Edit tour

Windows Analysis Report
En3e396wX1.exe

Overview

General Information

Sample name:	En3e396wX1.exe renamed because original name is a hash value
Original sample name:	F0FF2A2046A4FEFCD2D04C92C812FCF2.exe
Analysis ID:	1425675
MD5:	f0ff2a2046a4fefcd2d04c92c812fcf2
SHA1:	d2004f23d6b5a90888395c1f2d72d288b2dea821
SHA256:	06b314e6e7127b58bdafcd05252a28af38233afe2b188584eb4d27ab372c8762
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

Connects to many ports of the same IP (likely port scanning)

Contains functionality to disable the Task Manager (.Net Source)

Contains functionality to spread to USB devices (.Net source)

Disables zone checking for all users

Machine Learning detection for sample

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

En3e396wX1.exe (PID: 5348 cmdline: "C:\Users\user\Desktop\En3e396wX1.exe" MD5: F0FF2A2046A4FEFCD2D04C92C812FCF2)

netsh.exe (PID: 1892 cmdline: netsh firewall add allowedprogram "C:\Users\user\Desktop\En3e396wX1.exe" "En3e396wX1.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 5532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Campaign ID": "HacKed", "Version": "0.7d", "Install Name": "02a10a06650130398868c04656615034", "Install Dir": "Adobe Update", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
En3e396wX1.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
En3e396wX1.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x1266a:$a1: get_Registry 0x15177:$a2: SEE_MASK_NOZONECHECKS 0x14e19:$a3: Download ERROR 0x153cd:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13356:$a5: netsh firewall delete allowedprogram "
En3e396wX1.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x153cd:$x1: cmd.exe /c ping 0 -n 2 & del " 0x12ee2:$s1: winmgmts:\\.\root\SecurityCenter2 0x14e37:$s3: Executed As 0x1165d:$s5: Stub.exe 0x14e19:$s6: Download ERROR 0x12ea4:$s8: Select * From AntiVirusProduct
En3e396wX1.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15177:$reg: SEE_MASK_NOZONECHECKS 0x14dfd:$msg: Execute ERROR 0x14e51:$msg: Execute ERROR 0x153cd:$ping: cmd.exe /c ping 0 -n 2 & del
En3e396wX1.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13356:$s1: netsh firewall delete allowedprogram 0x133a8:$s2: netsh firewall add allowedprogram 0x153cd:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x14dfd:$s4: Execute ERROR 0x14e51:$s4: Execute ERROR 0x14e19:$s5: Download ERROR

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x1246a:$a1: get_Registry 0x14f77:$a2: SEE_MASK_NOZONECHECKS 0x14c19:$a3: Download ERROR 0x151cd:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13156:$a5: netsh firewall delete allowedprogram "
00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x14f77:$reg: SEE_MASK_NOZONECHECKS 0x14bfd:$msg: Execute ERROR 0x14c51:$msg: Execute ERROR 0x151cd:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.4484946830.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: En3e396wX1.exe PID: 5348	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.En3e396wX1.exe.8f0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.En3e396wX1.exe.8f0000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x1266a:$a1: get_Registry 0x15177:$a2: SEE_MASK_NOZONECHECKS 0x14e19:$a3: Download ERROR 0x153cd:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13356:$a5: netsh firewall delete allowedprogram "
0.0.En3e396wX1.exe.8f0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x153cd:$x1: cmd.exe /c ping 0 -n 2 & del " 0x12ee2:$s1: winmgmts:\\.\root\SecurityCenter2 0x14e37:$s3: Executed As 0x1165d:$s5: Stub.exe 0x14e19:$s6: Download ERROR 0x12ea4:$s8: Select * From AntiVirusProduct
0.0.En3e396wX1.exe.8f0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15177:$reg: SEE_MASK_NOZONECHECKS 0x14dfd:$msg: Execute ERROR 0x14e51:$msg: Execute ERROR 0x153cd:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.En3e396wX1.exe.8f0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13356:$s1: netsh firewall delete allowedprogram 0x133a8:$s2: netsh firewall add allowedprogram 0x153cd:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x14dfd:$s4: Execute ERROR 0x14e51:$s4: Execute ERROR 0x14e19:$s5: Download ERROR

Snort Signatures

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 18.156.13.209

Timestamp:	04/14/24-06:54:11.093222
SID:	2033132
Source Port:	49716
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.127.138.57

Timestamp:	04/14/24-06:53:07.096652
SID:	2033132
Source Port:	49714
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 18.156.13.209

Timestamp:	04/14/24-06:54:11.400675
SID:	2814856
Source Port:	49716
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 18.156.13.209

Timestamp:	04/14/24-06:54:14.327523
SID:	2825564
Source Port:	49716
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 18.197.239.5

Timestamp:	04/14/24-06:52:08.702264
SID:	2825564
Source Port:	49705
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.127.138.57

Timestamp:	04/14/24-06:53:07.405791
SID:	2814856
Source Port:	49714
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 18.197.239.5

Timestamp:	04/14/24-06:55:15.097163
SID:	2033132
Source Port:	49717
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 18.197.239.5

Timestamp:	04/14/24-06:52:08.702264
SID:	2814860
Source Port:	49705
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 18.197.239.5

Timestamp:	04/14/24-06:52:03.604825
SID:	2814856
Source Port:	49705
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 18.197.239.5

Timestamp:	04/14/24-06:52:03.291445
SID:	2033132
Source Port:	49705
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 18.156.13.209

Timestamp:	04/14/24-06:54:14.327523
SID:	2814860
Source Port:	49716
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 18.197.239.5

Timestamp:	04/14/24-06:55:15.404401
SID:	2814856
Source Port:	49717
Destination Port:	14095
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: En3e396wX1.exe

Avira: detected

Found malware configuration

Source: 0.0.En3e396wX1.exe.8f0000.0.unpack

Malware Configuration Extractor: Njrat {"Campaign ID": "HacKed", "Version": "0.7d", "Install Name": "02a10a06650130398868c04656615034", "Install Dir": "Adobe Update", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for domain / URL

Source: 2.tcp.eu.ngrok.io

Virustotal: Detection: 11%

Perma Link

Multi AV Scanner detection for submitted file

Source: En3e396wX1.exe	ReversingLabs: Detection: 81%
Source: En3e396wX1.exe	Virustotal: Detection: 79%			Perma Link

Yara detected Njrat

Source: Yara match	File source: En3e396wX1.exe, type: SAMPLE
Source: Yara match	File source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4484946830.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: En3e396wX1.exe PID: 5348, type: MEMORYSTR

Machine Learning detection for sample

Source: En3e396wX1.exe

Joe Sandbox ML: detected

Source: En3e396wX1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\En3e396wX1.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: En3e396wX1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Contains functionality to spread to USB devices (.Net source)

Source: En3e396wX1.exe, -.cs

.Net Code: @

Source: En3e396wX1.exe, 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: En3e396wX1.exe, 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: En3e396wX1.exe, 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: En3e396wX1.exe	Binary or memory string: \autorun.inf
Source: En3e396wX1.exe	Binary or memory string: [autorun]
Source: En3e396wX1.exe	Binary or memory string: autorun.inf

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49705 -> 18.197.239.5:14095
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49705 -> 18.197.239.5:14095
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49705 -> 18.197.239.5:14095
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49705 -> 18.197.239.5:14095
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49714 -> 3.127.138.57:14095
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49714 -> 3.127.138.57:14095
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49716 -> 18.156.13.209:14095
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49716 -> 18.156.13.209:14095
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49716 -> 18.156.13.209:14095
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49716 -> 18.156.13.209:14095
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49717 -> 18.197.239.5:14095
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49717 -> 18.197.239.5:14095

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 3.127.138.57 ports 14095,0,1,4,5,9
Source: global traffic	TCP traffic: 18.156.13.209 ports 14095,0,1,4,5,9
Source: global traffic	TCP traffic: 18.197.239.5 ports 14095,0,1,4,5,9

Source: global traffic	TCP traffic: 192.168.2.5:49705 -> 18.197.239.5:14095
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 3.127.138.57:14095
Source: global traffic	TCP traffic: 192.168.2.5:49716 -> 18.156.13.209:14095

Source: Joe Sandbox View	IP Address: 3.127.138.57 3.127.138.57
Source: Joe Sandbox View	IP Address: 18.156.13.209 18.156.13.209
Source: Joe Sandbox View	IP Address: 18.197.239.5 18.197.239.5

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: 2.tcp.eu.ngrok.io

Source: C:\Users\user\Desktop\En3e396wX1.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: En3e396wX1.exe, type: SAMPLE
Source: Yara match	File source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4484946830.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: En3e396wX1.exe PID: 5348, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: En3e396wX1.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: En3e396wX1.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: En3e396wX1.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: En3e396wX1.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\En3e396wX1.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C4298	0_2_050C4298
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C470F	0_2_050C470F
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C4936	0_2_050C4936
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C4630	0_2_050C4630
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C4544	0_2_050C4544
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C4B5B	0_2_050C4B5B
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C4287	0_2_050C4287
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C499D	0_2_050C499D
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C47D4	0_2_050C47D4
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C49F9	0_2_050C49F9
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C44F1	0_2_050C44F1
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C5000	0_2_050C5000
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C4F2F	0_2_050C4F2F
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C505D	0_2_050C505D
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C5459	0_2_050C5459
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C536F	0_2_050C536F
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C4C8F	0_2_050C4C8F
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C4F9D	0_2_050C4F9D
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_050C50E3	0_2_050C50E3

Source: En3e396wX1.exe, 00000000.00000002.4484672844.000000000108E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs En3e396wX1.exe

Source: En3e396wX1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: En3e396wX1.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: En3e396wX1.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: En3e396wX1.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: En3e396wX1.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: classification engine

Classification label: mal100.spre.phis.troj.evad.winEXE@4/2@4/3

Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_052324CE AdjustTokenPrivileges,		0_2_052324CE
Source: C:\Users\user\Desktop\En3e396wX1.exe	Code function: 0_2_05232497 AdjustTokenPrivileges,		0_2_05232497

Source: C:\Users\user\Desktop\En3e396wX1.exe

File created: C:\Users\user\AppData\Roaming\app

Jump to behavior

Source: C:\Users\user\Desktop\En3e396wX1.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\En3e396wX1.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\Desktop\En3e396wX1.exe	Mutant created: \Sessions\1\BaseNamedObjects\02a10a06650130398868c04656615034
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5532:120:WilError_03

Source: C:\Users\user\Desktop\En3e396wX1.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Jump to behavior

Source: En3e396wX1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: En3e396wX1.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\En3e396wX1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: En3e396wX1.exe	ReversingLabs: Detection: 81%
Source: En3e396wX1.exe	Virustotal: Detection: 79%

Source: unknown	Process created: C:\Users\user\Desktop\En3e396wX1.exe "C:\Users\user\Desktop\En3e396wX1.exe"
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\En3e396wX1.exe" "En3e396wX1.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\En3e396wX1.exe" "En3e396wX1.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\En3e396wX1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\En3e396wX1.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: En3e396wX1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\En3e396wX1.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: En3e396wX1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: En3e396wX1.exe, -.cs

.Net Code: @ System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\En3e396wX1.exe	Memory allocated: 1060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Memory allocated: 2EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Memory allocated: 4EC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\En3e396wX1.exe	Window / User API: threadDelayed 694	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Window / User API: threadDelayed 4987	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Window / User API: threadDelayed 3646	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Window / User API: foregroundWindowGot 778	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe	Window / User API: foregroundWindowGot 775	Jump to behavior

Source: C:\Users\user\Desktop\En3e396wX1.exe TID: 6568	Thread sleep count: 694 > 30	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe TID: 6568	Thread sleep time: -69400s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe TID: 5788	Thread sleep count: 4987 > 30	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe TID: 5788	Thread sleep time: -4987000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe TID: 5788	Thread sleep count: 3646 > 30	Jump to behavior
Source: C:\Users\user\Desktop\En3e396wX1.exe TID: 5788	Thread sleep time: -3646000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: netsh.exe, 00000002.00000002.2055561038.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: En3e396wX1.exe, 00000000.00000002.4484672844.0000000001101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\En3e396wX1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\En3e396wX1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 12:41:17 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:36:39 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:49:37 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:50:04 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:59:18 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:24:41 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:49:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:23:19 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:32:41 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:05:56 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:47:20 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:15:15 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:28:35 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:42:00 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:39:17 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 17:56:53 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:54:55 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:58:06 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:16:38 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:29:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:56:32 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:56:10 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:02:04 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:12:39 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:41:35 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:46:51 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:44:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:48:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:19:23 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:18:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:20:33 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 09:12:05 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:28:13 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:26:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:00:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 18:12:50 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 08:04:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:36:17 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:10:08 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:42:04 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:04:44 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:31:15 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:30:10 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:44:35 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:26:04 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 13:25:00 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:21:56 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:52:39 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:20:51 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 02:55:11 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:16:45 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:48:29 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:24:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4484946830.0000000002F79000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4484946830.00000000033D4000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/14 \| 06:56:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:08:34 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:00:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:33:31 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 12:01:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 03:07:20 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:15:33 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:25:28 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:15:24 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:52:35 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 13:47:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 02:23:37 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:55:24 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:53:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:48:50 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:03:12 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:55:02 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:15:08 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:13:52 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:01:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:47:17 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:09:20 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:37:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:30:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:31:31 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:07:04 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:57:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:03:03 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:53:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 08:47:03 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:01:28 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:22:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:51:09 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:40:34 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:32:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:45:50 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:11:16 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:45:21 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:47:37 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:49:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 09:45:48 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:56:25 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:33:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:59:36 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:04:33 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:01:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:20:26 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:56:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:09:33 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:36:28 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:42:11 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 11:57:23 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:43:05 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:38:12 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:04:04 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:32:52 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:40:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:19:18 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4484946830.0000000002F79000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4484946830.00000000033D4000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/15 \| 03:02:14 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 07:58:39 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:22:10 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 13:51:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 09:09:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:09:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:46:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:53:25 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:06:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:40:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:16:16 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 16:48:21 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:24:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:16:23 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:03:25 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:46:29 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 10:21:33 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:16:34 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:14:23 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:10:52 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:52:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:19:55 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:22:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 03:11:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:29:14 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 02:13:02 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:37:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:27:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:12:51 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:00:32 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:27:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:39:02 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:06:03 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 02:01:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:37:18 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:35:30 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 09:33:29 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:28:53 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:56:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:02:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:35:18 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:12:08 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:43:34 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:25:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:25:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:25:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 02:54:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:50:30 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:59:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 03:43:21 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 08:47:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 16:38:25 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:43:50 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:49:20 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:50:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:13:09 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:18:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:51:32 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:51:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:28:06 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:54:48 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:49:08 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:29:29 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:13:21 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:39:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:14:53 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:46:44 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:31:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:31:53 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:59:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:41:06 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:15:22 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:23:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:49:05 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:23:43 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:39:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 12:49:48 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 02:19:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:53:30 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4484946830.0000000002F79000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4484946830.00000000033D4000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/15 \| 02:45:24 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4484946830.0000000002F79000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4484946830.00000000033D4000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/15 \| 02:55:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:22:05 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:18:38 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 10:52:16 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:07:28 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:05:05 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 16:59:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:30:09 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:03:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:33:16 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:13:23 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:59:25 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:05:19 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:01:03 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:14:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:44:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:50:02 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:39:31 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:12:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:47:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:21:34 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:02:26 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:14:39 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:54:18 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:04:19 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 16:29:20 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 11:11:07 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:26:33 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 12:51:13 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:29:11 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:36:55 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:19:52 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:09:11 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:58:26 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:29:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4484946830.0000000002F79000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4484946830.00000000033D4000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/15 \| 03:12:10 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:26:34 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:51:23 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:36:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:02:41 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:46:13 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:04:15 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:26:35 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:28:50 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 02:02:50 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:10:45 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:38:19 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:12:19 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:24:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:55:31 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:26:13 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:16:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:54:31 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 12:13:20 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:24:29 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:21:04 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:23:08 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4484946830.0000000002F79000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4484946830.00000000033D4000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/15 \| 02:56:13 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:50:32 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:15:04 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:43:28 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 09:03:00 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 10:49:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 17:23:10 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4484946830.0000000002F79000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4484946830.00000000033D4000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/15 \| 03:56:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:37:24 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:35:24 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 03:44:51 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:03:41 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:23:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:13:00 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:19:09 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:45:28 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:27:20 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:59:48 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:11:45 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:17:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:40:43 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:19:30 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:48:07 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:51:53 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:47:44 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:30:23 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:39:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:42:07 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:27:34 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:07:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 02:08:21 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:55:48 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:18:17 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 12:38:20 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:32:48 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:43:30 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 16:59:10 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:08:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4484946830.0000000002F79000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4484946830.00000000033D4000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/15 \| 03:17:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:52:24 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:17:17 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:35:53 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:02:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:08:29 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:45:12 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:12:17 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:13:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:30:21 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 08:26:55 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 10:53:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:19:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:48:36 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:32:16 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:02:10 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:00:02 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:22:26 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 12:34:07 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:50:31 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:21:15 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:27:05 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:24:12 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:17:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:22:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 12:53:36 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:05:34 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:57:55 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:55:19 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:40:11 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:28:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:14:22 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:34:32 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:16:31 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:15:09 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:02:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:01:56 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:39:05 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:40:28 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:48:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:24:35 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:12:21 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:10:44 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:26:12 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:20:25 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:31:18 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:34:16 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:04:56 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:15:41 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:37:55 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:51:00 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:56:24 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:01:50 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:00:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:00:35 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:09:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:08:26 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:48:20 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:56:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:32:53 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:32:39 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 10:11:37 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:52:32 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:04:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 13:44:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 09:58:21 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:40:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 12:50:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:28:05 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:40:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:12:56 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:15:45 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:49:45 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:37:31 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:23:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:52:18 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:57:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:01:02 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:28:16 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:21:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:00:26 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:45:53 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:12:45 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:19:39 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 10:01:19 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 16:29:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:39:09 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:04:41 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:15:23 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:54:47 - Program Manager
Source: En3e396wX1.exe	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 11:18:45 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 08:13:43 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:23:10 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:55:16 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:15:16 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:58:25 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:07:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:47:12 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:26:30 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:11:24 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:18:09 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:08:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:29:28 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:57:25 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:24:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:06:56 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 09:12:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:16:37 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:49:21 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:10:55 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:12:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:18:53 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:23:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:26:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 03:19:19 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:39:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:43:37 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:03:51 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:34:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:09:04 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:04:10 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 12:51:44 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:41:43 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:47:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:02:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:43:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:36:30 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:25:11 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 11:45:41 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:56:31 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:00:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:54:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 11:22:33 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:29:07 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:06:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:52:38 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:26:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:59:33 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 12:13:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:32:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:53:46 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 13:53:06 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:32:04 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:38:02 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:08:57 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:59:26 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 12:45:02 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:35:54 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:53:33 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4484946830.000000000320D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 07:38:08 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:17:45 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:10:23 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:06:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:41:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 06:46:06 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:01:32 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:09:41 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:32:15 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:43:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:54:30 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 07:54:15 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:27:06 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4484946830.0000000002F79000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4484946830.00000000033D4000.00000004.00000800.00020000.00000000.sdmp, En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/15 \| 03:06:38 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 13:08:00 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 10:13:38 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:13:39 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:48:00 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 16:22:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 13:05:08 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:43:13 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:09:27 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 12:06:55 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:45:42 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:11:39 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:34:23 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:36:00 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 08:30:06 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 12:52:43 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:35:00 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:26:29 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:04:34 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:21:19 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:33:52 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 08:29:10 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:40:35 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 21:14:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:11:08 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:00:56 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:31:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:48:37 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/22 \| 12:43:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:23:41 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:45:36 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 07:07:40 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 02:09:14 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:57:18 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:15:44 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 00:25:39 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 01:00:59 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:32:22 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 11:42:49 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 04:27:43 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:01:33 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 22:12:38 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:55:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 19:38:53 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:35:47 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 23:49:58 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 08:08:03 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 18:33:09 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 17:52:01 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 20:43:20 - Program Manager
Source: En3e396wX1.exe, 00000000.00000002.4486143905.0000000003EDB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/20 \| 05:26:05 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\En3e396wX1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Contains functionality to disable the Task Manager (.Net Source)

Source: En3e396wX1.exe, -.cs

.Net Code: @

Disables zone checking for all users

Source: C:\Users\user\Desktop\En3e396wX1.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\Desktop\En3e396wX1.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\En3e396wX1.exe" "En3e396wX1.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\En3e396wX1.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\En3e396wX1.exe" "En3e396wX1.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: En3e396wX1.exe, type: SAMPLE
Source: Yara match	File source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4484946830.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: En3e396wX1.exe PID: 5348, type: MEMORYSTR

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: En3e396wX1.exe, type: SAMPLE
Source: Yara match	File source: 0.0.En3e396wX1.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4484946830.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: En3e396wX1.exe PID: 5348, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	11 Replication Through Removable Media	Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	2 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
En3e396wX1.exe	82%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
En3e396wX1.exe	79%	Virustotal		Browse
En3e396wX1.exe	100%	Avira	TR/Dropper.Gen
En3e396wX1.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
2.tcp.eu.ngrok.io	12%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
2.tcp.eu.ngrok.io	18.197.239.5	true	true	12%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.127.138.57	unknown	United States	16509	AMAZON-02US	true
18.156.13.209	unknown	United States	16509	AMAZON-02US	true
18.197.239.5	2.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1425675
Start date and time:	2024-04-14 06:51:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	En3e396wX1.exe renamed because original name is a hash value
Original Sample Name:	F0FF2A2046A4FEFCD2D04C92C812FCF2.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.evad.winEXE@4/2@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 116 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:52:33	API Interceptor	619924x Sleep call for process: En3e396wX1.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.127.138.57	ea1Wv7aq.posh.ps1	Get hash	malicious	Metasploit	Browse
	R3ov8eFFFP.exe	Get hash	malicious	Njrat	Browse
	b8UsrDOVGV.exe	Get hash	malicious	Njrat	Browse
	2G8CgDVl3K.exe	Get hash	malicious	Njrat	Browse
	tiodtk2cfy.exe	Get hash	malicious	Njrat	Browse
	QUuUm3J8x3.exe	Get hash	malicious	Njrat	Browse
	RWqHoCWEPI.exe	Get hash	malicious	Njrat	Browse
	OUXkIxeP6k.exe	Get hash	malicious	Njrat	Browse
	eI43OwXSvq.exe	Get hash	malicious	Njrat	Browse
	i9z1c1OtFb.exe	Get hash	malicious	Njrat	Browse
18.156.13.209	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/
18.197.239.5	P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.tcp.eu.ngrok.io	ZxocxU01PB.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	4xKDL5YCfQ.exe	Get hash	malicious	Njrat	Browse	18.156.13.209
	R3ov8eFFFP.exe	Get hash	malicious	Njrat	Browse	3.127.138.57
	Ve0c8i5So2.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	LMQV4V1d3E.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	b8UsrDOVGV.exe	Get hash	malicious	Njrat	Browse	3.127.138.57
	2G8CgDVl3K.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	BHp5Is5Xe7.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	tiodtk2cfy.exe	Get hash	malicious	Njrat	Browse	3.127.138.57
	QUuUm3J8x3.exe	Get hash	malicious	Njrat	Browse	3.127.138.57

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	http://www2.gerdau.com.br/fornecedores	Get hash	malicious	Unknown	Browse	54.74.204.68
	TaNoeG7qKG.elf	Get hash	malicious	Mirai	Browse	52.59.238.42
	https://iamhemantgauhai.github.io/Task-1-Netflix-Replica-UI/	Get hash	malicious	Unknown	Browse	34.208.213.96
	https://cloudde-e0e7.samariakurtz.workers.dev/633c62d4-5847-4578-aefc-6b70c4961623	Get hash	malicious	HTMLPhisher	Browse	3.163.125.60
	https://enjucm-6424.anotudhoeah.workers.dev/8dc0c739-61df-4e9d-9bd9-b5bc957356bf	Get hash	malicious	HTMLPhisher	Browse	3.163.125.15
	https://szyishikang.com/	Get hash	malicious	Unknown	Browse	54.248.198.108
	http://validartucuentaaqui.mx.zya.me/login.live.com_login_verify_credentials_outlook.html?i=3	Get hash	malicious	Unknown	Browse	54.67.124.80
	https://rolexz.b-cdn.net/Wi0n0MntyEr00170887/index.html	Get hash	malicious	Unknown	Browse	18.195.235.189
	gvCeE0lHPK.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.249.145.219
	5DRwjDjwst.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
AMAZON-02US	http://www2.gerdau.com.br/fornecedores	Get hash	malicious	Unknown	Browse	54.74.204.68
	TaNoeG7qKG.elf	Get hash	malicious	Mirai	Browse	52.59.238.42
	https://iamhemantgauhai.github.io/Task-1-Netflix-Replica-UI/	Get hash	malicious	Unknown	Browse	34.208.213.96
	https://cloudde-e0e7.samariakurtz.workers.dev/633c62d4-5847-4578-aefc-6b70c4961623	Get hash	malicious	HTMLPhisher	Browse	3.163.125.60
	https://enjucm-6424.anotudhoeah.workers.dev/8dc0c739-61df-4e9d-9bd9-b5bc957356bf	Get hash	malicious	HTMLPhisher	Browse	3.163.125.15
	https://szyishikang.com/	Get hash	malicious	Unknown	Browse	54.248.198.108
	http://validartucuentaaqui.mx.zya.me/login.live.com_login_verify_credentials_outlook.html?i=3	Get hash	malicious	Unknown	Browse	54.67.124.80
	https://rolexz.b-cdn.net/Wi0n0MntyEr00170887/index.html	Get hash	malicious	Unknown	Browse	18.195.235.189
	gvCeE0lHPK.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.249.145.219
	5DRwjDjwst.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
AMAZON-02US	http://www2.gerdau.com.br/fornecedores	Get hash	malicious	Unknown	Browse	54.74.204.68
	TaNoeG7qKG.elf	Get hash	malicious	Mirai	Browse	52.59.238.42
	https://iamhemantgauhai.github.io/Task-1-Netflix-Replica-UI/	Get hash	malicious	Unknown	Browse	34.208.213.96
	https://cloudde-e0e7.samariakurtz.workers.dev/633c62d4-5847-4578-aefc-6b70c4961623	Get hash	malicious	HTMLPhisher	Browse	3.163.125.60
	https://enjucm-6424.anotudhoeah.workers.dev/8dc0c739-61df-4e9d-9bd9-b5bc957356bf	Get hash	malicious	HTMLPhisher	Browse	3.163.125.15
	https://szyishikang.com/	Get hash	malicious	Unknown	Browse	54.248.198.108
	http://validartucuentaaqui.mx.zya.me/login.live.com_login_verify_credentials_outlook.html?i=3	Get hash	malicious	Unknown	Browse	54.67.124.80
	https://rolexz.b-cdn.net/Wi0n0MntyEr00170887/index.html	Get hash	malicious	Unknown	Browse	18.195.235.189
	gvCeE0lHPK.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.249.145.219
	5DRwjDjwst.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219

Process:	C:\Users\user\Desktop\En3e396wX1.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:3n:3
MD5:	8F11404A507CFB98455F89A534077F73
SHA1:	0716C668F504450353527AFF1A6457B8348CF435
SHA-256:	F7C301F3FCCE1C2444B540090E5024F0CEA1806AB8AE1D81901ECC3B63334CBB
SHA-512:	85403DD06DA5851E8C4D727CA8D87CC0E7FF4974942EC22123366684ED0E51B543A29B6D2521E2E65784C69884FDE8D711E5064F104B098293FCD18C44769492
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.14

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.551495374876113
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	En3e396wX1.exe
File size:	93'184 bytes
MD5:	f0ff2a2046a4fefcd2d04c92c812fcf2
SHA1:	d2004f23d6b5a90888395c1f2d72d288b2dea821
SHA256:	06b314e6e7127b58bdafcd05252a28af38233afe2b188584eb4d27ab372c8762
SHA512:	6d7767f7228397ba91fb87bb0d320533b1fb8d35a05cccbef58f19f2ad1101a3799bdfb4baacd8e0ccc6899cc2b61685801fe2702b17f3d94652bc323cfcb90c
SSDEEP:	768:eGZefAM+0uGAfIi+qXuzMywjZdLJakHX+xWvYR4SYzkYFI3tr3/iTnRVOR1MY4qn:YfAl0pUjBjZdL4kHG5mkYQJVR1/LpNv
TLSH:	2293E84D37E55065E2FE4AF3A870B2400FB9F0471742938D49E1A9761A33AD88F94DBB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\..f.................h..........^.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41865e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6600185C [Sun Mar 24 12:11:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1860c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16664	0x16800	926e9318c320b36a1762b59563d53789	False	0.3633355034722222	data	5.584254622217285	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	ff06ea9c63404a08dec111ab855065d8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/14/24-06:54:11.093222	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49716	14095	192.168.2.5	18.156.13.209
04/14/24-06:53:07.096652	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49714	14095	192.168.2.5	3.127.138.57
04/14/24-06:54:11.400675	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49716	14095	192.168.2.5	18.156.13.209
04/14/24-06:54:14.327523	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49716	14095	192.168.2.5	18.156.13.209
04/14/24-06:52:08.702264	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49705	14095	192.168.2.5	18.197.239.5
04/14/24-06:53:07.405791	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49714	14095	192.168.2.5	3.127.138.57
04/14/24-06:55:15.097163	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49717	14095	192.168.2.5	18.197.239.5
04/14/24-06:52:08.702264	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49705	14095	192.168.2.5	18.197.239.5
04/14/24-06:52:03.604825	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49705	14095	192.168.2.5	18.197.239.5
04/14/24-06:52:03.291445	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49705	14095	192.168.2.5	18.197.239.5
04/14/24-06:54:14.327523	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49716	14095	192.168.2.5	18.156.13.209
04/14/24-06:55:15.404401	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49717	14095	192.168.2.5	18.197.239.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 14, 2024 06:52:02.909413099 CEST	49705	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:52:03.222256899 CEST	14095	49705	18.197.239.5	192.168.2.5
Apr 14, 2024 06:52:03.222475052 CEST	49705	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:52:03.291445017 CEST	49705	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:52:03.604640007 CEST	14095	49705	18.197.239.5	192.168.2.5
Apr 14, 2024 06:52:03.604825020 CEST	49705	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:52:03.917789936 CEST	14095	49705	18.197.239.5	192.168.2.5
Apr 14, 2024 06:52:08.702264071 CEST	49705	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:52:09.015352011 CEST	14095	49705	18.197.239.5	192.168.2.5
Apr 14, 2024 06:52:24.237376928 CEST	14095	49705	18.197.239.5	192.168.2.5
Apr 14, 2024 06:52:24.237430096 CEST	49705	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:52:39.553397894 CEST	14095	49705	18.197.239.5	192.168.2.5
Apr 14, 2024 06:52:39.553491116 CEST	49705	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:52:54.869601965 CEST	14095	49705	18.197.239.5	192.168.2.5
Apr 14, 2024 06:52:54.870095968 CEST	49705	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:53:04.615612030 CEST	14095	49705	18.197.239.5	192.168.2.5
Apr 14, 2024 06:53:04.615706921 CEST	49705	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:53:06.625715017 CEST	49705	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:53:06.785188913 CEST	49714	14095	192.168.2.5	3.127.138.57
Apr 14, 2024 06:53:06.939268112 CEST	14095	49705	18.197.239.5	192.168.2.5
Apr 14, 2024 06:53:07.095134974 CEST	14095	49714	3.127.138.57	192.168.2.5
Apr 14, 2024 06:53:07.095232964 CEST	49714	14095	192.168.2.5	3.127.138.57
Apr 14, 2024 06:53:07.096652031 CEST	49714	14095	192.168.2.5	3.127.138.57
Apr 14, 2024 06:53:07.405733109 CEST	14095	49714	3.127.138.57	192.168.2.5
Apr 14, 2024 06:53:07.405791044 CEST	49714	14095	192.168.2.5	3.127.138.57
Apr 14, 2024 06:53:07.714529991 CEST	14095	49714	3.127.138.57	192.168.2.5
Apr 14, 2024 06:53:22.715188026 CEST	14095	49714	3.127.138.57	192.168.2.5
Apr 14, 2024 06:53:22.715266943 CEST	49714	14095	192.168.2.5	3.127.138.57
Apr 14, 2024 06:53:38.027453899 CEST	14095	49714	3.127.138.57	192.168.2.5
Apr 14, 2024 06:53:38.027632952 CEST	49714	14095	192.168.2.5	3.127.138.57
Apr 14, 2024 06:53:53.343367100 CEST	14095	49714	3.127.138.57	192.168.2.5
Apr 14, 2024 06:53:53.343533993 CEST	49714	14095	192.168.2.5	3.127.138.57
Apr 14, 2024 06:54:08.610907078 CEST	14095	49714	3.127.138.57	192.168.2.5
Apr 14, 2024 06:54:08.611697912 CEST	49714	14095	192.168.2.5	3.127.138.57
Apr 14, 2024 06:54:10.623795986 CEST	49714	14095	192.168.2.5	3.127.138.57
Apr 14, 2024 06:54:10.783406019 CEST	49716	14095	192.168.2.5	18.156.13.209
Apr 14, 2024 06:54:10.932416916 CEST	14095	49714	3.127.138.57	192.168.2.5
Apr 14, 2024 06:54:11.091090918 CEST	14095	49716	18.156.13.209	192.168.2.5
Apr 14, 2024 06:54:11.091217995 CEST	49716	14095	192.168.2.5	18.156.13.209
Apr 14, 2024 06:54:11.093221903 CEST	49716	14095	192.168.2.5	18.156.13.209
Apr 14, 2024 06:54:11.400532007 CEST	14095	49716	18.156.13.209	192.168.2.5
Apr 14, 2024 06:54:11.400675058 CEST	49716	14095	192.168.2.5	18.156.13.209
Apr 14, 2024 06:54:11.708328009 CEST	14095	49716	18.156.13.209	192.168.2.5
Apr 14, 2024 06:54:14.327522993 CEST	49716	14095	192.168.2.5	18.156.13.209
Apr 14, 2024 06:54:14.635154009 CEST	14095	49716	18.156.13.209	192.168.2.5
Apr 14, 2024 06:54:29.716849089 CEST	14095	49716	18.156.13.209	192.168.2.5
Apr 14, 2024 06:54:29.717046976 CEST	49716	14095	192.168.2.5	18.156.13.209
Apr 14, 2024 06:54:45.025136948 CEST	14095	49716	18.156.13.209	192.168.2.5
Apr 14, 2024 06:54:45.025391102 CEST	49716	14095	192.168.2.5	18.156.13.209
Apr 14, 2024 06:55:00.332755089 CEST	14095	49716	18.156.13.209	192.168.2.5
Apr 14, 2024 06:55:00.332817078 CEST	49716	14095	192.168.2.5	18.156.13.209
Apr 14, 2024 06:55:12.614891052 CEST	14095	49716	18.156.13.209	192.168.2.5
Apr 14, 2024 06:55:12.615005016 CEST	49716	14095	192.168.2.5	18.156.13.209
Apr 14, 2024 06:55:14.624006033 CEST	49716	14095	192.168.2.5	18.156.13.209
Apr 14, 2024 06:55:14.786896944 CEST	49717	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:55:14.931185007 CEST	14095	49716	18.156.13.209	192.168.2.5
Apr 14, 2024 06:55:15.096182108 CEST	14095	49717	18.197.239.5	192.168.2.5
Apr 14, 2024 06:55:15.096323013 CEST	49717	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:55:15.097162962 CEST	49717	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:55:15.404283047 CEST	14095	49717	18.197.239.5	192.168.2.5
Apr 14, 2024 06:55:15.404401064 CEST	49717	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:55:15.711644888 CEST	14095	49717	18.197.239.5	192.168.2.5
Apr 14, 2024 06:55:30.712021112 CEST	14095	49717	18.197.239.5	192.168.2.5
Apr 14, 2024 06:55:30.712107897 CEST	49717	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:55:46.024148941 CEST	14095	49717	18.197.239.5	192.168.2.5
Apr 14, 2024 06:55:46.024267912 CEST	49717	14095	192.168.2.5	18.197.239.5
Apr 14, 2024 06:56:01.348027945 CEST	14095	49717	18.197.239.5	192.168.2.5
Apr 14, 2024 06:56:01.351560116 CEST	49717	14095	192.168.2.5	18.197.239.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 14, 2024 06:52:02.748292923 CEST	63512	53	192.168.2.5	1.1.1.1
Apr 14, 2024 06:52:02.906595945 CEST	53	63512	1.1.1.1	192.168.2.5
Apr 14, 2024 06:53:06.627624035 CEST	65447	53	192.168.2.5	1.1.1.1
Apr 14, 2024 06:53:06.784053087 CEST	53	65447	1.1.1.1	192.168.2.5
Apr 14, 2024 06:54:10.624919891 CEST	57257	53	192.168.2.5	1.1.1.1
Apr 14, 2024 06:54:10.782660961 CEST	53	57257	1.1.1.1	192.168.2.5
Apr 14, 2024 06:55:14.626933098 CEST	50280	53	192.168.2.5	1.1.1.1
Apr 14, 2024 06:55:14.783973932 CEST	53	50280	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 14, 2024 06:52:02.748292923 CEST	192.168.2.5	1.1.1.1	0xa875	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Apr 14, 2024 06:53:06.627624035 CEST	192.168.2.5	1.1.1.1	0x2478	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Apr 14, 2024 06:54:10.624919891 CEST	192.168.2.5	1.1.1.1	0x2c84	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Apr 14, 2024 06:55:14.626933098 CEST	192.168.2.5	1.1.1.1	0xa140	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 14, 2024 06:52:02.906595945 CEST	1.1.1.1	192.168.2.5	0xa875	No error (0)	2.tcp.eu.ngrok.io	18.197.239.5	A (IP address)	IN (0x0001)	false
Apr 14, 2024 06:53:06.784053087 CEST	1.1.1.1	192.168.2.5	0x2478	No error (0)	2.tcp.eu.ngrok.io	3.127.138.57	A (IP address)	IN (0x0001)	false
Apr 14, 2024 06:54:10.782660961 CEST	1.1.1.1	192.168.2.5	0x2c84	No error (0)	2.tcp.eu.ngrok.io	18.156.13.209	A (IP address)	IN (0x0001)	false
Apr 14, 2024 06:55:14.783973932 CEST	1.1.1.1	192.168.2.5	0xa140	No error (0)	2.tcp.eu.ngrok.io	18.197.239.5	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	06:51:57
Start date:	14/04/2024
Path:	C:\Users\user\Desktop\En3e396wX1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\En3e396wX1.exe"
Imagebase:	0x8f0000
File size:	93'184 bytes
MD5 hash:	F0FF2A2046A4FEFCD2D04C92C812FCF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.2029633518.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.4484946830.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:51:59
Start date:	14/04/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\En3e396wX1.exe" "En3e396wX1.exe" ENABLE
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:51:59
Start date:	14/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.3%
Total number of Nodes:	92
Total number of Limit Nodes:	5

Executed Functions

Function 050C4298 Relevance: 3.2, Strings: 1, Instructions: 1950
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 050C4C24

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b9f673c4b4b88062d61f4415dbb97266696fd1b2df4fabd35d67c44607590728
Instruction ID: 3d8800e49d414ed44fec263b6c8ce0be987b1970d18c1f466ad9283dd35ef90a
Opcode Fuzzy Hash: b9f673c4b4b88062d61f4415dbb97266696fd1b2df4fabd35d67c44607590728
Instruction Fuzzy Hash: 36235A74A11228CFDB65EF35D864BADB7B2BB89304F0041E9D909673A5DB359E82CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C4287 Relevance: 3.0, Strings: 1, Instructions: 1752
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 050C4BC4

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4146991a82013bac03f84b2c869279bf12ef74ef477f272f505d0096efb0d8a0
Instruction ID: a2381670c72c81dd57db9a8cbfa26d42d66008af892831aee1927c4b359f59b2
Opcode Fuzzy Hash: 4146991a82013bac03f84b2c869279bf12ef74ef477f272f505d0096efb0d8a0
Instruction Fuzzy Hash: 89132A74A11228CFDB25EF35D864BADB7B2BB89304F1042E9D909673A5DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C44F1 Relevance: 2.9, Strings: 1, Instructions: 1624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 050C4BC4

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e9c2e22f6a22e869856a139721a590b377f76cca67291c467d9f62dddafe8d2a
Instruction ID: e3d335b51d7a431ebad5fda77f9ba333da9e5d968c94d6b5b8f01ac51e238c2a
Opcode Fuzzy Hash: e9c2e22f6a22e869856a139721a590b377f76cca67291c467d9f62dddafe8d2a
Instruction Fuzzy Hash: C9033B74A11228CFDB25EB35D864BADB7B2FB89304F1042E9D909673A5DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C4544 Relevance: 2.9, Strings: 1, Instructions: 1618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 050C4BC4

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5b2ad6d8a6b62ea780302cce48cfaa10e639e084ad1a5d75867dc62e6f7f9eef
Instruction ID: 891dc077a05694a8f9c805a2dbd1a3301393b7b20d1816ef1147977ba8d9b723
Opcode Fuzzy Hash: 5b2ad6d8a6b62ea780302cce48cfaa10e639e084ad1a5d75867dc62e6f7f9eef
Instruction Fuzzy Hash: 02033B74A11228CFDB25EF35D864BADB7B2BB89304F1042E9D909673A5DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C4630 Relevance: 2.8, Strings: 1, Instructions: 1579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 050C4BC4

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: cecb47df08a257da3f976ac1c9b0a9cd07a5a3c6963a6bc71c440b212f2347ab
Instruction ID: ecf54508afa0e4051e53d53626a8ba90e08e2739c7fd2041e7886bc8a6fcbc29
Opcode Fuzzy Hash: cecb47df08a257da3f976ac1c9b0a9cd07a5a3c6963a6bc71c440b212f2347ab
Instruction Fuzzy Hash: 8C033A74A11228CFDB25EF35D864BADB7B1BB89304F1042EAD909673A5DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C470F Relevance: 2.8, Strings: 1, Instructions: 1544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 050C4BC4

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: adc294e01d1282735f12e2e854fcb7333a26101a3e543d707b2d8d6b5a4212e2
Instruction ID: c42e18cc0b40660d091387fb3ee1ec788a1adbf84ef5fa12c7ec6bb899bb02a6
Opcode Fuzzy Hash: adc294e01d1282735f12e2e854fcb7333a26101a3e543d707b2d8d6b5a4212e2
Instruction Fuzzy Hash: FFF23A74A11228CFDB25EF35D864BADB7B1BB89304F1042EAD909673A5DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C47D4 Relevance: 2.8, Strings: 1, Instructions: 1513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 050C4BC4

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9bdba4688c32581bab708038503fd529a62a5cb198e3b1885de102da56ea88a7
Instruction ID: d178bfe20ecf5fc84c95b6d68649aada23d80fa224f99efb5781ad518c43dae2
Opcode Fuzzy Hash: 9bdba4688c32581bab708038503fd529a62a5cb198e3b1885de102da56ea88a7
Instruction Fuzzy Hash: 34F24B74A11228CFDB25EF35D864BADB7B1BB89304F1042EAD909673A5DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C4936 Relevance: 2.7, Strings: 1, Instructions: 1456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 050C4BC4

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ce5ebe08c588295e7e9457f747ca36523e4b147b8ae1d868cd5ec184492488ba
Instruction ID: 4775368d85e9fbb4e0e846e8f49ad46073dea62924dfba7e7459dedaa16eb746
Opcode Fuzzy Hash: ce5ebe08c588295e7e9457f747ca36523e4b147b8ae1d868cd5ec184492488ba
Instruction Fuzzy Hash: 60F24B74A11228CFDB25EF35D864BADB7B1BB89304F1042EAD909673A5DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05232497 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 05232517

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: d4f0b004fca9dced54d99527c43bd7fa17b2a5c27b9c0302a44ead478fd6662e
Instruction ID: cacdc575984cace7a3469e320c52907310c6098f1d40175c334f2b6f6732887d
Opcode Fuzzy Hash: d4f0b004fca9dced54d99527c43bd7fa17b2a5c27b9c0302a44ead478fd6662e
Instruction Fuzzy Hash: AB21BFB55093809FDB128F25DC41B62BFB8FF06310F08849AE9898B563D230E908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 052324CE Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 05232517

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 22126f2ab41dfc951f475edfdcb8a9ee8ef5ebd63e5f37e86c89861d3c90fc39
Instruction ID: de4e764382be48cd7ecba3052cc16660ac0e6f2951e4c8c40b01fe4e3f4afc8c
Opcode Fuzzy Hash: 22126f2ab41dfc951f475edfdcb8a9ee8ef5ebd63e5f37e86c89861d3c90fc39
Instruction Fuzzy Hash: 5111A075510200DFDB20CF15D885B62FBE9FF14320F08C8AAED4A8B652D375E518CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05231F6E Relevance: 1.6, APIs: 1, Instructions: 130
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 05232069

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0a231a27d12294c820d9d47e73a8228ab191054284639a07d011a1d1aa7e5b34
Instruction ID: 4dabc1f05d143d469afcef2cbe0c56c561a44c610c4d1ccf65db717cd4ce2717
Opcode Fuzzy Hash: 0a231a27d12294c820d9d47e73a8228ab191054284639a07d011a1d1aa7e5b34
Instruction Fuzzy Hash: 7C417C75109380AFE7238B218C50BA6BFB8EF16214F0985DAE985CB563D224E80DCB71

Uniqueness

Uniqueness Score: -1.00%

Function 0523045F Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 05230526

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 6f56130b72c48d5d84726536d5482578a08bfc6108e7f7c6dc9ca431ff725929
Instruction ID: 89567d1812704b61b6c608721b37af8e6b8ef07104001cfd0cf3d04a2fdb54b8
Opcode Fuzzy Hash: 6f56130b72c48d5d84726536d5482578a08bfc6108e7f7c6dc9ca431ff725929
Instruction Fuzzy Hash: 63318D6510E3C06FD3138B258C65A61BFB4EF47610B0E85CBD8C48B6A3D219A909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0100B1E6 Relevance: 1.6, APIs: 1, Instructions: 97
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 0100B291

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a92078c7e9e14b19400d6092f55667884579b3b486e0ee56503f543faee2cc96
Instruction ID: 7ddbfc1823f6f3ab1f6ea708363f1366aa832d24f2dc977cad940929c78a6396
Opcode Fuzzy Hash: a92078c7e9e14b19400d6092f55667884579b3b486e0ee56503f543faee2cc96
Instruction Fuzzy Hash: 32316F71409384AFE7238B65CC45FAABFF8EF16210F08849AE9849B593D224E409C761

Uniqueness

Uniqueness Score: -1.00%

Function 052311FC Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 052312C3

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 7778d489526b32ba2b846724251e413ce3de04827a23b82ca65ca7e15625a639
Instruction ID: 465136fdd3ca8f86767f07d0206ea37d74aa19f630c0cdc7236edd6bd9bc89f5
Opcode Fuzzy Hash: 7778d489526b32ba2b846724251e413ce3de04827a23b82ca65ca7e15625a639
Instruction Fuzzy Hash: 8131B1B1504344AFE721DB61CC44FA6FBACEF05314F04889AFA489B682D374E949CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0100AA75 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0100AB25

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: aec6d1ff832cddf0cadf8f7057d386de1edfda228d1a7f10cc21cc6ffcc1d496
Instruction ID: c4f496fc337a6508cb191c3888bc73e644b76cb160b51c79942517654ee427b4
Opcode Fuzzy Hash: aec6d1ff832cddf0cadf8f7057d386de1edfda228d1a7f10cc21cc6ffcc1d496
Instruction Fuzzy Hash: CF317071509780AFE722CF25CC44F56BFF8EF06214F08889AE9858B692D365E809CB61

Uniqueness

Uniqueness Score: -1.00%

Function 052310F4 Relevance: 1.6, APIs: 1, Instructions: 92
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessTimes.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 05231191

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 72835368bf577b4ca19ef8d10ad1b4a11165ee19a1d764f847fc2967c83a9b59
Instruction ID: 12688118f09fab221b28eff2903a534f6a21c0a71d73115f5932f5a01c3c74ab
Opcode Fuzzy Hash: 72835368bf577b4ca19ef8d10ad1b4a11165ee19a1d764f847fc2967c83a9b59
Instruction Fuzzy Hash: 7D31C5B25097816FD7228F21DC45FA6BFB8EF16324F0884DBE8848F193D265A519C771

Uniqueness

Uniqueness Score: -1.00%

Function 0100B036 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0100B0DD

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 4cb3b2d65c583132adf9439274a766c178d63637c646e8e42678b61e9eb703a3
Instruction ID: 21f3ad36e56ae1929d38897b3d5b92e604bd3a50a9523da3a8d17e3c04af0331
Opcode Fuzzy Hash: 4cb3b2d65c583132adf9439274a766c178d63637c646e8e42678b61e9eb703a3
Instruction Fuzzy Hash: 453173755093805FE712CB25DC45B96BFF8EF06214F08849AE984CB293D375E909C762

Uniqueness

Uniqueness Score: -1.00%

Function 0100B2D9 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0100B394

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1f6a4cb02c0141fddeaf38542244db9f3fe671b2f39dfb3a9995421387a64dfc
Instruction ID: 92570ed1d1f644d2fccb0af0e1e350c71a2fd6d9eb0eebc88b41ce232f21d4f4
Opcode Fuzzy Hash: 1f6a4cb02c0141fddeaf38542244db9f3fe671b2f39dfb3a9995421387a64dfc
Instruction Fuzzy Hash: 5D31B175509380AFE722CB65CC44FA6BFF8EF06214F18C4DAE985CB293D260E509CB61

Uniqueness

Uniqueness Score: -1.00%

Function 052309F0 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 05230A87

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 9a8aba143c715f58ab2de48e14dc61d589e3bc1d33e018765701fb501b2c0a08
Instruction ID: d749752220d6e1a68fb4af6967b97ffd752c6b677883622e3611bd7dad358800
Opcode Fuzzy Hash: 9a8aba143c715f58ab2de48e14dc61d589e3bc1d33e018765701fb501b2c0a08
Instruction Fuzzy Hash: 5131B171505345AFE721CB65DC45FA7BBE8EF05210F08849AE944DB652D324E808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05231FCE Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 05232069

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2ba76fbfbe744946b45be42d4c4b27b26263c5c4adbffcd617b15184e6b8f085
Instruction ID: f60977740494330999cccc2cdcb07e988ec53e1ce5ac85e2dfad61b57b087dcd
Opcode Fuzzy Hash: 2ba76fbfbe744946b45be42d4c4b27b26263c5c4adbffcd617b15184e6b8f085
Instruction Fuzzy Hash: BE21A0B6510204EFE721DF15CC45FA7BBECEF28614F04885AE94AD7651D724E40CCB61

Uniqueness

Uniqueness Score: -1.00%

Function 0100A6CE Relevance: 1.6, APIs: 1, Instructions: 85comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0100A77E

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 87100a3c256a0e1af7fa7319fa7d112b33d075dde0438e865a9183216c3a6e26
Instruction ID: 6ea7d78456dc15dc50df7725d31a41b59010944841e7daef709690a7a47edb9b
Opcode Fuzzy Hash: 87100a3c256a0e1af7fa7319fa7d112b33d075dde0438e865a9183216c3a6e26
Instruction Fuzzy Hash: 1931717504E3C06FD3138B259C61B61BFB4EF87610F0A80CBE884CB5A3D2256919D772

Uniqueness

Uniqueness Score: -1.00%

Function 0523121E Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 052312C3

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: cd54ae29fe48029befc4545f37bbdbc0245245c95ba01fc0a87c995091a90fe5
Instruction ID: c738857e64143cbd19b1503a1a7f7873f78e0dc075ce70b69f71d79abbeaa0d1
Opcode Fuzzy Hash: cd54ae29fe48029befc4545f37bbdbc0245245c95ba01fc0a87c995091a90fe5
Instruction Fuzzy Hash: F221DEB1500204AFEB21DB61CD85FAAF7ECEF14714F04885AFA48DA681D3B4E549CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0100B4C8 Relevance: 1.6, APIs: 1, Instructions: 82windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 0100B571

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: b5b86b006c6da0c042c56b3a430320b0d8d05b263aa123b975f82d569746596f
Instruction ID: 827da6a42ef76d5cca9056ce92216bb2814c11e1039a40d9a443d0f79ea0ae54
Opcode Fuzzy Hash: b5b86b006c6da0c042c56b3a430320b0d8d05b263aa123b975f82d569746596f
Instruction Fuzzy Hash: 9E21A571505340AFE7228F61DC44FA6FFB8EF46314F08849AE9859B592D375A409CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05232241 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 052322D0

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 00684a2d19953f044d72a507191aa78ead7aaabd5d30642aab9cc8d2e759777b
Instruction ID: bd3081006ac8ccee60b3f9176c63492ce9679adb70aa11e2894a3c409275ad75
Opcode Fuzzy Hash: 00684a2d19953f044d72a507191aa78ead7aaabd5d30642aab9cc8d2e759777b
Instruction Fuzzy Hash: E1215CB55093859FDB12CF25DC44A62BFF8FF06214B08849AE989CB162D264A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05232619 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 052326A0

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 17aa05247777a16bf67ed05d39be3b0713655204186d3637cdfbcf5b8c88cf05
Instruction ID: d24e74e68803fb9e6a314f0736260ed2ce6eabc2b4a295d32e8845d4f71753bc
Opcode Fuzzy Hash: 17aa05247777a16bf67ed05d39be3b0713655204186d3637cdfbcf5b8c88cf05
Instruction Fuzzy Hash: 1321A1715093846FE712CB25DC45FA6BFA8EF42714F0884EAE944DF193D264E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0100AE77 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0100AF0D

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 28d6e1214cccd97db525c943dac9f91aa972930d6fbf32feafa8af6360135388
Instruction ID: 5a5af357e3c20ba9d2c19e9d89d1a986ebddd0f204bccb2e194a02819b551ae9
Opcode Fuzzy Hash: 28d6e1214cccd97db525c943dac9f91aa972930d6fbf32feafa8af6360135388
Instruction Fuzzy Hash: 0F21A3B2509380AFE722CB61DC44F96BFB8EF56314F0884DAE9849B193D265A509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0100B3EA Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0100B480

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f338f83b774ed337a7d1c39a70593eef3dcc92f3deead857836f3a67d84a1a8c
Instruction ID: c4f0137901430e097bc73f14aedb399051fc23e4ec767d9a66f66399d883d15f
Opcode Fuzzy Hash: f338f83b774ed337a7d1c39a70593eef3dcc92f3deead857836f3a67d84a1a8c
Instruction Fuzzy Hash: 9221AE76504780AFE7228B15CC44FA7BFF8EF46210F08849AE985DB292D264E908C771

Uniqueness

Uniqueness Score: -1.00%

Function 05230552 Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 052305DE

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: c7e174242ea35cdc276c3aa41c0a89f89de5e950bd125c15723ef64e7efbe397
Instruction ID: b5d509451eda51d8e1a02c6a9ca95078e40f632165d11d821910c480302c7a1d
Opcode Fuzzy Hash: c7e174242ea35cdc276c3aa41c0a89f89de5e950bd125c15723ef64e7efbe397
Instruction Fuzzy Hash: A4217E71509380AFD722CF61DC45FA6FFB8EF09224F08889EE9858B652D375A409CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05230BA6 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 05230C3A

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: b62958ae1073a6f8c681e077d475213eb377fc82065eb18a25b4977c5b41d0ce
Instruction ID: 9b38215cdabe188d7216243f4d38793b6c38e49f0c90f2d369c37308eefae267
Opcode Fuzzy Hash: b62958ae1073a6f8c681e077d475213eb377fc82065eb18a25b4977c5b41d0ce
Instruction Fuzzy Hash: 6B21B171405340AFE722CB15CC45F96FBF8EF19224F04889EE9848B652D365E509CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0100AAA6 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0100AB25

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e62ad24f2e814b9f430e383b2a69a5ce976a4a72e2ce8cdd9f5599d9c4848bad
Instruction ID: a852d5f356bcad68d464114e3133603863f7c48351034230a5cf308a3c4e0741
Opcode Fuzzy Hash: e62ad24f2e814b9f430e383b2a69a5ce976a4a72e2ce8cdd9f5599d9c4848bad
Instruction Fuzzy Hash: 2621B271604700AFE721CF25CC44F66FBE8EF18314F048869E9858B692D375E408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05230A16 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 05230A87

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: eeb438a7d746aad080474105d976ff9b57731ad586f98cce43d7b2f9aa670a91
Instruction ID: ed39fd4eccbb3c320ead40d2ee55fa23afe39f8e1373c66ce69c5661f1a29efc
Opcode Fuzzy Hash: eeb438a7d746aad080474105d976ff9b57731ad586f98cce43d7b2f9aa670a91
Instruction Fuzzy Hash: 1A21D4B2501205AFEB20DF25DC45FABBBECEF14614F04846AEE45DB641D774E4088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 052308FE Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0523099C

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 050a81be002b27e6c8ff3f0222ff36ca521f2e376b49673219879b5faa32e8f7
Instruction ID: 3f52d523914e7a567243a00d509d89c050cbf8db2d609c0e2fd94c5047127fa3
Opcode Fuzzy Hash: 050a81be002b27e6c8ff3f0222ff36ca521f2e376b49673219879b5faa32e8f7
Instruction Fuzzy Hash: 702192B2509740AFE722CB11CC85F67BFF8EF55710F08889AE9459B692D325E908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0100B212 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 0100B291

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4a891cab6e9aaf03e88377822857f32b2754026c9210178821eedcfa3054a315
Instruction ID: cf22f9d49ab2c424a0b37ee6a8f23ec9fb0de9dc447e5614dd7f51b7b8e5b31d
Opcode Fuzzy Hash: 4a891cab6e9aaf03e88377822857f32b2754026c9210178821eedcfa3054a315
Instruction Fuzzy Hash: FE21A176500204AFE722DF55CC44FABFBECEF14714F04885AEA458BA92D724E5098BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0100AC37 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0100ACBD

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 0219b2c6528962485b2b00b6a30cd683ed8bc1c0d576d87160635f6ee06c0f04
Instruction ID: 68cca1f01baf13d3a7381fd839bbe37a60523b98018d7b127ee7606fd9dbf625
Opcode Fuzzy Hash: 0219b2c6528962485b2b00b6a30cd683ed8bc1c0d576d87160635f6ee06c0f04
Instruction Fuzzy Hash: 582105B54083806FE7138B11DC40BA6BFB8EF53314F08C0DAE9848B293C264A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0100A9BF Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0100AA44

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f1107081fe5035980806b8ffe6537b40849eab828833472f901b9d03094a5fc2
Instruction ID: 80f54db0f2ff8792d3fd3f82bdf13a3798a19e7f9b650a6046050ab47e1900aa
Opcode Fuzzy Hash: f1107081fe5035980806b8ffe6537b40849eab828833472f901b9d03094a5fc2
Instruction Fuzzy Hash: 3121486550E3C09FD7138B258C64A51BFB4EF53624F0E84DBD9C48F5A3C2689848CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05232703 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0523277F

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 0c4ccb3d50334351dbcc863d9a4a0e9b1162ed120b7c46d190e80dd5c11ab73c
Instruction ID: af6342c866ffcc77ed414c1dbed9a8c166e1f8b39a1b03504befea126766d50b
Opcode Fuzzy Hash: 0c4ccb3d50334351dbcc863d9a4a0e9b1162ed120b7c46d190e80dd5c11ab73c
Instruction Fuzzy Hash: 7E21C271509380AFE712CB21CC49FAABFA8EF46214F08C89AE945CB192D364E508CB71

Uniqueness

Uniqueness Score: -1.00%

Function 052327E7 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 05232863

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 0c4ccb3d50334351dbcc863d9a4a0e9b1162ed120b7c46d190e80dd5c11ab73c
Instruction ID: 1453ab16806d9912c8d4866e3111e4238abe4a2188d45af610bf8908cd10f35c
Opcode Fuzzy Hash: 0c4ccb3d50334351dbcc863d9a4a0e9b1162ed120b7c46d190e80dd5c11ab73c
Instruction Fuzzy Hash: 4F21D471509380AFD712CB21DC45FABBFA8EF46214F08C89AE944DB152D374E508CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0100B06A Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0100B0DD

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: d98e6ae33f010c48a3e5e188c0e819082ad250da11d1d9ba8d545594b98b68b0
Instruction ID: a582dad9a7760ec47d32a6827d2bac6e0ec81af498fc48e388601c2a40220c11
Opcode Fuzzy Hash: d98e6ae33f010c48a3e5e188c0e819082ad250da11d1d9ba8d545594b98b68b0
Instruction Fuzzy Hash: FA2180756042009FF721DB25DC45BA6FBE8EF15224F0488A9E9498B682D775E408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05230E3D Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 05230EC0

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: a17d1e04132df933339ccd99448cbe8f31edffda048b561b3733d94e0f09af06
Instruction ID: f1a143cdc052a0287b2e2fa0f47d2a11856735a77a1fc11c50101bc23b0b6630
Opcode Fuzzy Hash: a17d1e04132df933339ccd99448cbe8f31edffda048b561b3733d94e0f09af06
Instruction Fuzzy Hash: BE2192B1509384AFD712CB15CC45FA6BFB8EF46224F0884DAE9449F252C369A549CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0100A140 Relevance: 1.6, APIs: 1, Instructions: 71networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 0100A1C1

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 259165c4f4a1d85fde82e55b6931e11b0a256082cc428c6483d5df8a124a84ce
Instruction ID: 84f4ce18317ad39a970f29d23e7cc04d8395202979a73e2f216b6f397ca2b67c
Opcode Fuzzy Hash: 259165c4f4a1d85fde82e55b6931e11b0a256082cc428c6483d5df8a124a84ce
Instruction Fuzzy Hash: D3219A7190D3C09FDB138B258C54A52BFB4AF07210F0988DBD9848F5A3D265A809C762

Uniqueness

Uniqueness Score: -1.00%

Function 0100B31A Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0100B394

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 6f7e4dd3fd33aa3ecd258c08d1694a7a4f883d0aed6e7d545ca0001bc23d6b6d
Instruction ID: 943ca2b18c13d3bb782b887440242cf6ca405113e1b7606197bc7b827fe213ea
Opcode Fuzzy Hash: 6f7e4dd3fd33aa3ecd258c08d1694a7a4f883d0aed6e7d545ca0001bc23d6b6d
Instruction Fuzzy Hash: DC21C075600200AFE722CF15CC44FA6BBECEF14610F18C49AED85DB692D760E408CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0523217B Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 052321F7

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: e4365839a0f6ea0dbc20ceacd056c96a6f1154bc018bde47588a8d02b8567b7f
Instruction ID: bbc63265477e180271d8ab4839b60c1d9396f791981c77f981783bce66846f1a
Opcode Fuzzy Hash: e4365839a0f6ea0dbc20ceacd056c96a6f1154bc018bde47588a8d02b8567b7f
Instruction Fuzzy Hash: F721C371409384AFD722CF51CC44FA6BFB8EF56214F08C89AE9489B152C374E508C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 05230572 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 052305DE

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: d8d148c4d918ed0a55de29ddd2fc0593914cb3a5071152dd230db555b2550771
Instruction ID: d829b030006f679546ed256d0738da6f23c589b516bdd1c085380edeebbeacbc
Opcode Fuzzy Hash: d8d148c4d918ed0a55de29ddd2fc0593914cb3a5071152dd230db555b2550771
Instruction Fuzzy Hash: 7421F0B1500200AFEB21DF65DC45FA6FBE8EF19324F04886EE9498B652D375E409CB72

Uniqueness

Uniqueness Score: -1.00%

Function 05230BC6 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 05230C3A

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: e092a02ce6b45604e17ff2aadfa72b3395ed872c158f972f1da52602995566dc
Instruction ID: 40709918073395dcfe9cda6d516e13fab3f65efb92e79e37e746ab4287f36cd5
Opcode Fuzzy Hash: e092a02ce6b45604e17ff2aadfa72b3395ed872c158f972f1da52602995566dc
Instruction Fuzzy Hash: FD21C0B2500204AFE721DF15CD49FA6FBE8EF29324F048859E9498B651D375F509CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 052313CE Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 0523144A

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 21b1f0be33109d44914a4696f0c6096841ef477749552df4590d26c614231ba1
Instruction ID: 5033959381d65bb0fd18d90cd6bf8f982a0e4cdc5701bddc6d4ddc2a0bd37b09
Opcode Fuzzy Hash: 21b1f0be33109d44914a4696f0c6096841ef477749552df4590d26c614231ba1
Instruction Fuzzy Hash: A0215075508384AFDB228F55DC44B62BFF4EF06210F08899AE9898B563D375A418DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0100B4F6 Relevance: 1.6, APIs: 1, Instructions: 66windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 0100B571

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 17c0f10f14b1579533d87d1a69d14be4b0b7c1fbc422a0cbd70d78bf31c25f43
Instruction ID: a7e663cdf551e9a2cb7393821fdf21dc4063580b8a9d30cb203fb365edf8b6a5
Opcode Fuzzy Hash: 17c0f10f14b1579533d87d1a69d14be4b0b7c1fbc422a0cbd70d78bf31c25f43
Instruction Fuzzy Hash: EA219D76500200AFEB22DF51DC41FA6FBA8EF14714F14889AEE859A692D375E5088BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0523168A Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 05231713

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 15016df024da56804d0f63c163a84e1bcb37875896f9f2bfa703aef80b7a2fdc
Instruction ID: 0b3417595dc8d76caa6ffc355ae939aafc55ac92e56c44d5275fa7c9c1a68413
Opcode Fuzzy Hash: 15016df024da56804d0f63c163a84e1bcb37875896f9f2bfa703aef80b7a2fdc
Instruction Fuzzy Hash: 3111D371505340AFE721CB11DC85FA6FFB8EF46720F08849AF9489B692D364A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0100B40E Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0100B480

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4df865826ae13a7467ba22bddc9281f48a0829de337fd3dba9d1b119e82e7c23
Instruction ID: 533a574d0b502a0dd532134de6ecd04bb843441b98554b712e530cee5ca2ee0e
Opcode Fuzzy Hash: 4df865826ae13a7467ba22bddc9281f48a0829de337fd3dba9d1b119e82e7c23
Instruction Fuzzy Hash: DC118176500604AFE722CE15DC44FABFBECEF14614F04C45AEE859B692D774E5088A71

Uniqueness

Uniqueness Score: -1.00%

Function 0523092A Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0523099C

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 711df9cfcaa9bb980acd1ef5fea4a94f72f5acec0e74a654df875b20a5a8524a
Instruction ID: 004a37c54fba45dfd82f260ed710006c9ec3d1b82f4804e6d72304a29000542c
Opcode Fuzzy Hash: 711df9cfcaa9bb980acd1ef5fea4a94f72f5acec0e74a654df875b20a5a8524a
Instruction Fuzzy Hash: 7311B1B2510200AFE721CF11CC85FA7F7ECEF14A10F08C85AE9458B652E364E408CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0100AB7C Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0100ABF0

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 24dddb20b583749ee2a0687b6ef0246917e7533fcbbb28703b1ca218025d368d
Instruction ID: f8190a68921cceddf66279fa9041fa5748359da3b02492a0e3d1a7e96f2c7d1a
Opcode Fuzzy Hash: 24dddb20b583749ee2a0687b6ef0246917e7533fcbbb28703b1ca218025d368d
Instruction Fuzzy Hash: 7721C3759097849FD712CB29EC55792BFA8EF02320F0984DBEC858B593D234A908C761

Uniqueness

Uniqueness Score: -1.00%

Function 05231132 Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 05231191

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: c9e7ca2fc45e1ba6fefe613cd6ab522598dbe4c2d70ab849be8e085aea0b5d96
Instruction ID: ff0548f4ed54bfa579f487e3c38c931fc665f784431e5dca12009e3c1a15cd0a
Opcode Fuzzy Hash: c9e7ca2fc45e1ba6fefe613cd6ab522598dbe4c2d70ab849be8e085aea0b5d96
Instruction Fuzzy Hash: 7E119072500204AFEB21CF55DC45FAABBA8EF15724F04C86AED458B651D375E418CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0100A61E Relevance: 1.6, APIs: 1, Instructions: 63comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 0100A690

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 20f1477e834abe40b78ad33cdb01c54feed8252e9328c18e330119d5c99af864
Instruction ID: e20197d3736b843ea8d0bd5271f33f1fb999ef51489d0b41cb5a1ed74c1163c7
Opcode Fuzzy Hash: 20f1477e834abe40b78ad33cdb01c54feed8252e9328c18e330119d5c99af864
Instruction Fuzzy Hash: 042158719093C09FDB52CB25DC94752BFB4EF47220F0984DAED849F1A3D2659908CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 05232726 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0523277F

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 8b4012e87117ba50a51772964b3d37469a7b2638e0e291e00325687a27027f45
Instruction ID: 279532bd15bcf61b304e35965691491f33205fb6c7fc5f2116b8f169c168a884
Opcode Fuzzy Hash: 8b4012e87117ba50a51772964b3d37469a7b2638e0e291e00325687a27027f45
Instruction Fuzzy Hash: 1111C1B5500200AFEB21CF25DC45FAABBA8EF15724F08C86AED09CB641D374E4088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0523280A Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 05232863

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 8b4012e87117ba50a51772964b3d37469a7b2638e0e291e00325687a27027f45
Instruction ID: 58dad7d194cff7a6a96ab5c9e69c916c5cbcf5adbdd8ed11bd6f7124cd0dde09
Opcode Fuzzy Hash: 8b4012e87117ba50a51772964b3d37469a7b2638e0e291e00325687a27027f45
Instruction Fuzzy Hash: 6411C1B5500200AFEB21CF15DC45FAABBACEF65324F18C86AED09DB641D774E5088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0100A573 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0100A5DE

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ae854cf0509626cbe5194f98d3e63a2016e01b760ced8e5e0e037b461e6744d9
Instruction ID: 458fd0ffe54b8fcdff8d3fac883071e060c7cdb4d7a7a82af4cf86999bfc8f13
Opcode Fuzzy Hash: ae854cf0509626cbe5194f98d3e63a2016e01b760ced8e5e0e037b461e6744d9
Instruction Fuzzy Hash: 05117F71509380AFDB228F55DC44A62FFF8EF4A310F0888DAED858B563C275A418DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0523264A Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 052326A0

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 75f16521d27fd8acb3543032d8cea8e974ccc710513f8ff60710c80f57c4096d
Instruction ID: 9f7c2d342bb99cc73c924dfe10d77dd712ed8aec383970bb3ae920c9b5a2dd68
Opcode Fuzzy Hash: 75f16521d27fd8acb3543032d8cea8e974ccc710513f8ff60710c80f57c4096d
Instruction Fuzzy Hash: 1511E3B5500200AFEB20CB15DC45BAABBECEF15624F04C46AED05CB641D774E9088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0100AEAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0100AF0D

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7a8e5115764533e03852c01e660b2dc533a1531b0ee05312eddc63fcd38ab3ac
Instruction ID: a2f4d74e4418f0c0b32c683e86ce07152021d1d7a2b6e0cf7ba48048408749ef
Opcode Fuzzy Hash: 7a8e5115764533e03852c01e660b2dc533a1531b0ee05312eddc63fcd38ab3ac
Instruction Fuzzy Hash: BB119071500200AFEB22CF55DC44FAABBE8EF14714F04C89AEA459B692C375E4088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0523219E Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 052321F7

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 7dcd88bb966b5bcfc7389fc2cd5ce315118f11e7825b6132d7191bdbe3a5514c
Instruction ID: 8465d4c62f8210db6fa88c92173ea470ee17ddc45ef39f7663085cfa09fc8a16
Opcode Fuzzy Hash: 7dcd88bb966b5bcfc7389fc2cd5ce315118f11e7825b6132d7191bdbe3a5514c
Instruction Fuzzy Hash: 4A11E775900200AFE721CF51CC45FAAFBA8EF14714F04C45AEE058B641C374E5098BB1

Uniqueness

Uniqueness Score: -1.00%

Function 05230E6A Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 05230EC0

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 642ae0fb2641e6fe017605e011e604d12cff934f5ca36ff9c25286e23a89d2d7
Instruction ID: b78d59f9ba75212db3fcbdb30fba405e3e8cfb18e20630fb7b899422a42ad8f1
Opcode Fuzzy Hash: 642ae0fb2641e6fe017605e011e604d12cff934f5ca36ff9c25286e23a89d2d7
Instruction Fuzzy Hash: 991102B1504200AFEB20CF15CC89FAABBE8EF14724F08C85AED089B641D374E5088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 052316AA Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 05231713

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5b2bef62e6048948ecd4a3341c5f058cfdd537374bb69ae5a1c8b5151fc4c286
Instruction ID: 2ae8f61b7938f7ae3e8bfc68c2054cca69137e41cbe803072705673874dc77d1
Opcode Fuzzy Hash: 5b2bef62e6048948ecd4a3341c5f058cfdd537374bb69ae5a1c8b5151fc4c286
Instruction Fuzzy Hash: 0211E571510200AFE720DB11DC86FB6FBA8DF15724F18C459ED089B781D3B4E549CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0523227A Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 052322D0

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 3e4e2bdb94159474e0bc1e3aaf0caf99be40e8cf2ad001fa03b74792fc2a0fb8
Instruction ID: 1d2b82257d9586c1f909dbabf9ff511f160808b63d283d90d68da6586d92e065
Opcode Fuzzy Hash: 3e4e2bdb94159474e0bc1e3aaf0caf99be40e8cf2ad001fa03b74792fc2a0fb8
Instruction Fuzzy Hash: 861128B9A14205DFDB20CF65D885F66FBE8EF14610F0888AADD4ACB652D374E448CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0100AC6A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,57FC754B,00000000,00000000,00000000,00000000), ref: 0100ACBD

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ed7bddd0650d85a225ace4093563bf81c800bde59be56230cb99470837797d41
Instruction ID: ba26864fd7ea9a02a70205279e57f75c270d5b020c16e2f1316a7e09cf23106f
Opcode Fuzzy Hash: ed7bddd0650d85a225ace4093563bf81c800bde59be56230cb99470837797d41
Instruction Fuzzy Hash: 8B01C471504304AFE721CB05DC85FAAB7D8DF65624F08C496ED449B782D374E5088AB1

Uniqueness

Uniqueness Score: -1.00%

Function 052313FE Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 0523144A

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 3508787bdf1c47264261378377a9f77e37ea071d1249c208598ed8c447c6693a
Instruction ID: 7e96a9074940d2fe3ae8836cab521d97e212e7838a88061b95246e4ca706983a
Opcode Fuzzy Hash: 3508787bdf1c47264261378377a9f77e37ea071d1249c208598ed8c447c6693a
Instruction Fuzzy Hash: 76118E715142459FDB20CF55D845B62FBE5FF08320F08C8AAEE498B622D375E428CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0100A59A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0100A5DE

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b1bff02d631cf31be66d82a3acaf70c65a1dff3d72e159c4eb149118f1213d05
Instruction ID: f2848cc3578bfac8e063944fc8491cbffbab18e265428437b9a3c6adeb7dca3a
Opcode Fuzzy Hash: b1bff02d631cf31be66d82a3acaf70c65a1dff3d72e159c4eb149118f1213d05
Instruction Fuzzy Hash: F2013C71904700DFDB618F55D844B56FFE4EF48210F08889ADE894B652C376E414DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0100A72E Relevance: 1.5, APIs: 1, Instructions: 43comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0100A77E

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 06f06e1cda283f62801e5af27db0bba103db73489ddc67e78249845218a50022
Instruction ID: 0bebad0c4971fad50bd52e3a0fc16af7412ea2c965a47f05199879009a340136
Opcode Fuzzy Hash: 06f06e1cda283f62801e5af27db0bba103db73489ddc67e78249845218a50022
Instruction Fuzzy Hash: 77016271600600ABD310DF16DC46B66FBE8FB88A20F148159ED089BB41D775F916CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0100ABBE Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0100ABF0

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 53a03c2581a83936f81318f12d2aa8b33dce4682df6e7a19a459a4202b9d7d80
Instruction ID: 685f1525b3b2ff1c1207ecf08d05ccd0d7a03ca5457c5d6a6837e2dffdac62b6
Opcode Fuzzy Hash: 53a03c2581a83936f81318f12d2aa8b33dce4682df6e7a19a459a4202b9d7d80
Instruction Fuzzy Hash: C5018471A04344CFEB51CF15D885B66FBD4DF05224F08C8AADD498B692D275E404CA61

Uniqueness

Uniqueness Score: -1.00%

Function 052304D6 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 05230526

Memory Dump Source

Source File: 00000000.00000002.4488255696.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5230000_En3e396wX1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4298b930d39b26da9ae1f3745affdc0a22833d9ff236687ff5c45024d2bc5f59
Instruction ID: ce77b5f25cbfe006b483d9548056b998057f6c4d88aa94e5984696bec46bfcfb
Opcode Fuzzy Hash: 4298b930d39b26da9ae1f3745affdc0a22833d9ff236687ff5c45024d2bc5f59
Instruction Fuzzy Hash: 52016271600600ABD310DF16DC46B66FBE8FB88A20F14815AED089BB41D771F916CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0100A186 Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 0100A1C1

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 45ee194b6e235c5ee5a42b4057643f0253eefe86f97126c4607dd6038f63f831
Instruction ID: edea64c5a1a9366152ae5297dda3d4683065446b70a0fca43533ad18252b94f0
Opcode Fuzzy Hash: 45ee194b6e235c5ee5a42b4057643f0253eefe86f97126c4607dd6038f63f831
Instruction Fuzzy Hash: 0E019E31904340DFEB61CF55D844BA6FBE4EF15320F08C8AADD898B652C375E408CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0100A65E Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 0100A690

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: fe195d4a9de8f8eaf84810778733f527afa96040f25a15feb993e7db4973d43b
Instruction ID: f14995ac34ee22ac2d0f6d7314266e7032ce3fba8109876b81ee72ad643dcadc
Opcode Fuzzy Hash: fe195d4a9de8f8eaf84810778733f527afa96040f25a15feb993e7db4973d43b
Instruction Fuzzy Hash: B901A271A04340CFEB51CF55D884766FBE4DF55224F08C8AADD898F652D379E404CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 0100AA12 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0100AA44

Memory Dump Source

Source File: 00000000.00000002.4484471353.000000000100A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100a000_En3e396wX1.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e16b70dc1e745837768e6e89dc4ddc427ae1e631a8a3dc2519004e596bc53df5
Instruction ID: 285963c6ed9dad47a9a284e0965c4e406a1de669e4b9793ce634348c76f60002
Opcode Fuzzy Hash: e16b70dc1e745837768e6e89dc4ddc427ae1e631a8a3dc2519004e596bc53df5
Instruction Fuzzy Hash: 53F0FF35A00340CFEB21CF05D984B65FBE4EF06224F08C49ADD884B792C378E548CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 050C75C9 Relevance: 1.2, Instructions: 1242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4395adf5fd8ecffc10742f84967d6e17573cdb965c38b99fc564cc802822d1d
Instruction ID: 9705e4279bab5dc8ac15f879abf60f0c9db2e8b0a4ad8ef711153b9370ebe175
Opcode Fuzzy Hash: f4395adf5fd8ecffc10742f84967d6e17573cdb965c38b99fc564cc802822d1d
Instruction Fuzzy Hash: 7DB2AC34B10264CFDB119B26E8117BD7BF2FB99304F1082AA984597789CB7ACD46DF60

Uniqueness

Uniqueness Score: -1.00%

Function 050C7644 Relevance: 1.1, Instructions: 1079COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668c6481851f1f3a795477fddd0a95cf220edf5f18c7cf71e1705fa5bb2973d1
Instruction ID: 98b0d75d538901b3a4113f0c9bc3279096612da1383d4eb6584ac1bb5c429963
Opcode Fuzzy Hash: 668c6481851f1f3a795477fddd0a95cf220edf5f18c7cf71e1705fa5bb2973d1
Instruction Fuzzy Hash: E792F5307101608BDF159B26E8117BD3BF7BBA9304F1485AE9446A3789CB7ACD4ADF60

Uniqueness

Uniqueness Score: -1.00%

Function 050C767E Relevance: 1.1, Instructions: 1076COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8253dc3c2c097357432d1e4c1b8886b20f48fc898b7df5e65f2e1250765439be
Instruction ID: 79de8672eb7982a563104608f8c482c8cdac6ae841dd18b26863299f3a76d59a
Opcode Fuzzy Hash: 8253dc3c2c097357432d1e4c1b8886b20f48fc898b7df5e65f2e1250765439be
Instruction Fuzzy Hash: 0292F6307101608BDF159B26E8117BD3BF7BBA9304F1445AE9446A3789CB7ACD4ADF50

Uniqueness

Uniqueness Score: -1.00%

Function 050C76AD Relevance: 1.1, Instructions: 1075COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbc005487a6c1332de7299fbcf31b1fd3998dc96fb5b722862a10fee4029283
Instruction ID: 8d3c0af93607e12b240c5e74a0dd547281f6fb3c5218bb9feea159b6c9235a5c
Opcode Fuzzy Hash: 7cbc005487a6c1332de7299fbcf31b1fd3998dc96fb5b722862a10fee4029283
Instruction Fuzzy Hash: 3892F6307102608BDF159B26E8117BD3BF7BBA9304F1445AE9446A3789CB7ACD4ADF50

Uniqueness

Uniqueness Score: -1.00%

Function 050C3802 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9650c8ff796737ec4a1c260fcff94e6bb744846ad271f04baad98249abb740f3
Instruction ID: 85d96082000f5ff8c4258a19aa69a57111ac21d004872cc28fb09ee28980aa66
Opcode Fuzzy Hash: 9650c8ff796737ec4a1c260fcff94e6bb744846ad271f04baad98249abb740f3
Instruction Fuzzy Hash: 0F323830A102688FDB14EF75D855BEDB7B2BF89308F1045A9D509AB3A9DB399D81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C8BF0 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692723e6b96986559b0c13f0ce3729f6fd34aa7d4faa8058727a625dc929213e
Instruction ID: bcbe6fb89697289f0e28702fc1ced276fd523d2e03e3ae942a654e0e85becf10
Opcode Fuzzy Hash: 692723e6b96986559b0c13f0ce3729f6fd34aa7d4faa8058727a625dc929213e
Instruction Fuzzy Hash: 06D14C31A10215DFDB09EFB6F45159D77B2BF89344B108939E812A73A9DF39AC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 050C7190 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff31ec927ddcf01adbc4e5f717a986b4ab886d610b3c5b01c4fde518dad3b006
Instruction ID: 84572c17345bbbb13ebfd1e5f0114204439e7f61046ea8399d105e6a17ca4821
Opcode Fuzzy Hash: ff31ec927ddcf01adbc4e5f717a986b4ab886d610b3c5b01c4fde518dad3b006
Instruction Fuzzy Hash: 74A1D1306042118BDB25EB35E845BAD3AE2FF86314F1446BCE812AB3D5DB35DC06CB50

Uniqueness

Uniqueness Score: -1.00%

Function 050C8BDF Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7dfb22a74f625cdc158bc4352b1ed9e4692cc3a2b404890d30e5641f468af2
Instruction ID: 3efc784829659953e0e80994c44640c692c6d1183518aa2d31fd48c9eec09365
Opcode Fuzzy Hash: 5d7dfb22a74f625cdc158bc4352b1ed9e4692cc3a2b404890d30e5641f468af2
Instruction Fuzzy Hash: 25A14A31A10215DFCB09EB76F45166D77B2BF89348B508639E816A73A9DF39AC02CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C8CF5 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f071b2ed50f3f14d1dd969d1dfacf692b4ea39867d17c3c73c892bb6a25d8d0d
Instruction ID: 217135cf175851f7ccd3e7746ae1937026404b1211deb8c457e3b27caeb14ab4
Opcode Fuzzy Hash: f071b2ed50f3f14d1dd969d1dfacf692b4ea39867d17c3c73c892bb6a25d8d0d
Instruction Fuzzy Hash: E5912B31A10215DFDB09EBB6E45166D77B2BF89348B108579E812A73A9DF39A812CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C8D53 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bcf659fcefd9d5dc964e53d727d86e7af4245bf823996033517d7ebb0e066f
Instruction ID: 3335d08e46a86b4f0d7f26bcba326d77738570edcbb16ef97b2f0dfb2407ad87
Opcode Fuzzy Hash: 55bcf659fcefd9d5dc964e53d727d86e7af4245bf823996033517d7ebb0e066f
Instruction Fuzzy Hash: 67913D30A10215DFDB0AEB76E45165D77B2BF89348B508579E811A73A9DF39AC12CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C8DA3 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d3beb681836dc088cd23b73565346d66c9af4d42bbbd1a03c3f04331b212c4
Instruction ID: aecfc962320dd905d4a52d77ef198f5c16e76ccb741259e6c302f10808e9cce9
Opcode Fuzzy Hash: 14d3beb681836dc088cd23b73565346d66c9af4d42bbbd1a03c3f04331b212c4
Instruction Fuzzy Hash: BF814D30B10215DFDB0AEB76E45166D77B2BF89308B508679E811A73A9DF39AC12CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C8E25 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a257d1c8f7154269cad79ad5da91d6742a696c7d64324a51f481f70ae4acaade
Instruction ID: 29332ea6485aa7a136be18e8d8d2a304dea660da093b88bd1b38e9dd6c82b38c
Opcode Fuzzy Hash: a257d1c8f7154269cad79ad5da91d6742a696c7d64324a51f481f70ae4acaade
Instruction Fuzzy Hash: 9C714E30B10214DFDB0AAB76E45166D77B2BF89318B50867AE811973A9DF39EC12CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C3DCC Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113db835f9838f9789bd0f8c1afd47e16bc4b0567c33b4ebe9ce6c712ad9a1f2
Instruction ID: f06d385d2db0c67f8f424c06f79b689bdd88ddf2ed8bea2ae42c4069f194d648
Opcode Fuzzy Hash: 113db835f9838f9789bd0f8c1afd47e16bc4b0567c33b4ebe9ce6c712ad9a1f2
Instruction Fuzzy Hash: ACA1F534A10228CFDB25EF75D955AECB7B2FB49304F1046A9D809A7369DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C39BF Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5137309b57ac27fdd45599db24fe9178a57e3798b75c05f8538d186857a4514c
Instruction ID: cb971170bd1382a593f2036297c7dff047cbab5b9b41ecfd0881d0f7081237d1
Opcode Fuzzy Hash: 5137309b57ac27fdd45599db24fe9178a57e3798b75c05f8538d186857a4514c
Instruction Fuzzy Hash: E0819F30A00268CFDB14EFB4D851BEDB7B2BF85308F0085A9D509AB2A9DB799D45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 050C717B Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bf9491117cc7638d05f0eae0fa1094f73285a34208c3a4561dbd621b7d8b67
Instruction ID: e2cf3f55e3f6dc7b6743f027a26ef6ffe357ed476f245ec032a91ce44906cdb1
Opcode Fuzzy Hash: e0bf9491117cc7638d05f0eae0fa1094f73285a34208c3a4561dbd621b7d8b67
Instruction Fuzzy Hash: E651E4306043518BDB25DB36A8047AD3BE2FB46314F5882ADE452EB2D6DB39D946CB60

Uniqueness

Uniqueness Score: -1.00%

Function 050C8F15 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32e75ba814b1bb9c94a6bcc3b4a2fec81938d35d12bfabac4e6e0aa59ab8fafa
Instruction ID: f5d50dcedb9f40ddb4a6acae1e54061a3dfaa3bc10a8d66313a78435ef71b683
Opcode Fuzzy Hash: 32e75ba814b1bb9c94a6bcc3b4a2fec81938d35d12bfabac4e6e0aa59ab8fafa
Instruction Fuzzy Hash: D351A330B102159FDB19EB76F45166D77A2BF98358F108939E815A73A9DF39EC02CB40

Uniqueness

Uniqueness Score: -1.00%

Function 050C756E Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ce90357e94927c287466567175847a108ba8074ada2ab44bc0caaf0ef93587
Instruction ID: 68d00401080a38563d5f52aa9ba97c32b0e2fdc0883bd32fb61c5a8fa1116c5d
Opcode Fuzzy Hash: a7ce90357e94927c287466567175847a108ba8074ada2ab44bc0caaf0ef93587
Instruction Fuzzy Hash: EA41C5306042118BEB25DF36A8017AD3AE2FF46354F5886ADE452EB2D5DF39D906CF50

Uniqueness

Uniqueness Score: -1.00%

Function 050C3B18 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ff4d8c6766d8287a31e3d2e15646cc69feff1a94b93df0f712bb21058254ed
Instruction ID: 3b4c708788eac92918df695be68450ada7406e92171d2df8a426011c27b51019
Opcode Fuzzy Hash: 53ff4d8c6766d8287a31e3d2e15646cc69feff1a94b93df0f712bb21058254ed
Instruction Fuzzy Hash: 72417A30A002688FDB14EFB5D955BECB7F2BF49308F0045AAD009AB2A5DB799E44CF51

Uniqueness

Uniqueness Score: -1.00%

Function 050C0958 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8698732feee1f0841c1c682677e5ff97f24e07508f275ac87deb36e7290be3d
Instruction ID: ee288a9f4acf3fbfba0f05b56f5d2e5fabdc3e12d0eae57a803e8efdfeda7563
Opcode Fuzzy Hash: b8698732feee1f0841c1c682677e5ff97f24e07508f275ac87deb36e7290be3d
Instruction Fuzzy Hash: 1331D3317112118FDB04BB76D8267BE36A6EB98208F1144399405D77A9EF79CC16CB91

Uniqueness

Uniqueness Score: -1.00%

Function 050C94F0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a1cb60e36bca081aaacfe94a3f1647be50d94cce7ca66176546582d8d6f45c
Instruction ID: 5034bb83061a53f307b48e3272b59d688f0d3df19c08ba7a1733d3a3688a234f
Opcode Fuzzy Hash: 17a1cb60e36bca081aaacfe94a3f1647be50d94cce7ca66176546582d8d6f45c
Instruction Fuzzy Hash: 7131DC30B002059FDB04DB75E854BAEBBE6BF8A314F1485B9E405EB3A1DF70A8058B90

Uniqueness

Uniqueness Score: -1.00%

Function 050C00B8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb03a19ecd8471b8e6ebfa58b1eb7712395c8491d6aec91861a5a8aabf3c3e0d
Instruction ID: bd42a4da46ec0afa50bc28db4a219aef41ac26309dd8ccbc6bb47243406cd5d7
Opcode Fuzzy Hash: fb03a19ecd8471b8e6ebfa58b1eb7712395c8491d6aec91861a5a8aabf3c3e0d
Instruction Fuzzy Hash: C43138327043509FD706E77598117AE3BA7AF93218F1484AAD041CF296DF7E9C068391

Uniqueness

Uniqueness Score: -1.00%

Function 050C0118 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b607acf49705d6b89aca45287bf458b0c98f23ae6be3580265d64a34e457ba0
Instruction ID: 501c9071195da406a2773647187e757e6bad9f5a8db2381ba54b12cb8b26e8f6
Opcode Fuzzy Hash: 8b607acf49705d6b89aca45287bf458b0c98f23ae6be3580265d64a34e457ba0
Instruction Fuzzy Hash: 5A11E9327003518FD706E77AA4517AD379BABE72187544869D041CF366CF6EDC0687A2

Uniqueness

Uniqueness Score: -1.00%

Function 058D1F4C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488794732.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec51142f1f857550a4fbdd2681d4c34769067744c1b63a395ef598de0a9c3343
Instruction ID: c3c0853a40411a70a8ef89b24e8d56a007ed81354cb11299c1af189a05eea1a5
Opcode Fuzzy Hash: ec51142f1f857550a4fbdd2681d4c34769067744c1b63a395ef598de0a9c3343
Instruction Fuzzy Hash: 1811BAB5908341AFD340CF19D840A5BFBE4FB98664F048D5EF998D7311D235E9148FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EB0814 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4484372135.0000000000EB0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e58c7b66eb9c7e50c96d4a63bc5e73c2d407a6c615ecbd2807e875577f53f3b
Instruction ID: f1d47c4a1b4c7d19fae12a39a6af693ef3d2ffc042030a1224837e914cc235bc
Opcode Fuzzy Hash: 0e58c7b66eb9c7e50c96d4a63bc5e73c2d407a6c615ecbd2807e875577f53f3b
Instruction Fuzzy Hash: 5011E4306042809FC719CB10D540FA7B7A5AB9970CF24C9ACE4492BB43C77BE952CA81

Uniqueness

Uniqueness Score: -1.00%

Function 050C0006 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d26bf89df4fca765c3a6c719ae09cc3a8ae52fcf58508feff9c2a22813475a
Instruction ID: ef1d7414323c1151e4246e0e20c9c83c198a71d616f6434b74864c5bb76328a0
Opcode Fuzzy Hash: 86d26bf89df4fca765c3a6c719ae09cc3a8ae52fcf58508feff9c2a22813475a
Instruction Fuzzy Hash: 88117E7144E3C18FCB039BB498686803FB0AF67218B0B55D7C080CF1A7D6AC591AEB62

Uniqueness

Uniqueness Score: -1.00%

Function 050C9210 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef4f0e6b8f1c059aea10ed6183fdfe9a54184ca4509835777016dae5aa2177e
Instruction ID: c7f5b8e2bbef57547d8a878fce8a6e320801c161ae21fa9e6c264e8d02491551
Opcode Fuzzy Hash: 4ef4f0e6b8f1c059aea10ed6183fdfe9a54184ca4509835777016dae5aa2177e
Instruction Fuzzy Hash: EC110231F002198FCF84EBB898001ADB7F6EF89388B100179C805E7365EB319D46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EB07DE Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4484372135.0000000000EB0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f8a642eef8f5e4d665e3b9add3d579c06d3efd286faed72ee6f7b993c24e0e
Instruction ID: 78612ff5e2566f5f2c83f2dabd54af51b418460ecdf21d10a1cb600ca24e7f51
Opcode Fuzzy Hash: 14f8a642eef8f5e4d665e3b9add3d579c06d3efd286faed72ee6f7b993c24e0e
Instruction Fuzzy Hash: 59219F315093C08FC707CB24D950B52BFB1AF4B318F1986DAD4885BAA3C73A9906CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0101B0B4 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4484518849.000000000101A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_101a000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d926ad7d3387aa583c9cfffcc5acd1c445e683c60d5a33ca386e276b1eb6a5fa
Instruction ID: db1394d7fcab9d26fc722a4e485e030e75ffcce9b34025d1a1c6ce12289117e5
Opcode Fuzzy Hash: d926ad7d3387aa583c9cfffcc5acd1c445e683c60d5a33ca386e276b1eb6a5fa
Instruction Fuzzy Hash: D911A8B5908301AFD350CF09D841A5BFBE8EB98660F048D1EF95997311D275E9088BA2

Uniqueness

Uniqueness Score: -1.00%

Function 058D1DF0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488794732.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ef9d858df6c18d7185988e09e92d247a1394f0712f01299733961244478523
Instruction ID: f31a9d1c5caaf3a0d4163e99e7464adf657cd478d77afefe0df0f0b4c1139892
Opcode Fuzzy Hash: f1ef9d858df6c18d7185988e09e92d247a1394f0712f01299733961244478523
Instruction Fuzzy Hash: 4811BAB5908301AFD750CF09DC81E5BFBE8EB98660F048D1EF95997311D275E9088FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EB05E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4484372135.0000000000EB0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0425f10f2736490670b6a841b463077e53293098e5f427c182dcde8d5ba7d5d7
Instruction ID: 4801dbb71e9f2eec15099d93f5992f3aa351e22fc730dd745851b22bf38ef4ac
Opcode Fuzzy Hash: 0425f10f2736490670b6a841b463077e53293098e5f427c182dcde8d5ba7d5d7
Instruction Fuzzy Hash: B201F9B65093806FD701CF069C40863FFECDF86620B08C4AFFD498B652D225A808CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 050C0878 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c42647d010d1f3082ef24c2550e9dfeda6cf22db998a941b5fdc254dce0d643
Instruction ID: ab9f32e283cea897305396ed22aae745667f8cb549d7fd6915a3532ca77d10cf
Opcode Fuzzy Hash: 3c42647d010d1f3082ef24c2550e9dfeda6cf22db998a941b5fdc254dce0d643
Instruction Fuzzy Hash: 400139346163828FD701FB74D55849D7BE1EFD5208B00882CE4C5CB35AEB788815CB42

Uniqueness

Uniqueness Score: -1.00%

Function 050C00A8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c9237dc5d9a1d5c0eee3eb36f42859c1d6a8dfc5acabf93915b7678e8ca3abb
Instruction ID: cfa432145d8adf73bb3eaaf7f160517d2a8a0bc368917b9fcf4f4d6ffb94b847
Opcode Fuzzy Hash: 0c9237dc5d9a1d5c0eee3eb36f42859c1d6a8dfc5acabf93915b7678e8ca3abb
Instruction Fuzzy Hash: 1FF0FC31A40304AFEB04DB70C8127EE7BB2EF82714F1085BED545DB1D5DA354942CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00EB08D0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4484372135.0000000000EB0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b458bdb37eee74dda7414f63ab3821ab480e09a946024a3a034b09db3e5cf66
Instruction ID: 01b87e6718582f0b0a03999500d6e033509ae10870c6d5c09603f56039f1bb67
Opcode Fuzzy Hash: 5b458bdb37eee74dda7414f63ab3821ab480e09a946024a3a034b09db3e5cf66
Instruction Fuzzy Hash: 96F01D35104644DFC715CF04D580B56FBA2EB89718F24CAADE94917B52C737E913DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00EB0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4484372135.0000000000EB0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c63db333d1b49a44a7f82e522e525e19a6d6175679ac1e03d23373753d6fb50
Instruction ID: 6c782b781885c4551402b9c3078abb81056c0c990c52c3929bb0f3230cb22ceb
Opcode Fuzzy Hash: 8c63db333d1b49a44a7f82e522e525e19a6d6175679ac1e03d23373753d6fb50
Instruction Fuzzy Hash: B9E092B6A046008BD750CF0BEC41462F7D8EF88630708C47FDC0D8B711D235B508CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 0101B103 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4484518849.000000000101A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_101a000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca679b85f092445d297455603c44cd7609105b2c9d8b3786e4f821255ada9e1
Instruction ID: f6dbc8292ba19374db6653026de61de0b4fdf57b055951d25f10d3d9be0936ca
Opcode Fuzzy Hash: eca679b85f092445d297455603c44cd7609105b2c9d8b3786e4f821255ada9e1
Instruction Fuzzy Hash: 58E0DFB29402046BD210CF06AC46F62FB9CDB50A30F08C96BEE08AB712E172B504CAF1

Uniqueness

Uniqueness Score: -1.00%

Function 058D1FB7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488794732.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86adfcd03e4613793e751b87ecb31ce8ff955259cf7d0d80bf03d8d674041a8
Instruction ID: d7c886a38029d70b5af4a3ba1d2637672bb7d3a2d001392262d78ad441284039
Opcode Fuzzy Hash: a86adfcd03e4613793e751b87ecb31ce8ff955259cf7d0d80bf03d8d674041a8
Instruction Fuzzy Hash: 79E0DFB29403006BD310CF06AC46F62FB9CDB94A30F08C86BFD085B742E172B5188AF1

Uniqueness

Uniqueness Score: -1.00%

Function 058D1E3F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488794732.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6bae1006726f300917c856e608b74f81ec313e69eaf5df5c1ea0854f6678d39
Instruction ID: b2c5b5e22490de3cccafd62c4cff77dc9f3673d22bc30db06a4b371bea7ab7c2
Opcode Fuzzy Hash: b6bae1006726f300917c856e608b74f81ec313e69eaf5df5c1ea0854f6678d39
Instruction Fuzzy Hash: BEE0DFB29003046BD250DF06AC86F63FB9CDB50A30F08C96BFE085B712E172B5048AF1

Uniqueness

Uniqueness Score: -1.00%

Function 058D1863 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488794732.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c02321a2863e1edf1d80b269f5fb10bd0903ab8b9fca3def52d7bb6546d0156
Instruction ID: da98278eefb4408df892ffffeb06b83ae64a05705cea61aea918d841fe4379e8
Opcode Fuzzy Hash: 4c02321a2863e1edf1d80b269f5fb10bd0903ab8b9fca3def52d7bb6546d0156
Instruction Fuzzy Hash: 1EE0D8B290020067D210DF069C46F63FB9CDB50930F08C857FD085B712D172B514C9F1

Uniqueness

Uniqueness Score: -1.00%

Function 050C4200 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 632a482aac1680524d024f022a09a948393e938808ddeb7b3f11c07bd120d8d4
Instruction ID: 079d6ee02ffd030645d0e9fe89dbe9be9b7008f4796b623f6e3fe2093b12b946
Opcode Fuzzy Hash: 632a482aac1680524d024f022a09a948393e938808ddeb7b3f11c07bd120d8d4
Instruction Fuzzy Hash: 23E0CD7191A348DFC705DF78CD118987BB4DB16318B0100EBD444C7261FA365E05CB53

Uniqueness

Uniqueness Score: -1.00%

Function 050C36A8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3066809665a9be945193d2f636a7b8ac006e4edece48e7db3e8de8b463ee0f4b
Instruction ID: f84b3d4c7e22177e36890ffef67bf37ea00b2bcc5954885b1fd9a5fc3cf29d1c
Opcode Fuzzy Hash: 3066809665a9be945193d2f636a7b8ac006e4edece48e7db3e8de8b463ee0f4b
Instruction Fuzzy Hash: A6E0EC71156344CFCB262B3890185983775EB567093D104FEC4958B66AEA7B9C83CB11

Uniqueness

Uniqueness Score: -1.00%

Function 050C9389 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec5604e2824bcc20dd178a5de4199f4beab53dfa3d1220b2c17c4ead8a632cc0
Instruction ID: 81014aa1777d439e6051b390d64e8589377fa7eff802c15470912dd0a50d1e4c
Opcode Fuzzy Hash: ec5604e2824bcc20dd178a5de4199f4beab53dfa3d1220b2c17c4ead8a632cc0
Instruction Fuzzy Hash: 38E0C2311083508FC3426B38D4148967BF8EF0A224B5244EAE084CB123EA328C048BE1

Uniqueness

Uniqueness Score: -1.00%

Function 050C94AF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0b5c5df195fcdb5b27c3e57a2a169e5da73c6a23f844593b5d8d8ed200a278
Instruction ID: dc87dc8064ba974081b0da2376fa1c62f76da67a9eb4514e9f1cb9574a4cdd08
Opcode Fuzzy Hash: 9a0b5c5df195fcdb5b27c3e57a2a169e5da73c6a23f844593b5d8d8ed200a278
Instruction Fuzzy Hash: 02E0127070938C9FCB529BB1D9150DC7FB49A03211B1004EED845D7162EA692E14CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010023F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4484456446.0000000001002000.00000040.00000800.00020000.00000000.sdmp, Offset: 01002000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1002000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0581e23ebaf4d906993f6ff3fcecc4e1e081f0f33c0bd88bd85d1024229788
Instruction ID: 67bc7d6b5aac60202fcaa9ff6ad5443d12257056cae1b6c88495717845a8b138
Opcode Fuzzy Hash: 7a0581e23ebaf4d906993f6ff3fcecc4e1e081f0f33c0bd88bd85d1024229788
Instruction Fuzzy Hash: EBD05E792056C14FF3179A1CC2A8B963BE4AB61714F4B44F9AC408B7A3CB69D5D1D600

Uniqueness

Uniqueness Score: -1.00%

Function 050C4210 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa997279d710a549293d22b382cda429538b5569c50984ed00e75609c768312c
Instruction ID: 7856ee3713dbc82a895368e56696e72bdf5dfe1f26de99890b7f0a473fddc9a2
Opcode Fuzzy Hash: aa997279d710a549293d22b382cda429538b5569c50984ed00e75609c768312c
Instruction Fuzzy Hash: E1D0C971A15208EF8744DFA8D91189DB7F9EB49319B1041AAA809D3750EF365E04DB81

Uniqueness

Uniqueness Score: -1.00%

Function 010023BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4484456446.0000000001002000.00000040.00000800.00020000.00000000.sdmp, Offset: 01002000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1002000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fd56ce3d2630f59f8a5630fcceebb86541f3e5b823d123f921c54b432d5ba1
Instruction ID: 5b1a5af6696390059e70470a0cf48ebe68bfc245e1f2dbbd2ba99d462c4c6ce9
Opcode Fuzzy Hash: a8fd56ce3d2630f59f8a5630fcceebb86541f3e5b823d123f921c54b432d5ba1
Instruction Fuzzy Hash: 03D05E342002814BEB16DA0CD6D9F597BD8AB50B14F0684E8AC508B7A2C7B4D8C0CA00

Uniqueness

Uniqueness Score: -1.00%

Function 050C9398 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324bd9ba8aec4fcdf2c5b4dbaaef0413ba3e70bf3f160ccef13586056dcf9e4e
Instruction ID: 8a8d55cd919ad0e085ddd06def72360fb96378ecdcef78ba2ce6399ab841d3f5
Opcode Fuzzy Hash: 324bd9ba8aec4fcdf2c5b4dbaaef0413ba3e70bf3f160ccef13586056dcf9e4e
Instruction Fuzzy Hash: 4AC08C322001148BC610AB7CE004D96B7ECEF4D124B1144BAE248C7321CE72AC0047E0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 050C499D Relevance: 2.7, Strings: 1, Instructions: 1447COMMON

Download Yara Rule

Strings

, xrefs: 050C4BC4

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5e06fbf8fadcc749bf0e908c43f53da284d6de3c8ecfb92f266a8951f5143cc0
Instruction ID: 7a3ff1b5894be63a154285de26859c9bccd042da655d22d87b4a44872b3652af
Opcode Fuzzy Hash: 5e06fbf8fadcc749bf0e908c43f53da284d6de3c8ecfb92f266a8951f5143cc0
Instruction Fuzzy Hash: 31F24B74A11228CFDB25EF35D864BADB7B1BB89304F1042EAD909673A5DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C49F9 Relevance: 2.7, Strings: 1, Instructions: 1440COMMON

Download Yara Rule

Strings

, xrefs: 050C4BC4

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 3f647cf5fd01dada271aebbdd161e16ede22b15fc708f9238b07a30cd4b36474
Instruction ID: a503cb1de6141f7539ea92dc9f701fd41b5357c7fd07f8b4716288335bc3251c
Opcode Fuzzy Hash: 3f647cf5fd01dada271aebbdd161e16ede22b15fc708f9238b07a30cd4b36474
Instruction Fuzzy Hash: F7F24B74A11228CFDB25EF35D864BADB7B1BB89304F1042EAD909673A5DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C4B5B Relevance: 2.6, Strings: 1, Instructions: 1383COMMON

Download Yara Rule

Strings

, xrefs: 050C4BC4

Memory Dump Source

Source File: 00000000.00000002.4488068949.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_En3e396wX1.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ed45c0b4785caaa3247a84865346f7b9076e802f3c5be11c306443e402cb1c83
Instruction ID: 51e86ce3214656cef336fb9790fa6075f6a201f3a6d19909f6f12f16f6682cf2
Opcode Fuzzy Hash: ed45c0b4785caaa3247a84865346f7b9076e802f3c5be11c306443e402cb1c83
Instruction Fuzzy Hash: 14E24C74A11228CFDB25EF35D864BADB7B1BB89304F1042EAD909673A5DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report En3e396wX1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\app

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
En3e396wX1.exe

Function 050C4298 Relevance: 3.2, Strings: 1, Instructions: 1950
COMMON

Function 050C4287 Relevance: 3.0, Strings: 1, Instructions: 1752
COMMON

Function 050C44F1 Relevance: 2.9, Strings: 1, Instructions: 1624
COMMON

Function 050C4544 Relevance: 2.9, Strings: 1, Instructions: 1618
COMMON

Function 050C4630 Relevance: 2.8, Strings: 1, Instructions: 1579
COMMON

Function 050C470F Relevance: 2.8, Strings: 1, Instructions: 1544
COMMON

Function 050C47D4 Relevance: 2.8, Strings: 1, Instructions: 1513
COMMON

Function 050C4936 Relevance: 2.7, Strings: 1, Instructions: 1456
COMMON

Function 05231F6E Relevance: 1.6, APIs: 1, Instructions: 130
registryCOMMON

Function 0523045F Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 0100B1E6 Relevance: 1.6, APIs: 1, Instructions: 97
registryCOMMON

Function 052311FC Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 0100AA75 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Function 052310F4 Relevance: 1.6, APIs: 1, Instructions: 92
timeCOMMON

Function 0100B036 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON