBCMT ref: 005741A3
_wcslen.LIBCMT ref: 005741B3
_wcslen.LIBCMT ref: 005741C1
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,0056D2D3,?,?,00000000,?,?,?), ref: 005741DC

Strings

<, xrefs: 005741DC

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen$CompareString
String ID: <
API String ID: 3397213944-4251816714
Opcode ID: ddce76968428e9b66df834b98349ee3cf2b5c077efdcbf2b98b564750eaac428
Instruction ID: 32441c7d995e759ec2c1d5bd7e46059fd4ef4acb25b9c3dc6bfd34d72cc9b40b
Opcode Fuzzy Hash: ddce76968428e9b66df834b98349ee3cf2b5c077efdcbf2b98b564750eaac428
Instruction Fuzzy Hash: 01F01732148169BFCF122F51EC4DD8E3F26FB90770B61C41AFA196A061CB329995EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0058B160 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0058B17E

Part of subcall function 0058BAFA: RtlFreeHeap.NTDLL(00000000,00000000,?,0058EEE6,?,00000000,?,00000000,?,0058EF0D,?,00000007,?,?,0058F30A,?), ref: 0058BB10
Part of subcall function 0058BAFA: GetLastError.KERNEL32(?,?,0058EEE6,?,00000000,?,00000000,?,0058EF0D,?,00000007,?,?,0058F30A,?,?), ref: 0058BB22

_free.LIBCMT ref: 0058B190
_free.LIBCMT ref: 0058B1A3
_free.LIBCMT ref: 0058B1B4
_free.LIBCMT ref: 0058B1C5

Strings

p,Z, xrefs: 0058B174

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: p,Z
API String ID: 776569668-423584262
Opcode ID: 063a7ae002f0014924a8954f939d9c0dffa25f9b0553225a2d248bdf78eb67f5
Instruction ID: a2fc92445fcfcb0e9caa062f103d85566639bb2b021f35cd64ae7cb4fed2244f
Opcode Fuzzy Hash: 063a7ae002f0014924a8954f939d9c0dffa25f9b0553225a2d248bdf78eb67f5
Instruction Fuzzy Hash: C9F01774800A21AFAA05BB19EC168987FA9F765724700460AF81666360CBB20A49EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00573583 Relevance: 9.1, APIs: 6, Instructions: 104timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 005735E6

Part of subcall function 0056D076: GetVersionExW.KERNEL32(?), ref: 0056D0A7

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0057360A
FileTimeToSystemTime.KERNEL32(?,?), ref: 00573624
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00573637
SystemTimeToFileTime.KERNEL32(?,?), ref: 00573647
SystemTimeToFileTime.KERNEL32(?,?), ref: 00573657

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 0326e578180c7742fee8046a537b5396e0da85c8f781476d8669e73c160f867d
Instruction ID: c5989b902745ab762f2af6afb345e3586c403928fb7649a469c2e873a6dcb4b0
Opcode Fuzzy Hash: 0326e578180c7742fee8046a537b5396e0da85c8f781476d8669e73c160f867d
Instruction Fuzzy Hash: 124129761083059BCB04DFA8D88499BBBE8FF98714F04891EF999C7210E730D909DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0058511A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00585111,00584ECC,005821B4), ref: 00585128
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00585136
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0058514F
SetLastError.KERNEL32(00000000,00585111,00584ECC,005821B4), ref: 005851A1

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: aba6599c954e8293f783be45247860cbe6de04f989c09c62f42eb318eda09c24
Instruction ID: 433d219eed93270c31302bf98e116f3d7cb243ce8488b9611007328ef7258c35
Opcode Fuzzy Hash: aba6599c954e8293f783be45247860cbe6de04f989c09c62f42eb318eda09c24
Instruction Fuzzy Hash: 3D01F136208B126EE72136B8BC8E7362E44FBA2771BA0022AFC10A65E0FF510C14E750

Uniqueness

Uniqueness Score: -1.00%

Function 0058B9A5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,005A50C4,00586E12,005A50C4,?,?,0058688D,?,?,005A50C4), ref: 0058B9A9
_free.LIBCMT ref: 0058B9DC
_free.LIBCMT ref: 0058BA04
SetLastError.KERNEL32(00000000,?,005A50C4), ref: 0058BA11
SetLastError.KERNEL32(00000000,?,005A50C4), ref: 0058BA1D
_abort.LIBCMT ref: 0058BA23

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: a9ddc7d0e82f92d5074110b5f782895b27a6a5a2b88828952cac9eeba339ad38
Instruction ID: 081da660c33dd1181447a907cc685e1292eb49ec583cf035273c6e595e1e764d
Opcode Fuzzy Hash: a9ddc7d0e82f92d5074110b5f782895b27a6a5a2b88828952cac9eeba339ad38
Instruction Fuzzy Hash: BAF0F4361045026BE6197329AC4FB6B2E6DFFD1770F210015FE16B2292FF618C0A9324

Uniqueness

Uniqueness Score: -1.00%

Function 0058004D Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00580059
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00580073
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00580084
TranslateMessage.USER32(?), ref: 0058008E
DispatchMessageW.USER32(?), ref: 00580098
WaitForSingleObject.KERNEL32(?,0000000A), ref: 005800A3

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 61a174ebb3feb8309556404942650ff89bd34db16f821ce99c867b5130e06cc1
Instruction ID: bd1c30b266b8a866e2e20208392f59bc967e462c78ef1e8067b6a353e988abef
Opcode Fuzzy Hash: 61a174ebb3feb8309556404942650ff89bd34db16f821ce99c867b5130e06cc1
Instruction Fuzzy Hash: 8CF03C72A0122DABCB206BA1EC4DECF7E6DEF56751B008011B90AE2050D634C549DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0057D41C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 0057D57B
GetDlgItemTextW.USER32(?,00000066,00001000,00000200), ref: 0057D591
SetDlgItemTextW.USER32(?,00000067,?), ref: 0057D5B9

Strings

GETPASSWORD1, xrefs: 0057D548
Software\WinRAR SFX, xrefs: 0057D466

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 1770891597-1315819833
Opcode ID: 22fedd6c62bbe217342db2b6d0753a6635cc0b24c3cac82f66f6c2fda2483aae
Instruction ID: ffc828221fa571cdc995de6f9b0c19aa9278f750a30e330828e15ab74719ef8f
Opcode Fuzzy Hash: 22fedd6c62bbe217342db2b6d0753a6635cc0b24c3cac82f66f6c2fda2483aae
Instruction Fuzzy Hash: B7419172504209ABDB30AB64EC49FFA7BBCFF59700F108429F609E7181DB70A944AB75

Uniqueness

Uniqueness Score: -1.00%

Function 0056E033 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00572663: _wcslen.LIBCMT ref: 00572669

Part of subcall function 0056D848: _wcsrchr.LIBVCRUNTIME ref: 0056D85F

_wcslen.LIBCMT ref: 0056E105
_wcslen.LIBCMT ref: 0056E14D

Strings

.rar, xrefs: 0056E04F, 0056E0A2
.exe, xrefs: 0056E079
.sfx, xrefs: 0056E088

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 6448828d3ccc1030d283ed3ed6d08798d084fe8f88832292761fb1f9ddf3239e
Instruction ID: 6bf0e28f1eb2eaf9eb1a90dbd7de744ef2b94130b6d990b118f58f398d2d4d21
Opcode Fuzzy Hash: 6448828d3ccc1030d283ed3ed6d08798d084fe8f88832292761fb1f9ddf3239e
Instruction Fuzzy Hash: B141153A50271195CB326F34D85BA7B7FA8FF42764F10890EF9859B080EBB05D85D351

Uniqueness

Uniqueness Score: -1.00%

Function 0056DA1E Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0056DA59
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,0056BD19,?,?,00000800,?,?,?,0056BCD4), ref: 0056DB02
_wcslen.LIBCMT ref: 0056DB70

Strings

UNC, xrefs: 0056DAE8
\\?\, xrefs: 0056DA90, 0056DADC, 0056DB38, 0056DB87

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 366abd7c67804adb9e3c76a61d0e586d664286d718d97f4553db1e65f1933e46
Instruction ID: b90743ab90d0df1f61308f39a92c7988876e23339372cd76f61eaf4b6b326bf8
Opcode Fuzzy Hash: 366abd7c67804adb9e3c76a61d0e586d664286d718d97f4553db1e65f1933e46
Instruction Fuzzy Hash: D641D632E0434266DA20AF609C89DFF7BBCBF95740F018C1AF48493155EBA49845DB72

Uniqueness

Uniqueness Score: -1.00%

Function 005610E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00561136
_wcslen.LIBCMT ref: 0056115A
_wcslen.LIBCMT ref: 00561187
_wcslen.LIBCMT ref: 005611AC

Strings

%X, xrefs: 00561227

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen
String ID: %X
API String ID: 176396367-1974812566
Opcode ID: ee676fcc785c0852f35763d01dfe4ac8565104e7f0f3f1cadeb0af65829e9d1f
Instruction ID: 16640f1fe7b5083bcebdc378cf587577e321ab950d77224bc54c5838e1ec401c
Opcode Fuzzy Hash: ee676fcc785c0852f35763d01dfe4ac8565104e7f0f3f1cadeb0af65829e9d1f
Instruction Fuzzy Hash: AA418F71504B529BC725DF38C9599AFBBE8FF85300F04492DF989E3250DB30A9098B96

Uniqueness

Uniqueness Score: -1.00%

Function 0057D9DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0057D9ED
GetObjectW.GDI32(00000000,00000018,?), ref: 0057DA12
DeleteObject.GDI32(00000000), ref: 0057DA44
DeleteObject.GDI32(00000000), ref: 0057DA67

Part of subcall function 0057C652: FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,0057DA3D,00000066), ref: 0057C665
Part of subcall function 0057C652: SizeofResource.KERNEL32(00000000,?,?,?,0057DA3D,00000066), ref: 0057C67C
Part of subcall function 0057C652: LoadResource.KERNEL32(00000000,?,?,?,0057DA3D,00000066), ref: 0057C693
Part of subcall function 0057C652: LockResource.KERNEL32(00000000,?,?,?,0057DA3D,00000066), ref: 0057C6A2
Part of subcall function 0057C652: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0057DA3D,00000066), ref: 0057C6BD
Part of subcall function 0057C652: GlobalLock.KERNEL32(00000000,?,?,?,?,?,0057DA3D,00000066), ref: 0057C6CE
Part of subcall function 0057C652: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0057C737
Part of subcall function 0057C652: GlobalUnlock.KERNEL32(00000000), ref: 0057C756
Part of subcall function 0057C652: GlobalFree.KERNEL32(00000000), ref: 0057C75D

Strings

], xrefs: 0057DA1A

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: 61292b7ccb1fa18341466dea76b08e82a427deab4c39b21fbd00580b60badf76
Instruction ID: 44f2074f3fda59e508d78eec4f15dd2d157dbe71a390a0abaa81fd124194da22
Opcode Fuzzy Hash: 61292b7ccb1fa18341466dea76b08e82a427deab4c39b21fbd00580b60badf76
Instruction Fuzzy Hash: 3E01AD325046066BCB126769BC4DE7B3E7ABFC1B61F144118B80CB7291DF718C09AAB0

Uniqueness

Uniqueness Score: -1.00%

Function 0057F950 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00561366: GetDlgItem.USER32(00000000,00003021), ref: 005613AA
Part of subcall function 00561366: SetWindowTextW.USER32(00000000,005965F4), ref: 005613C0

EndDialog.USER32(?,00000001), ref: 0057F99B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0057F9B1
SetDlgItemTextW.USER32(?,00000066,?), ref: 0057F9C5
SetDlgItemTextW.USER32(?,00000068), ref: 0057F9D4

Strings

RENAMEDLG, xrefs: 0057F968

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 4b8d25baeeaaae7cbb135ffd1ddd19c79bcc82127507819aedffa82b592c6a13
Instruction ID: 94f0e9df2e6b563a68fc013258c42bc836a089632cda247005afb64136036b05
Opcode Fuzzy Hash: 4b8d25baeeaaae7cbb135ffd1ddd19c79bcc82127507819aedffa82b592c6a13
Instruction Fuzzy Hash: 5001B5322846187FD211DB64AD0DF7B7F5CFBA9701F14C425F345A2590C6629908FB75

Uniqueness

Uniqueness Score: -1.00%

Function 0058A6C5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0058A676,?,?,0058A616,?,0059F7B0,0000000C,0058A76D,?,00000002), ref: 0058A6E5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0058A6F8
FreeLibrary.KERNEL32(00000000,?,?,?,0058A676,?,?,0058A616,?,0059F7B0,0000000C,0058A76D,?,00000002,00000000), ref: 0058A71B

Strings

CorExitProcess, xrefs: 0058A6F0
mscoree.dll, xrefs: 0058A6DE

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0b621e9a692d5d8803f4e5a8ec1eb9ed3e8fb1c3f09f3ed84c516e81774b2d57
Instruction ID: ce20e3cd9b7482944bd775999afd8e3b2e501792d88c74765b34fb2663a56ed8
Opcode Fuzzy Hash: 0b621e9a692d5d8803f4e5a8ec1eb9ed3e8fb1c3f09f3ed84c516e81774b2d57
Instruction Fuzzy Hash: 2EF04430500208BBDF11AFA4DC89B9DBFB9FB08751F05416AF806A2150DB315E48EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00561366 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00570244: _swprintf.LIBCMT ref: 00570284
Part of subcall function 00570244: _strlen.LIBCMT ref: 005702A5
Part of subcall function 00570244: SetDlgItemTextW.USER32(?,005A2274,?), ref: 005702FE
Part of subcall function 00570244: GetWindowRect.USER32(?,?), ref: 00570334
Part of subcall function 00570244: GetClientRect.USER32(?,?), ref: 00570340

GetDlgItem.USER32(00000000,00003021), ref: 005613AA
SetWindowTextW.USER32(00000000,005965F4), ref: 005613C0

Strings

pPZ, xrefs: 005613CB
0, xrefs: 00561369
pPZ, xrefs: 0056137B

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0$pPZ$pPZ
API String ID: 2622349952-1843725025
Opcode ID: 0786abbfcc6c2de86f940d818735d00147e5917743f8d8a20f5e2125d8639a7a
Instruction ID: d9553696f1c4a8b1e5f94d228c548e516e23c9da092e360438a11de760aed91a
Opcode Fuzzy Hash: 0786abbfcc6c2de86f940d818735d00147e5917743f8d8a20f5e2125d8639a7a
Instruction Fuzzy Hash: 2CF08C30604A4CAADF150F22DC0DBB93FA8FB15394F088914FC4A52AA2DBB4C994EF54

Uniqueness

Uniqueness Score: -1.00%

Function 005712F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 005728AB: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005728D4
Part of subcall function 005728AB: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00571309,Crypt32.dll,00000000,00571383,00000200,?,00571366,00000000,00000000,?), ref: 005728F4

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00571315
GetProcAddress.KERNEL32(005AC1F0,CryptUnprotectMemory), ref: 00571325

Strings

Crypt32.dll, xrefs: 005712FF
CryptUnprotectMemory, xrefs: 0057131B
CryptProtectMemory, xrefs: 0057130F

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: ab684ddd9663139547964f352063d47005c11714145e5885a3a4504954c7acad
Instruction ID: 3750b43dbec3b45e268a5f3c73ec1a1654aad2f033a91d622b9f7150573e2d9e
Opcode Fuzzy Hash: ab684ddd9663139547964f352063d47005c11714145e5885a3a4504954c7acad
Instruction Fuzzy Hash: 07E08670A40B019EDB205F38A94DB427EE4BF24700F04CC1DE0D997640D6B5D4489B50

Uniqueness

Uniqueness Score: -1.00%

Function 005851FA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 005852C1
___AdjustPointer.LIBCMT ref: 005852E4
_abort.LIBCMT ref: 00585332
___AdjustPointer.LIBCMT ref: 00585380

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 3d3bf63d7dfd961246a75dcc9d1da9dec9363fb7f2ff7e997dc42410e538abf1
Instruction ID: 8ac1ee2191ad3d3b5d709df7a86f61e0253e983d4ca8ab33a1c79f016b7f67ef
Opcode Fuzzy Hash: 3d3bf63d7dfd961246a75dcc9d1da9dec9363fb7f2ff7e997dc42410e538abf1
Instruction Fuzzy Hash: 3851D275601A069FDB25AF54D845BAABFA4FF84350F14482DED06B7291FB71AC40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0058E580 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0058E589
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0058E5AC

Part of subcall function 0058BC8E: RtlAllocateHeap.NTDLL(00000000,?,?,?,00586A24,?,0000015D,?,?,?,?,00587F00,000000FF,00000000,?,?), ref: 0058BCC0

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0058E5D2
_free.LIBCMT ref: 0058E5E5
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0058E5F4

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 3865ce7217cc42d4e6b38125a7ce4214d5630049d24dcfaa048d7aad56151ddc
Instruction ID: 96f38f5720055f88b8c655a965df581b31897c3057c5511f209f80e5eb305137
Opcode Fuzzy Hash: 3865ce7217cc42d4e6b38125a7ce4214d5630049d24dcfaa048d7aad56151ddc
Instruction Fuzzy Hash: 0E01B1726012127F273166765C8EC7F6E7DFEC2BA8315012ABC05E2205EE608D05E3B0

Uniqueness

Uniqueness Score: -1.00%

Function 0058BA29 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0058BC80,0058D7D8,?,0058B9D3,00000001,00000364,?,0058688D,?,?,005A50C4), ref: 0058BA2E
_free.LIBCMT ref: 0058BA63
_free.LIBCMT ref: 0058BA8A
SetLastError.KERNEL32(00000000,?,005A50C4), ref: 0058BA97
SetLastError.KERNEL32(00000000,?,005A50C4), ref: 0058BAA0

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: d60a5027c81516c5a824726034b77b93d965dabb97114e03a49084764258492d
Instruction ID: c70195bdec3681ebcad1ed3ae284f493be04027885bb08ed14f025acaeff4ad3
Opcode Fuzzy Hash: d60a5027c81516c5a824726034b77b93d965dabb97114e03a49084764258492d
Instruction Fuzzy Hash: 7E01F936204602ABA21DB7385C8EE6B3E6EFFD13717210425FD25B2291EF618D09A320

Uniqueness

Uniqueness Score: -1.00%

Function 00572FC9 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 005732AF: ResetEvent.KERNEL32(?), ref: 005732C1
Part of subcall function 005732AF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 005732D5

ReleaseSemaphore.KERNEL32(?,00000040,00000000,6033248F,?,?,00000001,?,005952FF,000000FF,?,005743C0,?,00000000,?,00564766), ref: 00573007
CloseHandle.KERNEL32(?,?,?,005743C0,?,00000000,?,00564766,?,?,?,00000000,?,?,?,00000001), ref: 00573021
DeleteCriticalSection.KERNEL32(?,?,005743C0,?,00000000,?,00564766,?,?,?,00000000,?,?,?,00000001,?), ref: 0057303A
CloseHandle.KERNEL32(?,?,005743C0,?,00000000,?,00564766,?,?,?,00000000,?,?,?,00000001,?), ref: 00573046
CloseHandle.KERNEL32(?,?,005743C0,?,00000000,?,00564766,?,?,?,00000000,?,?,?,00000001,?), ref: 00573052

Part of subcall function 005730CA: WaitForSingleObject.KERNEL32(?,000000FF,005731E7,?,?,0057325F,?,?,?,?,?,00573249), ref: 005730D0
Part of subcall function 005730CA: GetLastError.KERNEL32(?,?,0057325F,?,?,?,?,?,00573249), ref: 005730DC

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: f1af91f800d4cf80ce140cad5ba176632746bbb2b510b755f2665cefed3e706c
Instruction ID: 4b99d2798ecf125aa0706e0f135b401ffedc4de2ee29f19c2da4da9fa15fbaa5
Opcode Fuzzy Hash: f1af91f800d4cf80ce140cad5ba176632746bbb2b510b755f2665cefed3e706c
Instruction Fuzzy Hash: 61118076500744EFC7229F64ED89BC6BBA9FB18710F01492AF16B92160CB75AA48EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0058EE4F Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0058EE67

Part of subcall function 0058BAFA: RtlFreeHeap.NTDLL(00000000,00000000,?,0058EEE6,?,00000000,?,00000000,?,0058EF0D,?,00000007,?,?,0058F30A,?), ref: 0058BB10
Part of subcall function 0058BAFA: GetLastError.KERNEL32(?,?,0058EEE6,?,00000000,?,00000000,?,0058EF0D,?,00000007,?,?,0058F30A,?,?), ref: 0058BB22

_free.LIBCMT ref: 0058EE79
_free.LIBCMT ref: 0058EE8B
_free.LIBCMT ref: 0058EE9D
_free.LIBCMT ref: 0058EEAF

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f6d69ea79ec7f54b1e6b6362022cfe4137f09ca91aad5a64f6ca1c5a15b9444b
Instruction ID: d20013bd75b74d465fa6d456e2f9ebb106a3ce442d7f46101c8ebba043a500c5
Opcode Fuzzy Hash: f6d69ea79ec7f54b1e6b6362022cfe4137f09ca91aad5a64f6ca1c5a15b9444b
Instruction Fuzzy Hash: 8CF0EC32504204AF9664FB6DF887C9A7BFEBB51711B540805F849F7650CB70FC848B60

Uniqueness

Uniqueness Score: -1.00%

Function 0057C79C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

Part of subcall function 0057C629: GetDC.USER32(00000000), ref: 0057C62D
Part of subcall function 0057C629: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0057C638
Part of subcall function 0057C629: ReleaseDC.USER32(00000000,00000000), ref: 0057C643

GetObjectW.GDI32(?,00000018,?), ref: 0057C7E0

Part of subcall function 0057CA67: GetDC.USER32(00000000), ref: 0057CA70
Part of subcall function 0057CA67: GetObjectW.GDI32(?,00000018,?), ref: 0057CA9F
Part of subcall function 0057CA67: ReleaseDC.USER32(00000000,?), ref: 0057CB37

Strings

fX, xrefs: 0057C82F
(, xrefs: 0057C935

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: ($fX
API String ID: 1061551593-3418762607
Opcode ID: 9279785608e1acf93d0db1021fbdca5afca004ee483468651dac195c190f9e4a
Instruction ID: 6fcad609f22702b72ee5eda906b39167d6bb84500675329952863287c9a090ae
Opcode Fuzzy Hash: 9279785608e1acf93d0db1021fbdca5afca004ee483468651dac195c190f9e4a
Instruction Fuzzy Hash: B991F3756083559FDA10DF29D848D2BBBE8FFD9B00F04495EF48AD3260CB70A909DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00573748 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 203COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00573910
_swprintf.LIBCMT ref: 005739BF

Strings

%s: %s, xrefs: 0057391F
%ls, xrefs: 00573795, 005737AB

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: c7141d8b041830fce5ebd27ec70b041df649cf3b951f1cd650750d5b8e879585
Instruction ID: f60035a8c1f9384db22e33deca3cee9aa331b62cf14bd59a62bc90fd5e97a56c
Opcode Fuzzy Hash: c7141d8b041830fce5ebd27ec70b041df649cf3b951f1cd650750d5b8e879585
Instruction Fuzzy Hash: C851F7B5248305FAFB255B94BD4BF257FA9FB09F20F10C906B38E640E1D6A257407E16

Uniqueness

Uniqueness Score: -1.00%

Function 0058A7C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\qdHMT36Tn9.exe,00000104), ref: 0058A800
_free.LIBCMT ref: 0058A8CB
_free.LIBCMT ref: 0058A8D5

Strings

C:\Users\user\Desktop\qdHMT36Tn9.exe, xrefs: 0058A7F7, 0058A7FE, 0058A82D, 0058A865

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\qdHMT36Tn9.exe
API String ID: 2506810119-1453164745
Opcode ID: 478a2f860074f8e95ac937595e73dc0fb46946e557f4e8263836d273711d2702
Instruction ID: 0d36701a6ac2428aa93df9faacef26e56ce0baa1b5b5562b3b84d7ec7f4e04d4
Opcode Fuzzy Hash: 478a2f860074f8e95ac937595e73dc0fb46946e557f4e8263836d273711d2702
Instruction Fuzzy Hash: C8318F71A00619EFEB25EB99D885DAEBFFCFB85710B104067ED04B7201D6704E45DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 005857F6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0058581B
_abort.LIBCMT ref: 00585926

Strings

MOC, xrefs: 0058582D
RCC, xrefs: 00585835

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 623d93b0c015a14a0449ec7ec8547b353ef8921e8387b5a3c9a4b6f0cb1f656b
Instruction ID: aff1811d35b534d91d9d5dbd5a2d72a0997b53a00c22e8cdef86d90aa4738a89
Opcode Fuzzy Hash: 623d93b0c015a14a0449ec7ec8547b353ef8921e8387b5a3c9a4b6f0cb1f656b
Instruction Fuzzy Hash: B341157290060AEFCF16EF94C885AAEBFB5FF48314F288059FD14B6221E2359950DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0056F7B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0056F82D
_strncpy.LIBCMT ref: 0056F871

Part of subcall function 00573F47: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0056F801,00000000,00000000,?,005A5070,?,0056F801,?,?,00000050,?), ref: 00573F64

Strings

$%s, xrefs: 0056F822
@%s, xrefs: 0056F817

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 4e126fa3e540fe2f81202ea875767537ce8f502ccaa105b37880381e1035f7ce
Instruction ID: d74d963c86076f9a8eaeb4b5188e01508bcd112e8b123c19cf48df646beda669
Opcode Fuzzy Hash: 4e126fa3e540fe2f81202ea875767537ce8f502ccaa105b37880381e1035f7ce
Instruction Fuzzy Hash: DF219072900309ABDB20DFA4EC46BAE7BA8FB15300F04056AF925A3191E771EA099B50

Uniqueness

Uniqueness Score: -1.00%

Function 0057CDA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00561366: GetDlgItem.USER32(00000000,00003021), ref: 005613AA
Part of subcall function 00561366: SetWindowTextW.USER32(00000000,005965F4), ref: 005613C0

EndDialog.USER32(?,00000001), ref: 0057CE28
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0057CE3D
SetDlgItemTextW.USER32(?,00000066,?), ref: 0057CE52

Strings

ASKNEXTVOL, xrefs: 0057CDB8

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 31254f5f92e970c2258bfe402e19e0ea4100975a8e98d752a610568ff7118124
Instruction ID: 94866342553c3a4d21235d958a5d72046459d7107a7eed8d37bb3a7e91e29b15
Opcode Fuzzy Hash: 31254f5f92e970c2258bfe402e19e0ea4100975a8e98d752a610568ff7118124
Instruction Fuzzy Hash: 1F11E932244A05AFD7229FA8FC09F763F6DFB5AB00F044418FA45A71A4C761AD05FB65

Uniqueness

Uniqueness Score: -1.00%

Function 00572F22 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0056CAA0,00000008,00000004,0056F1F0,?,00000000), ref: 00572F61
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0056CAA0,00000008,00000004,0056F1F0,?,00000000), ref: 00572F6B
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0056CAA0,00000008,00000004,0056F1F0,?,00000000), ref: 00572F7B

Strings

Thread pool initialization failed., xrefs: 00572F93

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: bda8e5cfb4f22c1438a585e3ed9926dd31a9f8fefe5221339cf59d93111ca537
Instruction ID: 66cd8e5e1de0e8c3bee4eadd5055cf4570c3439821aa1f59af9ae3b7821230d7
Opcode Fuzzy Hash: bda8e5cfb4f22c1438a585e3ed9926dd31a9f8fefe5221339cf59d93111ca537
Instruction Fuzzy Hash: C4114FB1604709AFC3215F6A9CC9AA7FFECFBA9744F10482EF1DAC3200E67159449B60

Uniqueness

Uniqueness Score: -1.00%

Function 005800EF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 0058012E, 00580162
RENAMEDLG, xrefs: 00580143

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 858133bffaae28796961929b26575cef3cec8b76a6c4ab690b313c81f24bf53f
Instruction ID: 80a8cf873b880af07b5a6aad7037ef6b58a665ce6706e569672fdf93de7bb897
Opcode Fuzzy Hash: 858133bffaae28796961929b26575cef3cec8b76a6c4ab690b313c81f24bf53f
Instruction Fuzzy Hash: 0F019E31604608AFDB51AF24EC48E763FE4BB2A761F000425F905E32B0D261885CEBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00564B3D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00564B42

Part of subcall function 0058106D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00581079
Part of subcall function 0058106D: ___delayLoadHelper2@8.DELAYIMP ref: 0058109F

std::_Xinvalid_argument.LIBCPMT ref: 00564B4D

Strings

string too long, xrefs: 00564B3D
vector too long, xrefs: 00564B48

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Helper2@8Load___delaystd::invalid_argument::invalid_argument
String ID: string too long$vector too long
API String ID: 2355824318-1617939282
Opcode ID: 150ff9bede4eb9369177b0874e532bdf07c5a5469b11a66c9752416fd6037e32
Instruction ID: f521e4802b648c39f12e43f3a2ab9edab802cc977283100e081436b8445541cc
Opcode Fuzzy Hash: 150ff9bede4eb9369177b0874e532bdf07c5a5469b11a66c9752416fd6037e32
Instruction Fuzzy Hash: FAF08C31200708AB8E34AE59DC4984ABBADFBC5B60B10091AEA8593611C3B0E9448BB5

Uniqueness

Uniqueness Score: -1.00%

Function 0056C142 Relevance: 6.1, APIs: 4, Instructions: 135filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,00569343,?,?,?), ref: 0056C1EE
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,?,00569343,?,?), ref: 0056C22C
SetFileTime.KERNEL32(00000800,?,?,00000000,?,?,?,00569343,?,?,?,?,?,?,?,?), ref: 0056C2AF
CloseHandle.KERNEL32(00000800,?,?,?,00569343,?,?,?,?,?,?,?,?,?,?), ref: 0056C2B6

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 884908e2a333f303a3af1846893df2256657906275f7e5aae97f23b7973896c4
Instruction ID: fa44c5c8c8815e0ae00416c864e74d3472df44fa46459b7e289d22c5081e852b
Opcode Fuzzy Hash: 884908e2a333f303a3af1846893df2256657906275f7e5aae97f23b7973896c4
Instruction Fuzzy Hash: DB41D2302483829EE320DB64DC59BBBBFE8BB99710F04091DB5D5D7181D674AA4CD752

Uniqueness

Uniqueness Score: -1.00%

Function 0056BD61 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0056BD93
_wcslen.LIBCMT ref: 0056BDB6
_wcslen.LIBCMT ref: 0056BE4C
_wcslen.LIBCMT ref: 0056BEB1

Part of subcall function 0056C37A: FindClose.KERNELBASE(00000000,000000FF,?,?,?,?,005687BC,?,?,00000000,0000003A,?,0000003A,00000802), ref: 0056C3A5

Part of subcall function 0056BBFF: RemoveDirectoryW.KERNEL32(00000001,?,00000001,00000000), ref: 0056BC1C
Part of subcall function 0056BBFF: RemoveDirectoryW.KERNEL32(?,00000001,?,00000800), ref: 0056BC48

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen$DirectoryRemove$CloseFind
String ID:
API String ID: 973666142-0
Opcode ID: bb330f41f9fcfafb6ebd45450e568b3dfa6ddc24113f5480a8b832e2e7924d6f
Instruction ID: dbbf97c634fed3504245a775d04e395120eda6ec02146d30dc09791fb960744d
Opcode Fuzzy Hash: bb330f41f9fcfafb6ebd45450e568b3dfa6ddc24113f5480a8b832e2e7924d6f
Instruction Fuzzy Hash: 3441C87250439596EB30AB6498499EBBBEDBFC4300F404C1AEA85D7142DB769DC8C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0056849E Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000800,?,?,6033248F,00000000,?,00000000), ref: 00568596

Part of subcall function 00568C95: GetCurrentProcess.KERNEL32(00000020,?), ref: 00568CB2
Part of subcall function 00568C95: GetLastError.KERNEL32 ref: 00568CF6
Part of subcall function 00568C95: CloseHandle.KERNEL32(?), ref: 00568D05

Strings

SeSecurityPrivilege, xrefs: 0056851C
TX, xrefs: 00568557, 0056857A
SeRestorePrivilege, xrefs: 00568531

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ErrorLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege$TX
API String ID: 1245819386-3103595474
Opcode ID: fdf9b200bc414342052bfe7bbcd51e6f94f394de0bb4ffe4f954edf38de16343
Instruction ID: 70db0dd2e54b2409b6dc93c1a2c99dd18b9c54e23de5f823a07f277b94514049
Opcode Fuzzy Hash: fdf9b200bc414342052bfe7bbcd51e6f94f394de0bb4ffe4f954edf38de16343
Instruction Fuzzy Hash: DC41B071A04249AFDF20EF649C49BFE7FB8FB59304F040159F906A7281DBB45E488B61

Uniqueness

Uniqueness Score: -1.00%

Function 0058EFD8 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00586F64,00000000,00000000,00587F99,?,00587F99,?,00000001,00586F64,?,00000001,00587F99,00587F99), ref: 0058F025
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0058F0AE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0058F0C0
__freea.LIBCMT ref: 0058F0C9

Part of subcall function 0058BC8E: RtlAllocateHeap.NTDLL(00000000,?,?,?,00586A24,?,0000015D,?,?,?,?,00587F00,000000FF,00000000,?,?), ref: 0058BCC0

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: e3fd3bfd6db0e89d8cfdb02c266ca3ecf0f5fd504202992b6508bad7c6e4e87d
Instruction ID: 47a752d5f975508d35aa5a5aae8e391f0acc9be9ba30ecf78356bdd44e9e87a9
Opcode Fuzzy Hash: e3fd3bfd6db0e89d8cfdb02c266ca3ecf0f5fd504202992b6508bad7c6e4e87d
Instruction Fuzzy Hash: EB31BD72A0020AAFDF24AF64DC49DAE7FA5FB48310B154229FC05A7292E735DD54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0057C5F3 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0057C5F6
GetDeviceCaps.GDI32(00000000,00000058), ref: 0057C605
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0057C613
ReleaseDC.USER32(00000000,00000000), ref: 0057C621

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: d7ea8b58e89bf0cb2b23b9b7ce7fa847352448b673d0d35121b03a7626ad6b4d
Instruction ID: 361b27478afc679e216580fe63cd427bb4d97cb35bcd8c58bab264f3e795778e
Opcode Fuzzy Hash: d7ea8b58e89bf0cb2b23b9b7ce7fa847352448b673d0d35121b03a7626ad6b4d
Instruction Fuzzy Hash: 6DE0EC71989A68ABD7211B65BC1DF963F54EB2E713F044005FA05A6690CAB04808EFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0058D808 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0058D974

Part of subcall function 00586676: IsProcessorFeaturePresent.KERNEL32(00000017,00586648,00000000,0058B5F4,00000000,00000000,00000000,00000016,?,?,00586655,00000000,00000000,00000000,00000000,00000000), ref: 00586678
Part of subcall function 00586676: GetCurrentProcess.KERNEL32(C0000417,0058B5F4,00000000,?,00000003,0058BA28), ref: 0058669A
Part of subcall function 00586676: TerminateProcess.KERNEL32(00000000,?,00000003,0058BA28), ref: 005866A1

Strings

., xrefs: 0058DB2B
*?, xrefs: 0058D84B

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: d880ea29d1525385f5bc4d26a230f40480b8b7b7c38aab8f8975374564cc868a
Instruction ID: f4d822ebf9ed0023f455fb9ec60a256f318906d6aca64c8aa383a597f77bb1d3
Opcode Fuzzy Hash: d880ea29d1525385f5bc4d26a230f40480b8b7b7c38aab8f8975374564cc868a
Instruction Fuzzy Hash: 5D517075E0011AEFDF14EFA9C881AADBBF5FF98310F244169E855F7341E6319A018B60

Uniqueness

Uniqueness Score: -1.00%

Function 0057D76E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0057D7D1
_wcslen.LIBCMT ref: 0057D7EC

Strings

}, xrefs: 0057D7C4

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: e0911ca8f76912d0d991d98f2e9199904dff9ebf6f7f4050d1fa38bc55d1afd0
Instruction ID: c530d6c98279eaf64e7733993f56a631d59545c5b6828e391610271e594ba07f
Opcode Fuzzy Hash: e0911ca8f76912d0d991d98f2e9199904dff9ebf6f7f4050d1fa38bc55d1afd0
Instruction Fuzzy Hash: 2E21AE3290430A5AD725EB64E849A6BBBFCFFC4710F40442AF988D3141EA60E94897F3

Uniqueness

Uniqueness Score: -1.00%

Function 0057CEBF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0057D392: GetCurrentProcess.KERNEL32(00020008,?), ref: 0057D3A1
Part of subcall function 0057D392: GetLastError.KERNEL32 ref: 0057D3CC

CreateDirectoryW.KERNEL32(?,?), ref: 0057CF61
LocalFree.KERNEL32(?), ref: 0057CF6F

Strings

X, xrefs: 0057CF20

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID: X
API String ID: 1077098981-1346631187
Opcode ID: 6ea3ae8734f0fb7ff301c42647b0a229eed9b46d3388b617640bf62a8787838d
Instruction ID: 3bd9a8bc86b7698a14c660df64b0959869e707ac49c936637f88c6500cab41eb
Opcode Fuzzy Hash: 6ea3ae8734f0fb7ff301c42647b0a229eed9b46d3388b617640bf62a8787838d
Instruction Fuzzy Hash: 2A21C7B190020DAFDB10DFA5E9899EE7BBCFB58340F50812AF815E2150D734DA19DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0057136B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 005712F6: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00571315
Part of subcall function 005712F6: GetProcAddress.KERNEL32(005AC1F0,CryptUnprotectMemory), ref: 00571325

GetCurrentProcessId.KERNEL32(?,00000200,?,00571366), ref: 005713F9

Strings

CryptUnprotectMemory failed, xrefs: 005713F1
CryptProtectMemory failed, xrefs: 005713B0

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 1ff4baa6cee90a1bf7f2dfce276ed59ca7ab9a2655eac9bb6b6334b60eb88f54
Instruction ID: 55830367c9b4a9003a8c2d97ccc8ebf8c308cbfa4feafcfc0801d2cb547e1d71
Opcode Fuzzy Hash: 1ff4baa6cee90a1bf7f2dfce276ed59ca7ab9a2655eac9bb6b6334b60eb88f54
Instruction Fuzzy Hash: CD115631600A25ABDF25AB38EC0596E3F68FF51B24B04C126FC196B252DA30AD45B6D8

Uniqueness

Uniqueness Score: -1.00%

Function 0056D8AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0056D8D3

Part of subcall function 00564C00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00564C13

Strings

%c:\, xrefs: 0056D8C9

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 74fea14c3364178fba02ac5a7ba1e3753d5fc1d374d8e8e85a9f55e1cb3bf298
Instruction ID: 987d12373bec97cc63f13790f0bcf929fdab496545db08586754fbbf964f9aa8
Opcode Fuzzy Hash: 74fea14c3364178fba02ac5a7ba1e3753d5fc1d374d8e8e85a9f55e1cb3bf298
Instruction Fuzzy Hash: 0F01F563A0431279DB207B759C4AD6BAFBCFED5B60741481AF844D3192EA20D840CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 005810F9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0058130A
___raise_securityfailure.LIBCMT ref: 005813F2

Strings

8]\, xrefs: 005813ED

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8]\
API String ID: 3761405300-3102823420
Opcode ID: c8ba3e0b44e795bb20ce75f30db834bf6cdc0a7a9fc506a23824f787833caffc
Instruction ID: 4d1d4b382d2ce578af7bcec292a1aaf63374d4855b8a05d07fd852b1fe8b667d
Opcode Fuzzy Hash: c8ba3e0b44e795bb20ce75f30db834bf6cdc0a7a9fc506a23824f787833caffc
Instruction Fuzzy Hash: 102105B5510F009FD311DF95E885A543BA8FB28310F5050AAEA09CB2A0F3B06AC9EB44

Uniqueness

Uniqueness Score: -1.00%

Function 0057D392 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,?), ref: 0057D3A1
GetLastError.KERNEL32 ref: 0057D3CC

Strings

@X, xrefs: 0057D3A8

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: CurrentErrorLastProcess
String ID: @X
API String ID: 335030130-1000945245
Opcode ID: 827114c041be420b4823157e59b1dd078ba43cfc28922602f0dd038299b8a683
Instruction ID: 4edd17199151635332f3a756a636fed02aff032b70820f59b1b678ba80576e12
Opcode Fuzzy Hash: 827114c041be420b4823157e59b1dd078ba43cfc28922602f0dd038299b8a683
Instruction Fuzzy Hash: 3C010575510208BFDF115BA5EC89EEE7F79FF19350B104466FA05A1050EAB29A48AB70

Uniqueness

Uniqueness Score: -1.00%

Function 0058E19E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0058B9A5: GetLastError.KERNEL32(?,005A50C4,00586E12,005A50C4,?,?,0058688D,?,?,005A50C4), ref: 0058B9A9
Part of subcall function 0058B9A5: _free.LIBCMT ref: 0058B9DC
Part of subcall function 0058B9A5: SetLastError.KERNEL32(00000000,?,005A50C4), ref: 0058BA1D
Part of subcall function 0058B9A5: _abort.LIBCMT ref: 0058BA23

_abort.LIBCMT ref: 0058E1D0
_free.LIBCMT ref: 0058E204

Strings

p,Z, xrefs: 0058E1FB

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ErrorLast_abort_free
String ID: p,Z
API String ID: 289325740-423584262
Opcode ID: f6becc82579b236333ca3151667ff59fcdd66984775de2bd463b545234be70ad
Instruction ID: 66593428416f84116e9ec97cda9d1053c0e120875eb90d985e76420d2c695955
Opcode Fuzzy Hash: f6becc82579b236333ca3151667ff59fcdd66984775de2bd463b545234be70ad
Instruction Fuzzy Hash: 92016D75D01A22DBCB21BF5CC80726DBB78BB59B20B15021AEC6677680CB706D428FC1

Uniqueness

Uniqueness Score: -1.00%

Function 00581405 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00581410
___raise_securityfailure.LIBCMT ref: 005814CD

Strings

8]\, xrefs: 005814C8

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8]\
API String ID: 3761405300-3102823420
Opcode ID: 4709f4b1441fc5e000cfa92acf04607a6108cf2e9d9d276b676e4c8b56d0ab13
Instruction ID: b7afe974cbc5aaf0a18465512f5406b04eb8f7e45807cb3a6f36c7b2b923f838
Opcode Fuzzy Hash: 4709f4b1441fc5e000cfa92acf04607a6108cf2e9d9d276b676e4c8b56d0ab13
Instruction Fuzzy Hash: 6511C0B5510F04DFC711DF95E885A453BB9FB28300B4060AAE9098B371F3B0ABC9AF45

Uniqueness

Uniqueness Score: -1.00%

Function 0058AABA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0058E580: GetEnvironmentStringsW.KERNEL32 ref: 0058E589
Part of subcall function 0058E580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0058E5AC
Part of subcall function 0058E580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0058E5D2
Part of subcall function 0058E580: _free.LIBCMT ref: 0058E5E5
Part of subcall function 0058E580: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0058E5F4

_free.LIBCMT ref: 0058AB00
_free.LIBCMT ref: 0058AB07

Strings

pb\, xrefs: 0058AAED

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID: pb\
API String ID: 400815659-2661721528
Opcode ID: e2aa10e887c351075cf9797ea36c07d4f681d0dfc7597506ba0e764824ab9478
Instruction ID: 10946fba96818baa7edcccd53690a5f9d35c687249678d61592d7ff812d26f0b
Opcode Fuzzy Hash: e2aa10e887c351075cf9797ea36c07d4f681d0dfc7597506ba0e764824ab9478
Instruction Fuzzy Hash: 4FE0E526A0541259F769767EAC0BEAF0D69BBC2371B11061BFD20B75C2EE9088055393

Uniqueness

Uniqueness Score: -1.00%

Function 005730CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,005731E7,?,?,0057325F,?,?,?,?,?,00573249), ref: 005730D0
GetLastError.KERNEL32(?,?,0057325F,?,?,?,?,?,00573249), ref: 005730DC

Part of subcall function 00567BAD: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00567BD5

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 005730E5

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 0c7268d7d006a43abfe168b08d2334a4b8c22a62f462316ab64efd967628e633
Instruction ID: e48be9ffd1c214da7903a02410704cc6f617f98e4e1654fadb25342d93d2c32a
Opcode Fuzzy Hash: 0c7268d7d006a43abfe168b08d2334a4b8c22a62f462316ab64efd967628e633
Instruction Fuzzy Hash: 45D02E3140C83933CA0133246C0EC6E3E08BBA2331F614345F139661F0EF204D45A2D1

Uniqueness

Uniqueness Score: -1.00%

Function 005701FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0056F951,?), ref: 005701FF
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0056F951,?), ref: 0057020D

Strings

RTL, xrefs: 00570207

Memory Dump Source

Source File: 00000000.00000002.2021990414.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2021843297.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022019779.0000000000596000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022039022.00000000005C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2022100190.00000000005C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_qdHMT36Tn9.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 4fc82b5b63960a6b237540e21248a1f1a1aab8e3b27f4a0b36a53f6c3ca9a11b
Instruction ID: 2abde86736b90df5f09f3be42f4fe35337aef8a5db8375570317a6632b6a128a
Opcode Fuzzy Hash: 4fc82b5b63960a6b237540e21248a1f1a1aab8e3b27f4a0b36a53f6c3ca9a11b
Instruction Fuzzy Hash: A9C0123124075096DA3057717C4DB872E587B10711F060459B545DA1C1D6EBC84D9660

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 1.exePID: 4292, Parent PID: 1984COMMON

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F27460 Relevance: 1.7, APIs: 1, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendARP.IPHLPAPI ref: 00007FF848F27538

Memory Dump Source

Source File: 00000002.00000002.2058621585.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f10000_1.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: 0532b33d1758d8ae2f0887e35b2a2fa849b1c835dec0241e850c07b03c2b70fb
Instruction ID: a54f5380824346861f387c9a2b3dc239e1557fc9eeea905471224f928fab3e36
Opcode Fuzzy Hash: 0532b33d1758d8ae2f0887e35b2a2fa849b1c835dec0241e850c07b03c2b70fb
Instruction Fuzzy Hash: 3461E33090DA888FD71AEB7898596A9BFF0EF56320F0941EFD049CB1A3DB645849C752

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3.exePID: 5656, Parent PID: 1984COMMON

Execution Graph

Execution Coverage:	18%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.8%
Total number of Nodes:	174
Total number of Limit Nodes:	8

Executed Functions

Function 00DDB863 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00DDB8E3

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: f821d9416e9db88809abf3930c792019d5ebcb67680c6c95854eaacd4f5ef5de
Instruction ID: dc10f969cbc435a3642c8e2095625549e8a38b994ff565edc0413d8b2bfb5674
Opcode Fuzzy Hash: f821d9416e9db88809abf3930c792019d5ebcb67680c6c95854eaacd4f5ef5de
Instruction Fuzzy Hash: 7221BF765097C09FDB228F25DC40B52BFB4EF16324F09849BE9858B263D370A908DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDBE8F Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 00DDBF05

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 30f080ee0d6c22f969dba8f3ce728ad7901419ede36e932e31a9fe16a939965f
Instruction ID: 511a46ebe3dedc7c20b4fbe61a11ef430a1fb82e968519d584623ebeeaf89b59
Opcode Fuzzy Hash: 30f080ee0d6c22f969dba8f3ce728ad7901419ede36e932e31a9fe16a939965f
Instruction Fuzzy Hash: F921A1754097C09FDB238B21DC45A51FFB4EF17324F0980DBE9848B163D265A909DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDB89A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00DDB8E3

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 95f31dc85f293c0d9d358939b3e63a83e296cc54556d2e55fe8d473811d17e57
Instruction ID: 44176656a235083eba00343cece2465147a30433bc15147294d7be52d5b9c344
Opcode Fuzzy Hash: 95f31dc85f293c0d9d358939b3e63a83e296cc54556d2e55fe8d473811d17e57
Instruction Fuzzy Hash: B2118C726002449FDB20CF15D844B66FBE8EF08324F0884ABED858B652D371E808DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00DDBBC8 Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 00DDBC25

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: ac038eb91b53c40f6b7c1047ba9d9d40fe98f0a6b14626ae5e707a82f655d120
Instruction ID: 50d9404ddda889f88904baf9fc3d7ebbf1df968449ec998a4dbabfa2a51d2285
Opcode Fuzzy Hash: ac038eb91b53c40f6b7c1047ba9d9d40fe98f0a6b14626ae5e707a82f655d120
Instruction Fuzzy Hash: 8211AC71408380AFCB228F15DC45A62FFB4EF16324F09C49FED844B663C275A918DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDB1EA Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,00000E24,?,?), ref: 00DDB23A

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 2f3e365c3db325c7274f8b686034cf671e07b1f7fddce8d1599c386c7bb16854
Instruction ID: 46756942e84085001f8d3c5f873c50fa698a098c52b75a665d40293e138063c9
Opcode Fuzzy Hash: 2f3e365c3db325c7274f8b686034cf671e07b1f7fddce8d1599c386c7bb16854
Instruction Fuzzy Hash: 6001AD71600200ABD210DF16DC86B66FBF8FB89A20F14815AEC489BB42D771F955CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00DDBECA Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 00DDBF05

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: c929e6fb6e8c44ace8e18ccd8e5e2c96e9974f263c6529704b8b174ddf3c89c0
Instruction ID: 9944fe8eeb377b4193f8267cb11f3d6aa8be010107e29e288202c40a3ecaeaf3
Opcode Fuzzy Hash: c929e6fb6e8c44ace8e18ccd8e5e2c96e9974f263c6529704b8b174ddf3c89c0
Instruction Fuzzy Hash: 09015A35500244DFDB208F15D844B65FBA0EF18724F08C49BED854B752D376E458DEB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDBBEA Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 00DDBC25

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: c929e6fb6e8c44ace8e18ccd8e5e2c96e9974f263c6529704b8b174ddf3c89c0
Instruction ID: 8fb27c339bf07f2f45787cbbedab7972e533e3da4a21d98113c1d8a53a2ae70a
Opcode Fuzzy Hash: c929e6fb6e8c44ace8e18ccd8e5e2c96e9974f263c6529704b8b174ddf3c89c0
Instruction Fuzzy Hash: 9C015675500244DFDB208F19D884B61FBA0FB18724F08C0ABEE890A762C375E858DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 01120F90 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 01120FB7

Memory Dump Source

Source File: 00000003.00000002.4480361964.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_3.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5ee1cdf782d6b8b42d860ca55044dea939e008929b8f20c0e55ea00535666ae0
Instruction ID: 6dd71902d5d31d6df97cfee42a810b28e0db750e51c984c4521829ce78822d61
Opcode Fuzzy Hash: 5ee1cdf782d6b8b42d860ca55044dea939e008929b8f20c0e55ea00535666ae0
Instruction Fuzzy Hash: 4541E6317002118FCB08DF79D8845AEB7E6EF84204B158879D809DB39ADF39DD46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012F1AD2 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNEL32(?,00000E24,?,?), ref: 012F1BB6

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 8fbc2294c420f1b38a8ada305f81e396e52f78173d432da444f63e574703c61d
Instruction ID: 7e82e495f33f2a9c8b255f6c49afc1dd371b37f01901a50529653f82f68675c9
Opcode Fuzzy Hash: 8fbc2294c420f1b38a8ada305f81e396e52f78173d432da444f63e574703c61d
Instruction Fuzzy Hash: 18415A6150E3C16FD3038B358C61AA2BFB8AF47214F0E85CBD8C4CF5A3D6246959C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01120F80 Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 01120FB7

Memory Dump Source

Source File: 00000003.00000002.4480361964.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1120000_3.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2d8280e64c39d531f5b91f1457870af4b50e1944683d3e777ea04d674bd5a032
Instruction ID: 1a3315253285fbcf10ac58b429f99dc0155423311b03be29d740d55a6f8699f7
Opcode Fuzzy Hash: 2d8280e64c39d531f5b91f1457870af4b50e1944683d3e777ea04d674bd5a032
Instruction Fuzzy Hash: 144186717002118FCB18DF39C8946AEB7E6EF84204B598879D809DB39ADF39DD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012F2ABA Relevance: 1.6, APIs: 1, Instructions: 99
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(?,00000E24), ref: 012F2B81

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cae2587b35329252abc2ae24d22a15061ac5f9cda62917afa0210c5e28a34ff2
Instruction ID: 3502639fc6efd2223e117e68a8c1f2a6ca95899caa785c46a3602f1f8220dc33
Opcode Fuzzy Hash: cae2587b35329252abc2ae24d22a15061ac5f9cda62917afa0210c5e28a34ff2
Instruction Fuzzy Hash: D7315071504344AFE7228F55DC84FA6FFFCEF16210F08859AEA859B662D324E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012F0C17 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(?,00000E24,?,?), ref: 012F0CDE

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: eb2b20af6a0a061b49811f49bd3f5f8a426d1c5ce1d15fc3b36e25d35d9cb2ed
Instruction ID: 53cc65728fb209c905bff9d409f80ea4b3a39791a4ae2b0824041e05d47a1ea0
Opcode Fuzzy Hash: eb2b20af6a0a061b49811f49bd3f5f8a426d1c5ce1d15fc3b36e25d35d9cb2ed
Instruction Fuzzy Hash: F9317C6510E3C06FD3138B258C61A61BFB4EF47610F0E85CBE9C48F6A3D2696909D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 012F31AC Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F325B

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 621e03c25190317a41e9be07e69856e167baa585908c34cd5aaa14ca14cae19c
Instruction ID: 750b2a1dfde9006bd8720bd97c1f18f61313442c0da9091e3e306aad810c799a
Opcode Fuzzy Hash: 621e03c25190317a41e9be07e69856e167baa585908c34cd5aaa14ca14cae19c
Instruction Fuzzy Hash: 4E3169755093C05FEB138B648C55B96BFB8AF07210F0984EBE984CB1A3D664A809C772

Uniqueness

Uniqueness Score: -1.00%

Function 012F1844 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 012F190B

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: e46b45ca2f1054d746ad45cd7abcd697bf3ffc514d5d8c7537531d36172d6412
Instruction ID: 5d73156e4a8baf760fc272a4af285f31fc04f7cef80d076a569827ae55f4a42a
Opcode Fuzzy Hash: e46b45ca2f1054d746ad45cd7abcd697bf3ffc514d5d8c7537531d36172d6412
Instruction Fuzzy Hash: 7731B1B2504344AFE721CB51CC44FA6FBECEF05314F04889AFA889B692D374A948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DDAA52 Relevance: 1.6, APIs: 1, Instructions: 91
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(?,00000E24), ref: 00DDAB05

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d4bf2b1d65db12578fbf49f94125892c8dcfd3ed05c51114bd7490ef32a28fa0
Instruction ID: 7316da92fe57e9c91c2c72ffaf53b7e6cd222b4672f260104d5163ad8e505f58
Opcode Fuzzy Hash: d4bf2b1d65db12578fbf49f94125892c8dcfd3ed05c51114bd7490ef32a28fa0
Instruction Fuzzy Hash: 563195714083846FE7228B55DC44FA6BFBCEF06314F09849BE9848B653D264A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 012F173C Relevance: 1.6, APIs: 1, Instructions: 90timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F17D9

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 84171b18a0d95ef479edc51c5a73cc939bc9c6fc8c7150f60db4ebc03b0fe840
Instruction ID: 6582cc34a4a56bb95d869102ba3167a8b5f49bb66c5af390750bb4063361dece
Opcode Fuzzy Hash: 84171b18a0d95ef479edc51c5a73cc939bc9c6fc8c7150f60db4ebc03b0fe840
Instruction Fuzzy Hash: 3131D7725093809FE712CF65DC45B96BFB8EF16314F0884AEE9858B193D325A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA612 Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 00DDA6B9

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 90d85a3471128baa4faa759f41dd8a7d9fbf1fe82491b691b371440b8ba311f5
Instruction ID: 1bb8a38d809a4f944634e1bef6557484f6dc9550120828cffe0656df4b0ae867
Opcode Fuzzy Hash: 90d85a3471128baa4faa759f41dd8a7d9fbf1fe82491b691b371440b8ba311f5
Instruction Fuzzy Hash: 2E3181B55097806FE711CB25DC45B96BFF8EF06314F08849AE984CB292D375E909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 012F1130 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 012F11C7

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: ba6b62edbf47852b1a07aba78a3d6b31798888b5cd2afc60383902169e06a9b4
Instruction ID: dba3a0025a4a1b67dc97082e3b4bc129897517fed49e70a153ac32b33ef7510d
Opcode Fuzzy Hash: ba6b62edbf47852b1a07aba78a3d6b31798888b5cd2afc60383902169e06a9b4
Instruction Fuzzy Hash: D6318471504385AFE721CB65DC45FA7FFF8EF05214F0884AAE984DB552D374A818CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DDB189 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,00000E24,?,?), ref: 00DDB23A

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 41792bc952358564b72ddeccd94f4dd1029de39928dc52b34348b45d00b54173
Instruction ID: 6eed9d87a0d357cdc76dc2756de441924480abb087ba71b94a1ddea0a79257e9
Opcode Fuzzy Hash: 41792bc952358564b72ddeccd94f4dd1029de39928dc52b34348b45d00b54173
Instruction Fuzzy Hash: 6631417154E3C06FD3138B259C61B61BFB5EF87610F0E81CBD8848B5A3D6296919CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDBAD0 Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 00DDBB64

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: fc5b426a741b3158fb06c08ddfcf191b3267d94038863df2333918a6d16fa4e2
Instruction ID: cc72ba344c917be3ec99bb477d606bf92ae9b03e3d87fed67b43fbf80e0362bb
Opcode Fuzzy Hash: fc5b426a741b3158fb06c08ddfcf191b3267d94038863df2333918a6d16fa4e2
Instruction Fuzzy Hash: 7A21B1B15093806FE7128B21DC45BA6BFB8EF46324F0984DBE984CF193D264A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DDADAD Relevance: 1.6, APIs: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 00DDAE51

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 501bfca6b896acfa59e547bfcb5e0e35a7772d3ea58b5805728addb05bd22da6
Instruction ID: b97e57f0c05c5646c51c35e4b53b2240d7c4807deb286614effb170bb083a966
Opcode Fuzzy Hash: 501bfca6b896acfa59e547bfcb5e0e35a7772d3ea58b5805728addb05bd22da6
Instruction Fuzzy Hash: E8315E71504344AFE721CF65DC85F56BBE8EF05314F08849EE9858B652D375E808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 012F2AE6 Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(?,00000E24), ref: 012F2B81

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 414bdf8237dde50ab0e2a2a3f35aec4e5b37083320abe858c965532032947632
Instruction ID: 34899855cd9f9c596297dc4896e1a5259c11c75b000de7bf9c1af4872ac50d69
Opcode Fuzzy Hash: 414bdf8237dde50ab0e2a2a3f35aec4e5b37083320abe858c965532032947632
Instruction Fuzzy Hash: 07219E72500208AFEB218E15DC81FA7FBECEF19614F04846AEE85D7652E734E508CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA361 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 00DDA40C

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0848bccffb7e8600567e6ae7226d13e34cfe5a62e3e1c521d1aafcd0c1ca47a1
Instruction ID: f995bff2371d93bd0998ef89d0a31d422419f845e02273fd3027938e786a6b21
Opcode Fuzzy Hash: 0848bccffb7e8600567e6ae7226d13e34cfe5a62e3e1c521d1aafcd0c1ca47a1
Instruction Fuzzy Hash: 7F318075504784AFD722CF55CC84F92BBF8EF06710F08849AE9858B292D364E909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 012F1866 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 012F190B

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: d6e6dc4e022b57a09bc9c140de45dd1f5d0f113d6356ffc0b29d1f76ed18f260
Instruction ID: 1047cf5879561e0a8d52b1e0ba83f30339308e0d9fde07cab5ba269f2860b87b
Opcode Fuzzy Hash: d6e6dc4e022b57a09bc9c140de45dd1f5d0f113d6356ffc0b29d1f76ed18f260
Instruction Fuzzy Hash: 0521A372500205AFEB21DF61DC45FA6F7ECEF04714F04885AFA899A681D7B4A548CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA120 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E24,?,?), ref: 00DDA1C2

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 66da86929fbae9159787d54d3be652ae8cfce2375f35da3dd2d363f2f543e686
Instruction ID: 55874024b439e54e15309c05dba3d06e3308c2bdd0448ae2a2789d2578e8ebaf
Opcode Fuzzy Hash: 66da86929fbae9159787d54d3be652ae8cfce2375f35da3dd2d363f2f543e686
Instruction Fuzzy Hash: 1821AE7150D3C06FD3028B658C61BA6BFB4EF87610F1984CBD8C4DF693D225A919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 012F2D59 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 012F2DE8

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 174ae9f197a297d4546e2e6e0d133e27e658c704bbe0f32a5d84f2703028f202
Instruction ID: 69c5f298302882136ec7a591a2f0581f35c8f6919fb68a03f5d53fc0e59ed871
Opcode Fuzzy Hash: 174ae9f197a297d4546e2e6e0d133e27e658c704bbe0f32a5d84f2703028f202
Instruction Fuzzy Hash: 84215E755083849FD722CF25DC44A92FFF8EF06214F0884EAEA84CB163D274E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DDAEA8 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 00DDAF3D

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6b4e1ef90a55b99dd6058d17ea56dcc108d987e1541fb3557325d7cc0c986975
Instruction ID: 469bce8b7ea382071744b9e1f7f73c07ac882b48e5995b861ec076d5eab9b761
Opcode Fuzzy Hash: 6b4e1ef90a55b99dd6058d17ea56dcc108d987e1541fb3557325d7cc0c986975
Instruction Fuzzy Hash: C621FBB54053805FD7128F25DC41BA2BFBCEF47724F0984D6E9808B2A3D264A909CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 00DDA4F8

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b2468d7f24e1b4bd7f68628b17118fec71c036660f1e7da719ed981612a78c06
Instruction ID: a98ed9a8a3740c5be497804e403f85389dca28ac851fd0002389fd821406f69c
Opcode Fuzzy Hash: b2468d7f24e1b4bd7f68628b17118fec71c036660f1e7da719ed981612a78c06
Instruction Fuzzy Hash: E2218EB65043806FD7228F15DC44FA7BFB8EF46710F08849AE985CB652D264E848CB72

Uniqueness

Uniqueness Score: -1.00%

Function 012F0D0A Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 012F0D96

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 80a6c47cacdaab1071c55a65bb57429edc0ac2ede5f9748d8d2053aaf50f4651
Instruction ID: d0e8957cd2612eba2db8bbe32fc9b0303fb478814929cc5b6426dc672c61e54e
Opcode Fuzzy Hash: 80a6c47cacdaab1071c55a65bb57429edc0ac2ede5f9748d8d2053aaf50f4651
Instruction Fuzzy Hash: 3A218071509384AFD722CF55DC45F96FFF8EF06214F08889EE9858B692D375A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 012F12E6 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 012F137A

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 664615f488e5a95b5d5e791af5d626bb60422165e24f1382d4bd27f464a6560e
Instruction ID: 299e9ea06cf2987bfac6606b86c4860b5fd384050d3d63a30ff7f9abdd52b02a
Opcode Fuzzy Hash: 664615f488e5a95b5d5e791af5d626bb60422165e24f1382d4bd27f464a6560e
Instruction Fuzzy Hash: C121D171404380AFE722CF55CC44F96FFF8EF09224F04849EEA858B652D375A908CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDADD2 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 00DDAE51

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d7a1b3bcd5e5decfb99c5201e115715800362a884a31a578e0e0868f89207393
Instruction ID: 4dc129208642986d351985ceaf0b2517ca43304d8b3000aee61eecced3260714
Opcode Fuzzy Hash: d7a1b3bcd5e5decfb99c5201e115715800362a884a31a578e0e0868f89207393
Instruction Fuzzy Hash: 15214F71604244AFE721DF65DC45B66FBE8EF04724F08846AE9858B751D375E808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 012F103E Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F10DC

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 62cbb85cc897ba6f24586dcc444dbd2f4366da30726a4e122bd82f51a15183c5
Instruction ID: 9a39e06dbf9a1ff502640bb5d225b5d6df6d3bc4c7ceadf616c95462623aedc1
Opcode Fuzzy Hash: 62cbb85cc897ba6f24586dcc444dbd2f4366da30726a4e122bd82f51a15183c5
Instruction Fuzzy Hash: 02219C72504380AFE722CB15CC44F67FFF8AF45610F08849EEA859B292D324E808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 012F1156 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 012F11C7

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 1d2e860438eb041e6a022c2ea89a214bc02f33e0dda92fff618affcf9654b349
Instruction ID: 40e843ccf807e7312f0305adfc7618d704d1c78313848e4e582fdacb5170b9e7
Opcode Fuzzy Hash: 1d2e860438eb041e6a022c2ea89a214bc02f33e0dda92fff618affcf9654b349
Instruction Fuzzy Hash: 5E21C272600204AFE720DF65DC45BABFBECEF04214F04846AEE45DB652D374E418CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDAA86 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E24), ref: 00DDAB05

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5ae14cd87f12a5b9003c1a99ac642e1572b0e85fc700cfdf7187b0f2443e52a4
Instruction ID: a45956b149c40126ab5611f91f4cbc01d7fad0493fd60a0423cb89b439d96b5b
Opcode Fuzzy Hash: 5ae14cd87f12a5b9003c1a99ac642e1572b0e85fc700cfdf7187b0f2443e52a4
Instruction Fuzzy Hash: 8521BE72500204AEE7209F55DC44FAAFBECEF14324F08845AE9858B752D774E948CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 012F32C3 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F333F

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: b49624ee9ddb135a41953032607547e3e9e6323d490ca2ab8c8ae5bbd01303f9
Instruction ID: 4f1f8d88dac9588d6c12a0de85e8214b244f388bcf15a83501ab53c28cf6ff5f
Opcode Fuzzy Hash: b49624ee9ddb135a41953032607547e3e9e6323d490ca2ab8c8ae5bbd01303f9
Instruction Fuzzy Hash: 512195715093846FD712CB15DC45FA6FFA8EF45214F08C4AEE985CB252D374A908CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 00DDA6B9

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 9f9a7b7bfe8b087400c0e43767002aa067bbbcb36464c44f0fcccf86bb7e5477
Instruction ID: f44028e03432931931ca40d51340505265768c8c16214532bd5c2fd11e0eaf3c
Opcode Fuzzy Hash: 9f9a7b7bfe8b087400c0e43767002aa067bbbcb36464c44f0fcccf86bb7e5477
Instruction Fuzzy Hash: A3217F71604244AFE720CB29DC45BA6FBE8EF04724F08C46AE9858B741D375E809CA76

Uniqueness

Uniqueness Score: -1.00%

Function 012F157D Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F1600

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 56db2b66ea39ed28266d922f0a02d76761358d29291f446a428b942b1d2f229a
Instruction ID: 7ff2bfecd6a17141066a73e25acd8be1ec5db4c2ebb011263a42282910fbc19b
Opcode Fuzzy Hash: 56db2b66ea39ed28266d922f0a02d76761358d29291f446a428b942b1d2f229a
Instruction Fuzzy Hash: B02195B1509384AFD712CB15DC45B56FFB8EF46214F0884DBE984DB253C368A548CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDB5B5 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00DDB62E

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 83419f7334b3ba470b057ffd465c71edcd3e73ef0558372c144576bd5250f0c1
Instruction ID: 902a729e53d430394acffc49ad4ac459326dfe4b18d0019240ba0923e807509a
Opcode Fuzzy Hash: 83419f7334b3ba470b057ffd465c71edcd3e73ef0558372c144576bd5250f0c1
Instruction Fuzzy Hash: 03217F715083809FD7118B25DC95B92BFE8EF16224F0984EBE885CF263D264E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012F0AA2 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F0B21

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1d30b9a028fc3872ea3b94ce0c34b6eddc2e4047e96122646a8e656cc4e6db1e
Instruction ID: af2e8af183c5e16d70f8c3142d2e2ba85be1e36d3f920621f6c44f89af08152a
Opcode Fuzzy Hash: 1d30b9a028fc3872ea3b94ce0c34b6eddc2e4047e96122646a8e656cc4e6db1e
Instruction Fuzzy Hash: FF218071505384AFD722CF55DC44FA6FFB8EF45714F08849AE9858B152D374A408CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 00DDA40C

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 911aeb97d7d681ace244a95c5af0bb16c9003cd501ac606ee76e91ed20602775
Instruction ID: 3102311ae9d5cedd29c3348f2a31829db5241ba2c8cd50cfec6dbc2c44c484c3
Opcode Fuzzy Hash: 911aeb97d7d681ace244a95c5af0bb16c9003cd501ac606ee76e91ed20602775
Instruction Fuzzy Hash: ED216D756002049EE720CF59DC84FA6B7ECEF04720F08C46AE9858B751D7A4E949CA72

Uniqueness

Uniqueness Score: -1.00%

Function 012F2C93 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F2D0F

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: f26269a9aecbafeef21f8c3b7042e50fdf2dd955b38a6f2ec37ae89d2ad2c83d
Instruction ID: efb5ea03f915b6b91551cf2651fb8f3b207fb464dc0bd65fa5300f79cf884b73
Opcode Fuzzy Hash: f26269a9aecbafeef21f8c3b7042e50fdf2dd955b38a6f2ec37ae89d2ad2c83d
Instruction Fuzzy Hash: 3621A4715093846FD722CF15DC44F96FFB8EF46314F0884AAE9859B152C374A508CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDAB4D Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDABCB

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 191bc6384fe7924fd95e73062f340c1436360018b2d1b55b5a0977552956779b
Instruction ID: 710bf4a363bca8c6d464089048e08de23051671c4c6c47e01ae902a5c1135ecf
Opcode Fuzzy Hash: 191bc6384fe7924fd95e73062f340c1436360018b2d1b55b5a0977552956779b
Instruction Fuzzy Hash: 742192755093C45FDB11CB25D885B92BFA4EF07324F0D84EFE8858B267D264A849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDB930 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDB99C

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 89c15573e43f357a2dfd17df5674e75f5fcaa7f2107e0b6fb556f40202eb37b4
Instruction ID: 8c23456db64caaba701459b9bdbd48e5468dfe816485266bb4ae86f9d67e65e3
Opcode Fuzzy Hash: 89c15573e43f357a2dfd17df5674e75f5fcaa7f2107e0b6fb556f40202eb37b4
Instruction Fuzzy Hash: AF21D1725093C05FDB128B25DC54692BFB4AF03324F0D84DBED858F663D264A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA710 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDA780

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6aa55e72fbcf6fe4483e33a0dfd492024e412de5beeafa967937b5a109763098
Instruction ID: 00c819c13adc19532378f7ba74f8101801f072aaa64f71fe0daca89403e5c8f3
Opcode Fuzzy Hash: 6aa55e72fbcf6fe4483e33a0dfd492024e412de5beeafa967937b5a109763098
Instruction Fuzzy Hash: A321D2B55043809FD711CF15ED85B52BFB8EF02324F0984ABEC458B293D375A905DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 012F0D2A Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 012F0D96

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 4234216fa0c266af14ac58c1351363da538a3a91a9f51261b9a1d6d19c74f6b9
Instruction ID: 5a04eab22f0c924f13a7caff75b79d2778a268908f4527580964b950e49855da
Opcode Fuzzy Hash: 4234216fa0c266af14ac58c1351363da538a3a91a9f51261b9a1d6d19c74f6b9
Instruction Fuzzy Hash: AD21D171504204AFEB21CF55DC45BAAFBE5EF05324F0488AEEE858B692C375F408CB66

Uniqueness

Uniqueness Score: -1.00%

Function 012F1306 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 012F137A

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: eff6bd2212126ec1d335634cfbfccdee4370ab5b9cf18339c73045d13c623219
Instruction ID: 6d46ed3328b35ed0550fa90a20bba660dc12156dfcf3924eb62936fa0303d7a9
Opcode Fuzzy Hash: eff6bd2212126ec1d335634cfbfccdee4370ab5b9cf18339c73045d13c623219
Instruction Fuzzy Hash: DE21C372500244AFE721CF55DC45F96FBE8EF08224F04846DEA858BA51D375F558CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 012F1A16 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 012F1A92

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 7f60b0126d4962f14346422537645bc8956bfac20e342c7e32d23cc9cb5e6fea
Instruction ID: 01d7ed8495a0317b73e7e9557a60280098a48b4d71dff8a51759b1de5fcb50a4
Opcode Fuzzy Hash: 7f60b0126d4962f14346422537645bc8956bfac20e342c7e32d23cc9cb5e6fea
Instruction Fuzzy Hash: C3215E71508384AFDB22CF55DC44B62FFF4EF06610F08849EEA858B163D375A818DB61

Uniqueness

Uniqueness Score: -1.00%

Function 012F1DD2 Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E24), ref: 012F1E5B

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 986be1e169934dad1a93487a87451b1843d328404236a34416e99ff17bcdffe9
Instruction ID: bba4b9ad914813d399a4dbe26635a5de817c0fed0219b1c79c53ffc10208e784
Opcode Fuzzy Hash: 986be1e169934dad1a93487a87451b1843d328404236a34416e99ff17bcdffe9
Instruction Fuzzy Hash: 7211D671504380AFE721CF15DC85FA6FFB8DF46720F04809AFE849B292D274A948CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 00DDA4F8

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 68ce2bdc94014b51fc80b20d9d0bbc97a19f3e2c34abe9628d563f5186aabb7e
Instruction ID: d36690dd98c03460ed0ad84046f392b61b7341738e74ab44c44d2f118c0d269b
Opcode Fuzzy Hash: 68ce2bdc94014b51fc80b20d9d0bbc97a19f3e2c34abe9628d563f5186aabb7e
Instruction Fuzzy Hash: F1118176500604AFEB218E15DC45FA6FBECEF14724F08C45AED858B751D374E848CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 012F106A Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F10DC

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 44e99c538a73f534205a9eda81bae5aa1f2bcd91990d60f381369c0daf346736
Instruction ID: c775727a2aa62a13a0b67b7afcdb53f375df175dd3a608614328b543e6d5a51c
Opcode Fuzzy Hash: 44e99c538a73f534205a9eda81bae5aa1f2bcd91990d60f381369c0daf346736
Instruction Fuzzy Hash: EF119D76600204AEE721CE15DC41BA6FBE8EF04624F04C46EEE469B652D374E458CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDACE8 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDAD52

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: f7f0d60f8d9f88623821697979a47dfc5a08dbb74edb28ba402a3af0fdc58220
Instruction ID: 762d9033e30d17914176807cdb9a891e857bcdbbafc9fa723441958e71865b51
Opcode Fuzzy Hash: f7f0d60f8d9f88623821697979a47dfc5a08dbb74edb28ba402a3af0fdc58220
Instruction Fuzzy Hash: DC1130726053805FD721CF29DC85B56BFE8EF16610F0C84AAE985CB652E274E804CB62

Uniqueness

Uniqueness Score: -1.00%

Function 012F0006 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012F0076

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a0aabe6629dae2029719d8db607da589987d819f9ee7a3a2f63aec9f09257465
Instruction ID: 4487539484d6261e90071ef1659daab9feca1fcafb1601c74d219dc035bbe2d1
Opcode Fuzzy Hash: a0aabe6629dae2029719d8db607da589987d819f9ee7a3a2f63aec9f09257465
Instruction Fuzzy Hash: 74219371409380AFDB228F65DC44A62FFF4EF46314F0884DEEE858B163D276A419DB62

Uniqueness

Uniqueness Score: -1.00%

Function 012F177A Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F17D9

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: cdfc3d6a60163709babe43d99acf25fa5a672214aefa6990c4f9e44be1a93a07
Instruction ID: 09e2004ac6b3640a5f071cea64c8465766ac434d753573ea363a5e432ee5f54a
Opcode Fuzzy Hash: cdfc3d6a60163709babe43d99acf25fa5a672214aefa6990c4f9e44be1a93a07
Instruction Fuzzy Hash: F4119072600204AFEB21CF55DC45BAAFBE8EF04724F04C46EEE458B651D374E858CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 012F3202 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F325B

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 1d54f1a26431ad05d46f1c5438890079a1c93b4b76244043447b11e85d07074c
Instruction ID: 1015c0555c0748b3369f623d778f3d6976b4ff63fd5d3cdea537072475e91694
Opcode Fuzzy Hash: 1d54f1a26431ad05d46f1c5438890079a1c93b4b76244043447b11e85d07074c
Instruction Fuzzy Hash: AC11B2755002049FEB21CF55DC45BAAF7E8EF44724F04C46AEE458B641D374A808CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 012F32E6 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F333F

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 1d54f1a26431ad05d46f1c5438890079a1c93b4b76244043447b11e85d07074c
Instruction ID: aae7e65f7b6b3993074aa7cf1b30bf4354bfef56ab24b8fd3f5c65574cd34a0a
Opcode Fuzzy Hash: 1d54f1a26431ad05d46f1c5438890079a1c93b4b76244043447b11e85d07074c
Instruction Fuzzy Hash: 6011B2725042049FEB21CF15DC45BAAF7E8EF04724F08C46EEE458B741D774A448CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDBB0E Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 00DDBB64

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 1b3bfdd086fb0b2f5a9e4d4f0bbe83c06dfe45ed357186daef8b267c2751bee8
Instruction ID: 219f3d9e5a28c29ddeddde88c15db38e4abe61f0da1159a67838445904fe4356
Opcode Fuzzy Hash: 1b3bfdd086fb0b2f5a9e4d4f0bbe83c06dfe45ed357186daef8b267c2751bee8
Instruction Fuzzy Hash: FB11C171A00204AFEB20CB15DC45BAAB7D8DF44728F18C4ABED458B741D374E808CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDBDE4 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDBE46

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: fa216051f545f471255407ed08441ec42e7b582a647be7001dee4524f3538b88
Instruction ID: 99cc60cf916bc6a5d13bf30bc5220a279f58ee2d0577132d02ac699d9ab0a025
Opcode Fuzzy Hash: fa216051f545f471255407ed08441ec42e7b582a647be7001dee4524f3538b88
Instruction Fuzzy Hash: 7C116D755057849FD721CF65DC84A96BFE8EF46220F0984ABED458B262D374A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012F0AC2 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F0B21

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 480938a86e0e98a6265cdfb3a7d99c276cb430ed6cb0899b4300671cf6d231a3
Instruction ID: bf9dedb6345b6d6f56989b4589df78c51a2c640cad26c7aa57122531b00a68c8
Opcode Fuzzy Hash: 480938a86e0e98a6265cdfb3a7d99c276cb430ed6cb0899b4300671cf6d231a3
Instruction Fuzzy Hash: 4A118271500208AFEB21CF55DC45FA6FBE8EF04728F1484AAFE458B652D375A448CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 012F2CB6 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F2D0F

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 94cc9e0514d6409379782234090515d48055b57449cccf2f201a5ee21ac2c405
Instruction ID: 99e0f268095c3fbf042f14e5260c36c50e2dc0516cc13f34694972477160d4fa
Opcode Fuzzy Hash: 94cc9e0514d6409379782234090515d48055b57449cccf2f201a5ee21ac2c405
Instruction Fuzzy Hash: A811C671500204AFE721CF55DC45BA6FBE8EF55724F04C4AAEE458B691D374E408CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA9B5 Relevance: 1.6, APIs: 1, Instructions: 57comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 00DDAA14

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 45c2ec4f0c88fb017ec39fe0ca98faf6718ece72b737adf3d58696a9971fdf98
Instruction ID: 42e8ce0d4ff7ffa2eb02b6794111d9bdff6d8bef02b07afda60fdb921ca2931b
Opcode Fuzzy Hash: 45c2ec4f0c88fb017ec39fe0ca98faf6718ece72b737adf3d58696a9971fdf98
Instruction Fuzzy Hash: EB1160715093C05FDB12CB25DC45692BFB4EF07220F0884DBED848F253C275A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 012F15AA Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 012F1600

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 088a7d4ea99c412ca57f22cba747c34d32c325b9144b84e5fcc60637f8586eb1
Instruction ID: 8dafd673e160fd2bf64828ec78691d7790681b2ba829a66f1dcccf2fd34f8268
Opcode Fuzzy Hash: 088a7d4ea99c412ca57f22cba747c34d32c325b9144b84e5fcc60637f8586eb1
Instruction Fuzzy Hash: 0A11E971500204AFEB11CF15DC45BA6F7E8DF04724F18C4AAEE459B641D374A448CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA2D2 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDA330

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 5ce8537f1d25775670fae252c5e562507f8861534ac48191e7c5788f9ecb3a35
Instruction ID: 8db3539a963984b29884c0db0216b823b445963afdef1662883de1a3a6f32b2b
Opcode Fuzzy Hash: 5ce8537f1d25775670fae252c5e562507f8861534ac48191e7c5788f9ecb3a35
Instruction Fuzzy Hash: 071191714093C06FDB228B19DC54A62BFB4DF57624F0D84DBED848B263C265A908D772

Uniqueness

Uniqueness Score: -1.00%

Function 012F1DF2 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E24), ref: 012F1E5B

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0e4ef2e003e82f06582a44b1f20868af7709b19db2b672d74faffbe7be50bf97
Instruction ID: a5fd089069a65a98be11a4700fc7a25961246f686e055438d4575d433358fcfe
Opcode Fuzzy Hash: 0e4ef2e003e82f06582a44b1f20868af7709b19db2b672d74faffbe7be50bf97
Instruction Fuzzy Hash: 9811C271510204AEE7208F15DC41FA6F7A8DF44724F1480AAEE445A682D3B4A948CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 012F2D92 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 012F2DE8

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: add5033c21be43a7db46c9c6e0528d57af99d9b846a2170db70852d6afaf76e3
Instruction ID: f7aed4405f683914ebb5c9955b742a60a9e5c036da079e7555bcb8d230fe1131
Opcode Fuzzy Hash: add5033c21be43a7db46c9c6e0528d57af99d9b846a2170db70852d6afaf76e3
Instruction Fuzzy Hash: B1114F75610204DFEB20CF59D884BA6FBE8EF05610F0884BEDE49CB652D374E848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00DDA0D5

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 12671abdef24890c01d502754fe84daca27a37c74ba20811b61fcf761d859e70
Instruction ID: 7ee723ea0b53eff4e8a0fb5c526683b28fc50390cf906b5886951981e1aa949d
Opcode Fuzzy Hash: 12671abdef24890c01d502754fe84daca27a37c74ba20811b61fcf761d859e70
Instruction Fuzzy Hash: 23118F71549380AFDB22CF15DC44B52FFB4EF56324F08849FED858B662C275A818DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDB5E6 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00DDB62E

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 33ad1548ba0ac83137235eac19a221e20bd11a78c9edcad793f2f3e2479c875e
Instruction ID: fade7001857cb4d839d5bfff847aa42a8d15ed47a9cb93ce2adddb2b617edf5d
Opcode Fuzzy Hash: 33ad1548ba0ac83137235eac19a221e20bd11a78c9edcad793f2f3e2479c875e
Instruction Fuzzy Hash: 01115A71A042048FDB20CF2AD885B66BBE8EB14724F0884ABEC49CB752D374E804CA71

Uniqueness

Uniqueness Score: -1.00%

Function 00DDAD0A Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDAD52

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 33ad1548ba0ac83137235eac19a221e20bd11a78c9edcad793f2f3e2479c875e
Instruction ID: 7220f46172d2cc6abe0777a7a7665f05655d5d4f00b07626721605475627feef
Opcode Fuzzy Hash: 33ad1548ba0ac83137235eac19a221e20bd11a78c9edcad793f2f3e2479c875e
Instruction Fuzzy Hash: 0F1130726042458FDB20CF29D845756FBE8EF15721F08C4AAED45CBB52E674E844CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00DDAEEA Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E24,03534817,00000000,00000000,00000000,00000000), ref: 00DDAF3D

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 41a3039cca72d7fe0a5467e53acfb08473e0929ae4dbe4d0056c86fbeaaa6408
Instruction ID: e784449dc56c8d5efc00efe1f0a8154425737b07ba863bf8792859003f7ee47a
Opcode Fuzzy Hash: 41a3039cca72d7fe0a5467e53acfb08473e0929ae4dbe4d0056c86fbeaaa6408
Instruction Fuzzy Hash: F701C0B5504204AEE720CB15DC85BA6F7E8DF04724F18C0DAFD858B791D378E848CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA918 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 00DDA96F

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: 170afe536ebd45954ff6389084ed970fb15aa6da7c6af6ddf8b0a5d9eb32bc9e
Instruction ID: c0515e80ba63aa97d6eb9a4f4d472d7d6f04d57dd4276a736d4e8f375f1267f9
Opcode Fuzzy Hash: 170afe536ebd45954ff6389084ed970fb15aa6da7c6af6ddf8b0a5d9eb32bc9e
Instruction Fuzzy Hash: F5115E715093849FDB21CF55DC85B56FFA4EF46320F0984AAED858B262D279A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDBE06 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDBE46

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 2c606fd5f852ee6cbdf4428c521d80331eef5408f664a03bf450f673288a5cfe
Instruction ID: 0bc43f0d88e6e20060f94a935df8cb450e8106a0d9ac83ef45ee5205b8d45f67
Opcode Fuzzy Hash: 2c606fd5f852ee6cbdf4428c521d80331eef5408f664a03bf450f673288a5cfe
Instruction Fuzzy Hash: D0118E756006448FDB10CF25D884B96FBE4EF14324F0884ABEE498B752D374E844CA61

Uniqueness

Uniqueness Score: -1.00%

Function 012F1A46 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 012F1A92

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 1d47a69e2f5ae4bda3edfc015ca476474c6e4bc4f75cee5fa96606ba8df3faf0
Instruction ID: 224a8eac9a018eb46513c4fa4ca83d9a26dd2e88f5c58ed019f3074f8dbba324
Opcode Fuzzy Hash: 1d47a69e2f5ae4bda3edfc015ca476474c6e4bc4f75cee5fa96606ba8df3faf0
Instruction Fuzzy Hash: 36119A31500204DFDB20CF55D844B66FBE4EF08220F0888AEEE458B662D375E418DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DDAB8E Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDABCB

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: be0f16bea2b373b29d522c7aa7120cc714a5d6a16d933851f40e28820f74daf7
Instruction ID: 33ef03d75e092de8d76da863398c9832f3a99d8eabe217aefe0f9ad879ca318f
Opcode Fuzzy Hash: be0f16bea2b373b29d522c7aa7120cc714a5d6a16d933851f40e28820f74daf7
Instruction Fuzzy Hash: 0E018C75A042448FDB20CF2AD885766FBE8EF04720F08C4ABED49CB752D374E844CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA172 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E24,?,?), ref: 00DDA1C2

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: b15fb3b98a0108f6cc0cdbb6a3043247d58c084d0559d3963567300844ba54e2
Instruction ID: 8db86b32303a4afccecc09746a920e8ce09be0f535e44e9948938cafe0a47ba0
Opcode Fuzzy Hash: b15fb3b98a0108f6cc0cdbb6a3043247d58c084d0559d3963567300844ba54e2
Instruction Fuzzy Hash: 3101B171600200AFD310DF16DC46B66FBE8FB89A20F14815AEC489B741D731F915CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 012F1B66 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32(?,00000E24,?,?), ref: 012F1BB6

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 8319c6bdf10c3462d9102dd769fc4d55628b2a517b8ec8c31129c9867441c827
Instruction ID: 58d1b1d5c22554badae9d4671283dce8c3104de46ce3a4a42c1fd8395babb0ea
Opcode Fuzzy Hash: 8319c6bdf10c3462d9102dd769fc4d55628b2a517b8ec8c31129c9867441c827
Instruction Fuzzy Hash: 2D019E71600200ABD210DF16DC46B66FBE8EB89A20F14811AEC489B742D731B915CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 012F0032 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012F0076

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: df039f2281fa5b59ab7c8a47a7218a21ce6f099e32edf64d6f493df00af328c1
Instruction ID: 0de02cb2d6111a7db8d29aa5895c79b6418caab70a9eab0240eade819c66ab69
Opcode Fuzzy Hash: df039f2281fa5b59ab7c8a47a7218a21ce6f099e32edf64d6f493df00af328c1
Instruction Fuzzy Hash: CE01AD325102049FDB21CF55D844B66FBE1EF08720F08C8AEEE894B652C376E418DF62

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA74E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDA780

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 31ec4af9b88b2a42c048feb67b5ce7f86b80aa8886e3d3c5094c289eb1dd8ee9
Instruction ID: 82c69ca77a4bd7f96551f9b2f425c94182501d9022db655babe519c91dcbd209
Opcode Fuzzy Hash: 31ec4af9b88b2a42c048feb67b5ce7f86b80aa8886e3d3c5094c289eb1dd8ee9
Instruction Fuzzy Hash: 7501DF75A042449FDB10CF2AE885766FBE4EF00720F08C4ABDC498B752D374E848CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDB96A Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDB99C

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 72d9b126e5d885c5952487e2dee755edf82169fbbcec3bb11608da01653e435e
Instruction ID: c36d8d560b0fad03f8d0b1485bd27c2f0a6d5b40288e213e0d17b8d9a15a3b91
Opcode Fuzzy Hash: 72d9b126e5d885c5952487e2dee755edf82169fbbcec3bb11608da01653e435e
Instruction Fuzzy Hash: FD019E756042848FDB10CF16D885756BBA4EB14734F08C0ABDD498B752C374E848CE72

Uniqueness

Uniqueness Score: -1.00%

Function 012F0C8E Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,?,?), ref: 012F0CDE

Memory Dump Source

Source File: 00000003.00000002.4480435887.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12f0000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bdfe55831ddd0981f258c6238b1888ee6d60045e1b57eb4935d474403e16bdaf
Instruction ID: 2551020688b15f1233197b2c9ecbc992d92796a507a9f654cbadc0132d30db46
Opcode Fuzzy Hash: bdfe55831ddd0981f258c6238b1888ee6d60045e1b57eb4935d474403e16bdaf
Instruction Fuzzy Hash: 9501A271600200ABD210DF16DC46B66FBF8FB89A20F14C11AEC489BB42D771F955CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00DDA0D5

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f7336227c9be84777444a3f18e80c4fbfebeb9f3d48b3d593cedd422c257fb99
Instruction ID: 28ca852480cda7f22607ee352b94420a33a93268d5cbbec0197bc5a430fced76
Opcode Fuzzy Hash: f7336227c9be84777444a3f18e80c4fbfebeb9f3d48b3d593cedd422c257fb99
Instruction Fuzzy Hash: 860188715042449FDB20CF59D884B66FBA0EF18724F08C4AAED898B652D375E448DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA93A Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 00DDA96F

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: f2417d11deb6e85cca7f7d6e50644b856d14aa8f20373aed117faeedcd376295
Instruction ID: 971873cbabcd55e87e511a3be8695fe19d665ad3c8a9e200b57d795bc4e066fe
Opcode Fuzzy Hash: f2417d11deb6e85cca7f7d6e50644b856d14aa8f20373aed117faeedcd376295
Instruction Fuzzy Hash: B9017C719042449FDB20CF19D884B65FBA4EF04724F08C4ABDD498B756D375E444CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA9E2 Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 00DDAA14

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 673dfba4d60bf749f165303a1e08c8aa588082e3203b293ff520c2d3bef23ddc
Instruction ID: bf167409c39570e8086808c49802acb5e992a8f8e2cdba023f3ba03d4f8748d7
Opcode Fuzzy Hash: 673dfba4d60bf749f165303a1e08c8aa588082e3203b293ff520c2d3bef23ddc
Instruction Fuzzy Hash: C1018B719042849FDB20CF19D984765FBA4EF04724F08C4ABED498B752D3B9E848CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDA2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,03534817,00000000,?,?,?,?,?,?,?,?,6C2D3C58), ref: 00DDA330

Memory Dump Source

Source File: 00000003.00000002.4479894969.0000000000DDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dda000_3.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 27c4d9b53519e1b6ede370c8d79b7c5c662eac6a8b44180ed81cc0174a1ce895
Instruction ID: 807afc022fcb4823664017abaca7903fa6e6a37c2b1b4fbf26f505621890cb96
Opcode Fuzzy Hash: 27c4d9b53519e1b6ede370c8d79b7c5c662eac6a8b44180ed81cc0174a1ce895
Instruction Fuzzy Hash: 31F08C759042449FDB208F0AD885765FBA0EF14724F08C4AADD494B752D2B9E848DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 01131072 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4480392186.0000000001130000.00000040.00000020.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d16bab3a835901d9d6e3768ef1580f5bc34cbb5f9cd1ccb5dd983e69bed92e
Instruction ID: 19b8d1a2eaf4d0eb57f387a15f4387022084de4feedf4797d49baa3a25d6d8ca
Opcode Fuzzy Hash: f4d16bab3a835901d9d6e3768ef1580f5bc34cbb5f9cd1ccb5dd983e69bed92e
Instruction Fuzzy Hash: 7921A5715093C09FD722CB25DC84B62BFF8EB46624F09849BD9458B653C3399808C762

Uniqueness

Uniqueness Score: -1.00%

Function 05802400 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4484956529.0000000005800000.00000040.00000800.00020000.00000000.sdmp, Offset: 05800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5800000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a77ccd32e5edab91e35edcf929743aa7ad38a133f607d1b46e4aecac99624eb6
Instruction ID: c3da7ef81c8356f81d80a42b3f23df02a61a98d35fd09593ce6c4759de2435ce
Opcode Fuzzy Hash: a77ccd32e5edab91e35edcf929743aa7ad38a133f607d1b46e4aecac99624eb6
Instruction Fuzzy Hash: 7711CCB5908341AFD340CF19D841A5BFBE4FB98664F04896EF998D7311D331E9148FA2

Uniqueness

Uniqueness Score: -1.00%

Function 01130934 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4480392186.0000000001130000.00000040.00000020.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff877d33815f6ab6f4edd4b1e9797d587eed2e16cb0ef7b66c62dcd925fdb12d
Instruction ID: 342e5b58c1ad6baa8cb9be13711dbc36d9fb0a6e1b1b3963bc36629d227ce5c2
Opcode Fuzzy Hash: ff877d33815f6ab6f4edd4b1e9797d587eed2e16cb0ef7b66c62dcd925fdb12d
Instruction Fuzzy Hash: 9F11C0302082809FE719CB14D940B25BBE5ABCD618F24C59CE94D0BA87D73AD842C741

Uniqueness

Uniqueness Score: -1.00%

Function 011310D5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4480392186.0000000001130000.00000040.00000020.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec46341cd91f5ed5230f6d8395edb717b94c7f1e93bc1c88011aba5032af83d9
Instruction ID: a849f121c2055e5ad4344bdfa9fcfd971813cc0a28e67edd00c3b97d06da6be6
Opcode Fuzzy Hash: ec46341cd91f5ed5230f6d8395edb717b94c7f1e93bc1c88011aba5032af83d9
Instruction Fuzzy Hash: 121186715097C49FD722CB15DC84F62FFB8EB46614F0888AAED454B653C379A808CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB5A0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4479987771.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_efa000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0791bcf9d19b37c8b8a8cea4020b07b892fa1160103ebea515f3cf73013bb7e
Instruction ID: 02f67c0344c4fff674818908cc3a1ce7d7694ca069658893fefacd039ab53825
Opcode Fuzzy Hash: c0791bcf9d19b37c8b8a8cea4020b07b892fa1160103ebea515f3cf73013bb7e
Instruction Fuzzy Hash: B411ECB5508305AFD350CF09D841A5BFBE8EB98660F04891EF95997711D271E9188BA2

Uniqueness

Uniqueness Score: -1.00%

Function 01130912 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4480392186.0000000001130000.00000040.00000020.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33bf4503985448ee329745eeaf26cbb0e48643dcd10371d94e7147296541b2b5
Instruction ID: 05aa0e336694c560c99ce6ccfd1092dbc0f75a0871eaca25b7775db29a8e88c6
Opcode Fuzzy Hash: 33bf4503985448ee329745eeaf26cbb0e48643dcd10371d94e7147296541b2b5
Instruction Fuzzy Hash: 93115135109780DFD717CB14C990B55BBB1EB8A218F2889EEE4894B663C33AD806CB41

Uniqueness

Uniqueness Score: -1.00%

Function 011310F6 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4480392186.0000000001130000.00000040.00000020.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06076142fc9ef8b47a32f2b9a4ffbcacca4661a79e30b51b174aa5b2eceadaca
Instruction ID: 38f2941bc30a05fa8860dc34e502b32f53718c4c34cc3fb7876f2b0dd553c980
Opcode Fuzzy Hash: 06076142fc9ef8b47a32f2b9a4ffbcacca4661a79e30b51b174aa5b2eceadaca
Instruction Fuzzy Hash: DD01F771604784DFD725CF29D980BA1FBE4EB85624F08C46ADD094BB46C37DA448CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011305DF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4480392186.0000000001130000.00000040.00000020.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981c81e4d6cbb8a34f3117a0c01df253206d710b4387695edc8bdf49349ccd95
Instruction ID: 48ad95e42503a02c224002d7650984708d187a7139d1c25998734341af7b7ac6
Opcode Fuzzy Hash: 981c81e4d6cbb8a34f3117a0c01df253206d710b4387695edc8bdf49349ccd95
Instruction Fuzzy Hash: DB01DB765097846FC7128F05AC41872FFF8EF86520709C4AFEC4987612C235B809CB71

Uniqueness

Uniqueness Score: -1.00%

Function 011309F0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4480392186.0000000001130000.00000040.00000020.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d72fd811d1dcf0381d502175804f2cf81f84fb0d159f174eee8ef1af5a1991
Instruction ID: 0cc48cc2fb2376818d755f7fb3bfc767114abb2ecd9eba4c9df7c21399ea6e28
Opcode Fuzzy Hash: 29d72fd811d1dcf0381d502175804f2cf81f84fb0d159f174eee8ef1af5a1991
Instruction Fuzzy Hash: 6AF0FB35104644DFC606CB04D540B25FBE2EB89718F24CAA9E94917A56C7379812DB81

Uniqueness

Uniqueness Score: -1.00%

Function 01130606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4480392186.0000000001130000.00000040.00000020.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1130000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd6456bdab21a19df8705cd358bcb60c5516705c9500d9f09c301e3991d6376
Instruction ID: d8e78d17417179159e70e9e52309ec6dc002d85233320b07c1b5330654a29a39
Opcode Fuzzy Hash: dfd6456bdab21a19df8705cd358bcb60c5516705c9500d9f09c301e3991d6376
Instruction Fuzzy Hash: BBE092B66006444BD650CF0BFC41462F7D8EB88A30B08C07FDC0D8B711D675B909CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 05801D17 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4484956529.0000000005800000.00000040.00000800.00020000.00000000.sdmp, Offset: 05800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5800000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b8adc0599e9c0dd9fc88aeeaca8c5a2f995accb5023d804faa135b13f466e9
Instruction ID: ac3c393ccf483db41318ea84137ece842613f7b689e78c4d44a9445e849a72d1
Opcode Fuzzy Hash: f2b8adc0599e9c0dd9fc88aeeaca8c5a2f995accb5023d804faa135b13f466e9
Instruction Fuzzy Hash: C6E0D8F254020467D210DE06AC46F63FB98DB50930F04C46BED091B702D172B514C9E1

Uniqueness

Uniqueness Score: -1.00%

Function 0580246B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4484956529.0000000005800000.00000040.00000800.00020000.00000000.sdmp, Offset: 05800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5800000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7ab42515bd8af8ba3633dc315bb1e298ada8aacb8a4eda43b941ace3669dfd
Instruction ID: e583a55d6ac09adeb75e23721c059d1094ff5a684c0fc5f703fbd9476d16b82d
Opcode Fuzzy Hash: 2c7ab42515bd8af8ba3633dc315bb1e298ada8aacb8a4eda43b941ace3669dfd
Instruction Fuzzy Hash: D0E0D8F254030467D2508E06AC46F62FB98DB54931F04C46BED081B742D172B51489E1

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB5EF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4479987771.0000000000EFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EFA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_efa000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d232ac6161bab0944c1e747ddda8ad491eb24bf630fde2346dc67735c8c55644
Instruction ID: 70eb512d8003335f0ba42a83f4e82096a14e9cfcdb3b5b506cc293ae23e2b0d2
Opcode Fuzzy Hash: d232ac6161bab0944c1e747ddda8ad491eb24bf630fde2346dc67735c8c55644
Instruction Fuzzy Hash: 67E0D8B254020467D2108E06AC46F62F798DB50930F04C56BED095B702D272B5148AF1

Uniqueness

Uniqueness Score: -1.00%

Function 00DD23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4479874383.0000000000DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dd2000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3097040e93bd39c7aae0365f9d92fbd0f453d2a985f00fc1db1fdcad94353ef4
Instruction ID: 8bc0b75e3ee768bceedd8bab48c2fcca9bf81825b128a3576a31a8fdce4b58c9
Opcode Fuzzy Hash: 3097040e93bd39c7aae0365f9d92fbd0f453d2a985f00fc1db1fdcad94353ef4
Instruction Fuzzy Hash: A0D05E7A2056C14FD3179E1CC1A5BA537D4BB61714F4A44FAAC408B763C768D981D611

Uniqueness

Uniqueness Score: -1.00%

Function 00DD23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4479874383.0000000000DD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_dd2000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 929a155c91b6f3a90de8db31c7ff5ca6482c1001bf19ad4d63e182c5cd761c8c
Instruction ID: 099e74f78ddcaf2d361251315471dab54aaf3cab9014bddfa5e729fef80a01ed
Opcode Fuzzy Hash: 929a155c91b6f3a90de8db31c7ff5ca6482c1001bf19ad4d63e182c5cd761c8c
Instruction Fuzzy Hash: 85D05E353402814BC715DE0CC2D4F6937D4AB90B15F0A44EDAC108B762C7A8D9C0CA10

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3.exePID: 7064, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04E8035F Relevance: 3.9, Strings: 3, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=[^k^, xrefs: 04E80477, 04E8047C
[^k^, xrefs: 04E80545, 04E8054A
-[^k^, xrefs: 04E804DA, 04E804DF

Memory Dump Source

Source File: 00000007.00000002.2255963054.0000000004E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4e80000_3.jbxd

Similarity

API ID:
String ID: [^k^$-[^k^$=[^k^
API String ID: 0-3832217768
Opcode ID: dcf404c4a0fd8ac0d4ea0941761608b38ff794c0e354ff1c48163f0be2bdefb0
Instruction ID: 3df80626ac94444e8538ea4ac076d1d6582d82dcfae6375ba116e256136a1a06
Opcode Fuzzy Hash: dcf404c4a0fd8ac0d4ea0941761608b38ff794c0e354ff1c48163f0be2bdefb0
Instruction Fuzzy Hash: 225124317002448FCB18BB7984616BE77E79FC5348B154429E806DB3E5EF39ED0A97A2

Uniqueness

Uniqueness Score: -1.00%

Function 04E80368 Relevance: 3.9, Strings: 3, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=[^k^, xrefs: 04E80477, 04E8047C
[^k^, xrefs: 04E80545, 04E8054A
-[^k^, xrefs: 04E804DA, 04E804DF

Memory Dump Source

Source File: 00000007.00000002.2255963054.0000000004E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4e80000_3.jbxd

Similarity

API ID:
String ID: [^k^$-[^k^$=[^k^
API String ID: 0-3832217768
Opcode ID: 3777622c9d4a3b0826abcec79cc5d72e139438fe3c1a2507d99f3a8fa4a3b4c4
Instruction ID: 557f14633f55b6654aea6ee737f34d45a4dd5b5453a31f5f87deec27138c0e6b
Opcode Fuzzy Hash: 3777622c9d4a3b0826abcec79cc5d72e139438fe3c1a2507d99f3a8fa4a3b4c4
Instruction Fuzzy Hash: 3C5146317002448FCB18BB3984616BE76E79FC53487054429E806DF3E5EF39ED0A97A2

Uniqueness

Uniqueness Score: -1.00%

Function 04E803BD Relevance: 3.9, Strings: 3, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=[^k^, xrefs: 04E80477, 04E8047C
[^k^, xrefs: 04E80545, 04E8054A
-[^k^, xrefs: 04E804DA, 04E804DF

Memory Dump Source

Source File: 00000007.00000002.2255963054.0000000004E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4e80000_3.jbxd

Similarity

API ID:
String ID: [^k^$-[^k^$=[^k^
API String ID: 0-3832217768
Opcode ID: a313226a471f36261e0ae5c5453d7ce2e1aba3e8b645c034e5a9828168f5a435
Instruction ID: c8d08475d8502c16e1d7710bfd43f0e9c13c67d1b643a69bddb0a8e2e11fa6bb
Opcode Fuzzy Hash: a313226a471f36261e0ae5c5453d7ce2e1aba3e8b645c034e5a9828168f5a435
Instruction Fuzzy Hash: 084124317002554FCB18BB7984652BD72D39FD63887094429E806DF3E5EF28ED0AA7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00CDA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00CDA6B9

Memory Dump Source

Source File: 00000007.00000002.2255278937.0000000000CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cda000_3.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 5a6d1f71a6562382c5cf603559549de28679adb09e2aa8ba800b480aadd0ac49
Instruction ID: 795c1925930bd9b1461db5c7863fba53a44299b53554006d7c89bf36f76296bf
Opcode Fuzzy Hash: 5a6d1f71a6562382c5cf603559549de28679adb09e2aa8ba800b480aadd0ac49
Instruction Fuzzy Hash: 993193755093805FE711CB25CC85B96BFF8EF06314F09849AE984CB292D375E909CB76

Uniqueness

Uniqueness Score: -1.00%

Function 00CDA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,27AEFF21,00000000,00000000,00000000,00000000), ref: 00CDA40C

Memory Dump Source

Source File: 00000007.00000002.2255278937.0000000000CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cda000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4529f36e5e5bd47173f5a7fddabe671912d4ca549ba8779277ff3b70b1be52eb
Instruction ID: 5059ce5227863b6d0a73925e61a1105e239db832b240acdab66d942da412c428
Opcode Fuzzy Hash: 4529f36e5e5bd47173f5a7fddabe671912d4ca549ba8779277ff3b70b1be52eb
Instruction Fuzzy Hash: AC316175505784AFE722CF15CC84F92BBF8EF06710F08859AE985CB292D364E949CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00CDA462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,27AEFF21,00000000,00000000,00000000,00000000), ref: 00CDA4F8

Memory Dump Source

Source File: 00000007.00000002.2255278937.0000000000CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cda000_3.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 16c3a7580bb97c29b5b4e549fde94863ae451c544ddeefd8c73026bda038dab5
Instruction ID: 2ed59b0334dada9274ebb69f12133f94d02a9ee285578e2872e2030b080207ea
Opcode Fuzzy Hash: 16c3a7580bb97c29b5b4e549fde94863ae451c544ddeefd8c73026bda038dab5
Instruction Fuzzy Hash: 36218E765047806FDB228F11DC44FA7BFB8EF46220F08849AE985CB652D264E948CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00CDA646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00CDA6B9

Memory Dump Source

Source File: 00000007.00000002.2255278937.0000000000CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cda000_3.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 863197603207aaf50b2499d8544ce6c03281417fb3a5d3479f719dedcba3df65
Instruction ID: 8594bc8d574efc59d700a049deab3fefcc975051d4235d4487c70e76e8bf69f5
Opcode Fuzzy Hash: 863197603207aaf50b2499d8544ce6c03281417fb3a5d3479f719dedcba3df65
Instruction Fuzzy Hash: F22180716042449FE720CF26DC85BA6FBE8EF04724F08846AEE458B741D375E909CB76

Uniqueness

Uniqueness Score: -1.00%

Function 00CDA392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,27AEFF21,00000000,00000000,00000000,00000000), ref: 00CDA40C

Memory Dump Source

Source File: 00000007.00000002.2255278937.0000000000CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cda000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f4d48fb4c7ddd79ddd71fabe5e0ba8115e83d7aad1cab7ce72044c23d7b1074f
Instruction ID: a0bd9d1741f1401a192da6fcd70be721d32a72fc179698e6557b2da7862ce4f1
Opcode Fuzzy Hash: f4d48fb4c7ddd79ddd71fabe5e0ba8115e83d7aad1cab7ce72044c23d7b1074f
Instruction Fuzzy Hash: A4218E766002049FEB20CF15CC84FA6B7ECEF04720F04846AEA458B751D7A4E949CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00CDA486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,27AEFF21,00000000,00000000,00000000,00000000), ref: 00CDA4F8

Memory Dump Source

Source File: 00000007.00000002.2255278937.0000000000CDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cda000_3.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f0480426ba277f72cfafcfb55dbe4048b0459279b413ca1d543fc96c3268724e
Instruction ID: 400f5aa8730d58fb2fd66b2c6a9626efff0620c36bc55d1bb7adc509fc5d6501
Opcode Fuzzy Hash: f0480426ba277f72cfafcfb55dbe4048b0459279b413ca1d543fc96c3268724e
Instruction Fuzzy Hash: C311B176500604AFEB218F15DC44FA7BBECEF04724F04845AEE458B741D374E948CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 04E80090 Relevance: .1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2255963054.0000000004E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4e80000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166f438ac6f6fbb4fc55d8bb84cfb601f08ddbc2af2e8b0fada852110a7d1d64
Instruction ID: 365786156c6bcfc25d674a0120e8fc51eb28340b8b6d20b14c45b3488ac22c04
Opcode Fuzzy Hash: 166f438ac6f6fbb4fc55d8bb84cfb601f08ddbc2af2e8b0fada852110a7d1d64
Instruction Fuzzy Hash: 75510D722112868FC704FF34E48998AB7A2FB9530C7518E2DD4458B36EFB346D1ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 04E80006 Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2255963054.0000000004E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4e80000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9103b63e6fe2c37c07c00b2dfc202050f59e45910643f20807b5fd0e9caa3b3a
Instruction ID: 488e5b91dcfc23f2b2eb14e4a6967e5724c289b438c84240fa2295cd5d1afb65
Opcode Fuzzy Hash: 9103b63e6fe2c37c07c00b2dfc202050f59e45910643f20807b5fd0e9caa3b3a
Instruction Fuzzy Hash: 49011E8684E3C25FD70322741CAA2943F709D6306578F02D7C496CA5E3E81C595F8BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F905E7 Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2255634134.0000000000F90000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f90000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1167db210bc98cdee887503929ec2185c3eb97532643d9062adc5f2c61019f
Instruction ID: b7b0f3c88ffa489b434cf9d60f1f3b425a2c2c5223804afe3df82dc64bb4b0f7
Opcode Fuzzy Hash: eb1167db210bc98cdee887503929ec2185c3eb97532643d9062adc5f2c61019f
Instruction Fuzzy Hash: 73F0A4B65093846FD7118B06AC40862FFBCEB86630709C4AFEC498B612D225B908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00F90606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2255634134.0000000000F90000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f90000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a427cfae3df47817e418f0901d5ac518464019f3f1379637fe0f7fcac6536c3
Instruction ID: 7cf2c91c81de7c40319620e4b7606b4b1bc50f86347224a85a0c627a79977470
Opcode Fuzzy Hash: 5a427cfae3df47817e418f0901d5ac518464019f3f1379637fe0f7fcac6536c3
Instruction Fuzzy Hash: 7EE092B66046044BD650CF0AEC81452F7D8EB88630B08C47FDC0D8B701D636B509CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 00CD23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2255261021.0000000000CD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd2000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a30d55328179c2e28dd1c3b8062b0c2ebde62069ccac438ca4f4f03d70fafe0
Instruction ID: 8d53962de8b3c1f8ef32cb9811098ae41f9f3224123396b2d38308b35352ce57
Opcode Fuzzy Hash: 9a30d55328179c2e28dd1c3b8062b0c2ebde62069ccac438ca4f4f03d70fafe0
Instruction Fuzzy Hash: A2D05E7A2056C14FD3179E1CC1A4B9537D4BB61714F4A44FBAC408B763C768DA81E601

Uniqueness

Uniqueness Score: -1.00%

Function 00CD23BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2255261021.0000000000CD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CD2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cd2000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8d9f12387adb49dfa38219707b660c2784e2c3ff941ab6c6b6081102e041b6
Instruction ID: 1f307d429437681475c25e1b2aff55e14a0025dff5f98dfb400950999978fc45
Opcode Fuzzy Hash: 6d8d9f12387adb49dfa38219707b660c2784e2c3ff941ab6c6b6081102e041b6
Instruction Fuzzy Hash: FFD05E353402814BC715DE0CC2D4F5937D8AB90B15F0644E9AC208B772C7A8DAC0CA00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3.exePID: 2724, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	19.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 014CA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 014CA6B9

Memory Dump Source

Source File: 00000008.00000002.2349500848.00000000014CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14ca000_3.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 238d642319aed9161e4d128bab2598f6e7a28dcbcc72c50b6b018a593101aef1
Instruction ID: 50ab13e672d8dd00c1ed15a8f0a1c17600867884f81595aec212e802da73fbe2
Opcode Fuzzy Hash: 238d642319aed9161e4d128bab2598f6e7a28dcbcc72c50b6b018a593101aef1
Instruction Fuzzy Hash: E731A1B55093845FE712CB65CC45B96BFF8EF06614F08849AE984CB292D375E809CB62

Uniqueness

Uniqueness Score: -1.00%

Function 014CA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,79006B60,00000000,00000000,00000000,00000000), ref: 014CA40C

Memory Dump Source

Source File: 00000008.00000002.2349500848.00000000014CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14ca000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4d85ff0661342604eb6ec11ef518c6aaee69f7d9ee0b83d7559605f2f08a9000
Instruction ID: 461ae719e410f0a1359c5ffa767356abc5048e123b387cbebeb484c5bf09dce6
Opcode Fuzzy Hash: 4d85ff0661342604eb6ec11ef518c6aaee69f7d9ee0b83d7559605f2f08a9000
Instruction Fuzzy Hash: FE318E75505784AFE722CF15CC84F93BBF8EF06610F08849AE985CB2A2D364E949CB65

Uniqueness

Uniqueness Score: -1.00%

Function 014CA462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,79006B60,00000000,00000000,00000000,00000000), ref: 014CA4F8

Memory Dump Source

Source File: 00000008.00000002.2349500848.00000000014CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14ca000_3.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 10efc5eb91a64bcbb60f63cbb409b6eb4411bb7ffcc23ddef70da007d378e3ec
Instruction ID: 9cd876beda72f8664da8717679f5583886342cbbad3dd5dcc7f40652d5e5918d
Opcode Fuzzy Hash: 10efc5eb91a64bcbb60f63cbb409b6eb4411bb7ffcc23ddef70da007d378e3ec
Instruction Fuzzy Hash: 4E21B0B65043846FE7228F15CC44FA3BFF8EF06614F08859AE985CB662D364E848CB75

Uniqueness

Uniqueness Score: -1.00%

Function 014CA646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 014CA6B9

Memory Dump Source

Source File: 00000008.00000002.2349500848.00000000014CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14ca000_3.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: a45db7c4fee429f9452fc80480478869fbc8f4eacbfac59026ba2d4758c55481
Instruction ID: efc36acc4e16f55a36138e39b247b178f2490ce105e28fea389dd97078f884bd
Opcode Fuzzy Hash: a45db7c4fee429f9452fc80480478869fbc8f4eacbfac59026ba2d4758c55481
Instruction Fuzzy Hash: BB21F2756002089FE720CF69CC45BA6FBE8EF04624F14846EED898B751E374E809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 014CA710 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 014CA780

Memory Dump Source

Source File: 00000008.00000002.2349500848.00000000014CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14ca000_3.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2883ec1ea91e9e9e20ff8abe636f04045cbc1e2a40e25a49410564e41b6c7c97
Instruction ID: fe134b89bf5528c2eecb7b5516c27c508be472053edad26375f00a0b14c2c631
Opcode Fuzzy Hash: 2883ec1ea91e9e9e20ff8abe636f04045cbc1e2a40e25a49410564e41b6c7c97
Instruction Fuzzy Hash: 4121F6B55093849FD7128F15DC85752BFB4EF02324F0984DBDC458F2A3D235A905DB61

Uniqueness

Uniqueness Score: -1.00%

Function 014CA392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,79006B60,00000000,00000000,00000000,00000000), ref: 014CA40C

Memory Dump Source

Source File: 00000008.00000002.2349500848.00000000014CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14ca000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 43744d4c155416713a36a81fde72b2f3c96679fab18f3b9995f6df859d55ca54
Instruction ID: ff580b7f302f2a01806abccefc0581e9a17624d501130651d1e80f73d61d990d
Opcode Fuzzy Hash: 43744d4c155416713a36a81fde72b2f3c96679fab18f3b9995f6df859d55ca54
Instruction Fuzzy Hash: 5D218E796006089FE761CF15CC84FA7F7ECEF04A24F14846AE9458B761E374E849CA75

Uniqueness

Uniqueness Score: -1.00%

Function 014CA486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,79006B60,00000000,00000000,00000000,00000000), ref: 014CA4F8

Memory Dump Source

Source File: 00000008.00000002.2349500848.00000000014CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14ca000_3.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 40aa438808cdf169bfa2ce6f985b4034e2b1aaf5dbfdcac5e11554c4795b3ecf
Instruction ID: b8266b7d61fb60e23c439839199dc16ec0f41fce3037adf7e84bb5e64b3aca9e
Opcode Fuzzy Hash: 40aa438808cdf169bfa2ce6f985b4034e2b1aaf5dbfdcac5e11554c4795b3ecf
Instruction Fuzzy Hash: AC11E17A600608AFE7218E05CC44FA7FBECEF04A24F14C55AED458B751E374E448CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 014CA74E Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 014CA780

Memory Dump Source

Source File: 00000008.00000002.2349500848.00000000014CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14ca000_3.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8927683818f5439dca62333c210153e151a567d205bdedcb7d77305e88f1f55e
Instruction ID: 161e99fa7a27b2a457eef8f88fdcdc96cc39e8942f42cab489b0c40d88b14449
Opcode Fuzzy Hash: 8927683818f5439dca62333c210153e151a567d205bdedcb7d77305e88f1f55e
Instruction Fuzzy Hash: 1D01D4796052088FDB50CF29D984756FBE4EF00624F18C4AFDC468F752D375E448CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 05360310 Relevance: .2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2349890971.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5360000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c0af7bb731fb9b9107ccda631399f6ec7ef4db6a237f639f17284284323ac8
Instruction ID: 98cf760ca2f09d336ab3465490e3e9de9512d5a0ed174e24006d6839807a1c55
Opcode Fuzzy Hash: 07c0af7bb731fb9b9107ccda631399f6ec7ef4db6a237f639f17284284323ac8
Instruction Fuzzy Hash: FF513570B003018FCB19EB3A94656BD77EBAB85248715856EE402DB3E4DF78CC458BA2

Uniqueness

Uniqueness Score: -1.00%

Function 053603BD Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2349890971.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5360000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dacfdceccc2c27316dd71ba847e32b15543868c109ebef2409025e2b6f3ba0f5
Instruction ID: a37c87a4a45504df36ed4c24efe29414bf28b7e8018c039077ac7a94a99d68b5
Opcode Fuzzy Hash: dacfdceccc2c27316dd71ba847e32b15543868c109ebef2409025e2b6f3ba0f5
Instruction Fuzzy Hash: 7C412570B002118F8B59EB7A80656BD72D7AFD6548745842EE402DB3E4DFBCCC0A87A2

Uniqueness

Uniqueness Score: -1.00%

Function 05360080 Relevance: .1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2349890971.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5360000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35aaec1ef438e9e83628483c18603fa74e45e939fe12c2cde2e9967ab9be8e21
Instruction ID: 17859355895a8654b2d57e1bd95670b41a214d5040e6ed8261611d97cd1b9a20
Opcode Fuzzy Hash: 35aaec1ef438e9e83628483c18603fa74e45e939fe12c2cde2e9967ab9be8e21
Instruction Fuzzy Hash: A55141B1602346DFCB05DF36E4445CAB7A6FF9120C755886AD4444B369DB386D8DCF82

Uniqueness

Uniqueness Score: -1.00%

Function 05360006 Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2349890971.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5360000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424c67b335e68df1d1e405ca4d3042c0369d53ae4ea58e4848111f3e0f256a12
Instruction ID: 3035b116057b369b3ff91f3c08c74486deeadef73e7f94ac585b05b8016a4f2e
Opcode Fuzzy Hash: 424c67b335e68df1d1e405ca4d3042c0369d53ae4ea58e4848111f3e0f256a12
Instruction Fuzzy Hash: 0D0128AA84E3C54FDB534B709C6A2903F70AE6321575F01DBC4C1CA5A7E55C494AD332

Uniqueness

Uniqueness Score: -1.00%

Function 014705E7 Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2349436577.0000000001470000.00000040.00000020.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1470000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8db5c38990221d6167de2109113e04a908a0b7d0f0690147e9eff1ef3bbce20
Instruction ID: b433d45cd8d13b29d783f98cea98c4512f122b277bc9234d49e7a74523310a0a
Opcode Fuzzy Hash: b8db5c38990221d6167de2109113e04a908a0b7d0f0690147e9eff1ef3bbce20
Instruction Fuzzy Hash: 86F0A4B65097846FD7118B06EC40862FFB8EB86620749C49FEC498B612D225B908CB76

Uniqueness

Uniqueness Score: -1.00%

Function 01470606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2349436577.0000000001470000.00000040.00000020.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1470000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737eb0d8cfd0a1321443dbf42bf491b7c219606bc9d989046f5f79f04e76dda6
Instruction ID: 0de4d75736c81e5ae6e789b513a060a9315aa20556ce990fff933f86b8b09b9c
Opcode Fuzzy Hash: 737eb0d8cfd0a1321443dbf42bf491b7c219606bc9d989046f5f79f04e76dda6
Instruction Fuzzy Hash: A7E092BAA00A044B9650DF0BEC41452F7D8EB88630748C57FDC0D8B701D63AB509CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 014C23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2349487438.00000000014C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14c2000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f56d9c15844db9092de9d4d4e3bcc917b9fe66abaae847639ec596f554e6c8c
Instruction ID: 1c0890c933ca8daf1b120fc3d9fc13c8c0e07a2bc65930957ab04c23e15a459a
Opcode Fuzzy Hash: 6f56d9c15844db9092de9d4d4e3bcc917b9fe66abaae847639ec596f554e6c8c
Instruction Fuzzy Hash: 7AD05E7E2056D14FE3169E1CC1A4F967BE4BB51B14F4A44FEA8408B773C7B8D581D601

Uniqueness

Uniqueness Score: -1.00%

Function 014C23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2349487438.00000000014C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 014C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_14c2000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058ffc0696279da4ef50df69640775e61d90ade6852324bef4c5bb23ae6607bf
Instruction ID: 4b44eaecdd454edda168f816ed55133b714c4a90c4db99033bd8ab233b06ab0d
Opcode Fuzzy Hash: 058ffc0696279da4ef50df69640775e61d90ade6852324bef4c5bb23ae6607bf
Instruction Fuzzy Hash: 8FD017393402814BD755DA1CC2D4F5A3BD4AB40B15F0644ADA8108B772C7F8D980CA00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3.exePID: 6208, Parent PID: 1028COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0155A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0155A6B9

Memory Dump Source

Source File: 00000009.00000002.2430805615.000000000155A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_155a000_3.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 100f9a1fbda4ea759ade5dbe82687c10c6ff5f0db1c81c994423c7169a17c15f
Instruction ID: f0287a750e1754389a5383000f9220fcead8bbd8adc495fb349d6648f7f799a5
Opcode Fuzzy Hash: 100f9a1fbda4ea759ade5dbe82687c10c6ff5f0db1c81c994423c7169a17c15f
Instruction Fuzzy Hash: 7C31A1755093805FE712CB25CC45B96BFF8EF06214F08849AE984CF293D364E809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0155A361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,D4BDB729,00000000,00000000,00000000,00000000), ref: 0155A40C

Memory Dump Source

Source File: 00000009.00000002.2430805615.000000000155A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_155a000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 3183bcff71dc1d708a5cb1bc76d0e263ef7f2006331d0c02c85c0cd94de6bf65
Instruction ID: 67781a66a3795a262e3169b53f1c6e5e8e01a29d2225a42ba687a7838ec3d303
Opcode Fuzzy Hash: 3183bcff71dc1d708a5cb1bc76d0e263ef7f2006331d0c02c85c0cd94de6bf65
Instruction Fuzzy Hash: 28318075504780AFE722CF15CC84F96BFF8EF05214F08859AE9858B293D364E949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0155A462 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,D4BDB729,00000000,00000000,00000000,00000000), ref: 0155A4F8

Memory Dump Source

Source File: 00000009.00000002.2430805615.000000000155A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_155a000_3.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4d503045c70fc175f4bb9751439a692bc50761898e6e212517883e348990a66a
Instruction ID: b9e6fcf21ce7a1a086d17aa838e2a1e6e7c3934c0c762213103738914e2a9149
Opcode Fuzzy Hash: 4d503045c70fc175f4bb9751439a692bc50761898e6e212517883e348990a66a
Instruction Fuzzy Hash: C52192765043806FE7228F55DC44F67BFF8EF45214F08859AE985CB652D364E848CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0155A646 Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0155A6B9

Memory Dump Source

Source File: 00000009.00000002.2430805615.000000000155A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_155a000_3.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 42c12f5b3773900c286a96b2ad58f22869af4a9907e6c7952419bde4fcb147a4
Instruction ID: ded2a428b4b82a4f2e82758cf5472faf84eb16c1c0b29983510c8ed066931841
Opcode Fuzzy Hash: 42c12f5b3773900c286a96b2ad58f22869af4a9907e6c7952419bde4fcb147a4
Instruction Fuzzy Hash: 76217F75A042449FE720CF25DC45BAABBE8EF04224F0488AAED458F642D775E809CF72

Uniqueness

Uniqueness Score: -1.00%

Function 0155A710 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0155A780

Memory Dump Source

Source File: 00000009.00000002.2430805615.000000000155A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_155a000_3.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: cab3ea7589199128010867b6aacd851fb2576cde5eee67fc9e2dda221fbb0be1
Instruction ID: a2910159f0c9030cc60eb9585f4b6e4b2fe6f5831477ee944deeef10e53abe08
Opcode Fuzzy Hash: cab3ea7589199128010867b6aacd851fb2576cde5eee67fc9e2dda221fbb0be1
Instruction Fuzzy Hash: 9221C3B55083809FD7128F25DC95751BFB8EF02324F0984EBDC458F693D275A905DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0155A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,D4BDB729,00000000,00000000,00000000,00000000), ref: 0155A40C

Memory Dump Source

Source File: 00000009.00000002.2430805615.000000000155A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_155a000_3.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f3c9ba2472e1eda1d4362120e674a9a3aa01dcdc2c3ab9b3c0d89a2dcfcf7d72
Instruction ID: f9f850e5ac6428ead0087ccd2b6390f64ac3354371af53ee32cf303f1a9f0c18
Opcode Fuzzy Hash: f3c9ba2472e1eda1d4362120e674a9a3aa01dcdc2c3ab9b3c0d89a2dcfcf7d72
Instruction Fuzzy Hash: EB218E756002049FE761CF55CC84FA6BBECEF04624F0885AAED468B652D364E849CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0155A486 Relevance: 1.6, APIs: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExW.KERNELBASE(?,00000E24,D4BDB729,00000000,00000000,00000000,00000000), ref: 0155A4F8

Memory Dump Source

Source File: 00000009.00000002.2430805615.000000000155A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_155a000_3.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 49d7e7be9258611f3431e4d4dfa842891b5ec9516064d63e7df09dca891b31ed
Instruction ID: ce441dbf9d842086f1db514ed563535684f7a5f967e4af692ada14ec05849c36
Opcode Fuzzy Hash: 49d7e7be9258611f3431e4d4dfa842891b5ec9516064d63e7df09dca891b31ed
Instruction Fuzzy Hash: B0119376500604AFEB218F55DC45FABFBECEF04624F04855AED458B751D374E448CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 0155A74E Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0155A780

Memory Dump Source

Source File: 00000009.00000002.2430805615.000000000155A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_155a000_3.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3616f74b25d1ab4a7c70ff032e556464a2c0b9d66a939f05bedcf34fb8139bb6
Instruction ID: 00dc646d664dabfebb30558df52ae8cede7a7f285acba2273782f5cb6450f55d
Opcode Fuzzy Hash: 3616f74b25d1ab4a7c70ff032e556464a2c0b9d66a939f05bedcf34fb8139bb6
Instruction Fuzzy Hash: DE018F756042448FEB51CF29E985766FBE4EF04224F08C4ABDD4A8F752D375E448CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 05540310 Relevance: .2, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2431321046.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5540000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54dfe3ae25592c7229c65b09f44eb6bfddb95381308d26085277e0ce5bbb2986
Instruction ID: 60a7b0b63525ebf6c21fb813cc93a9389bd491a13746e2b4a9dc1507ffaf4f72
Opcode Fuzzy Hash: 54dfe3ae25592c7229c65b09f44eb6bfddb95381308d26085277e0ce5bbb2986
Instruction Fuzzy Hash: 7351E5307002018FDB58EB39986467E77E7BB89248F144569E406DF3E4DF39DC069BA2

Uniqueness

Uniqueness Score: -1.00%

Function 055403BD Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2431321046.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5540000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61ba5337de1bf4ced5ba5134a401c5e0282b31d2c42aca791dddb205834729d
Instruction ID: c1965cb38f637f6eb5a069e2b861801b0731d631c26653c3283cd6a0c288fb4b
Opcode Fuzzy Hash: b61ba5337de1bf4ced5ba5134a401c5e0282b31d2c42aca791dddb205834729d
Instruction Fuzzy Hash: 2941C7307002168BDB58AB79886427D76D7BFC5248F154929E806DF3E4DF3DCD0697A2

Uniqueness

Uniqueness Score: -1.00%

Function 05540080 Relevance: .1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2431321046.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5540000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35de26c48b546a7d896308fc44be4a606abab4d37375071fac42635e0b2a9662
Instruction ID: c0d519fc7d2c512d2bbebbacf6a5973f1e1c5642b7ea6d023c49e47fbfe9d245
Opcode Fuzzy Hash: 35de26c48b546a7d896308fc44be4a606abab4d37375071fac42635e0b2a9662
Instruction Fuzzy Hash: 785175702052468FCB04DF34E9548AAB7A6FF9830EF51A969E4448B369DF386D4DCB81

Uniqueness

Uniqueness Score: -1.00%

Function 05540006 Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2431321046.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5540000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73f9c5092cb8bf912d2c0f1fa46c015263bb96c5dc89a810a30d2ac712d8727
Instruction ID: e1fb641d4f6ef8595acdcd796f2cd0142f8a6c44e7d2e9b76a75335a9920ed5b
Opcode Fuzzy Hash: f73f9c5092cb8bf912d2c0f1fa46c015263bb96c5dc89a810a30d2ac712d8727
Instruction Fuzzy Hash: 5701A7A544E3C11FCB438BB06CA99927FB0AE13124B0F41D7D8C0CA4E3E28C9A59D763

Uniqueness

Uniqueness Score: -1.00%

Function 016805E0 Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2430923915.0000000001680000.00000040.00000020.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1680000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b84bce878085381af0fb7f945b0b26db0759c171f15fb056ca2b3c9df508f85
Instruction ID: 8c971bc8f110c38014b2cdbb12e89555103a1b8f96b6f1c9cc110c164a1d5639
Opcode Fuzzy Hash: 1b84bce878085381af0fb7f945b0b26db0759c171f15fb056ca2b3c9df508f85
Instruction Fuzzy Hash: 3601D6B550D7946FC712CF16EC40862FFB8DF86620709C4DFEC498B652D225A809CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 01680606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2430923915.0000000001680000.00000040.00000020.00020000.00000000.sdmp, Offset: 01680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1680000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e32115a71ab069ac41c4b60fa7b01e8afac0a072e2108c2d4cdeb2902d8718d
Instruction ID: 703429a7c5f2127099cf40128f83dc982990c27f0dafcba62a704e082b0d581d
Opcode Fuzzy Hash: 0e32115a71ab069ac41c4b60fa7b01e8afac0a072e2108c2d4cdeb2902d8718d
Instruction Fuzzy Hash: E3E092B66046044B9750CF0AEC81462F7E8EB88630708C07FDC0D8B701E635B509CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 015523F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2430790614.0000000001552000.00000040.00000800.00020000.00000000.sdmp, Offset: 01552000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1552000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdd98d94c1960a4f337a0210e91e879663492761a781ccd7ba16db1f0d9d51e
Instruction ID: a90c2c9ccc10e691812df6496460d79fdcafedbe1812f95d5ec0de7605bf8b1a
Opcode Fuzzy Hash: 9fdd98d94c1960a4f337a0210e91e879663492761a781ccd7ba16db1f0d9d51e
Instruction Fuzzy Hash: 8AD05E7A2057C1CFE3169E1CC1A4B993FE4BB51714F4A44FAAC408F763C768D581D601

Uniqueness

Uniqueness Score: -1.00%

Function 015523BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2430790614.0000000001552000.00000040.00000800.00020000.00000000.sdmp, Offset: 01552000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1552000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55cc5d5ce8074855f90445ac12f23dd589837b9a586e986f9085a64c9388449
Instruction ID: 1fc06170c375e14da96bce3d5e92d548956aa06771050ca009fc2635cddb6d89
Opcode Fuzzy Hash: e55cc5d5ce8074855f90445ac12f23dd589837b9a586e986f9085a64c9388449
Instruction Fuzzy Hash: E4D05E353402818BD715DE0CC2E4F5D3BD4BB40B15F0644E9AC108F762C7A8D9C0CB00

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qdHMT36Tn9.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\v6zchhhv.default-release\cert9.db

C:\Users\Public\v6zchhhv.default-release\key4.db

C:\Users\user\AppData\Local\44\Information.txt

C:\Users\user\AppData\Local\44\Process.txt

C:\Users\user\AppData\Local\44\Screen.png

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\3.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1.exe.log

C:\Users\user\AppData\Local\Temp\1.exe

Windows Analysis Report
qdHMT36Tn9.exe

Function 0057EA07 Relevance: 46.0, APIs: 22, Strings: 4, Instructions: 453
fileCOMMON

Function 0058037C Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 208
filesleeptimeCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre