Edit tour

Windows Analysis Report
OgcktrbHkI.exe

Overview

General Information

Sample name:	OgcktrbHkI.exe renamed because original name is a hash value
Original sample name:	35f519000ad078d242c0bce097c59b31.exe
Analysis ID:	1436353
MD5:	35f519000ad078d242c0bce097c59b31
SHA1:	41a3c859c36a4240a51e6ce17ab269e8d2728eb0
SHA256:	1dc79692db8709e88fee042c5555f8432dc4638442887d8150b8b7c67f5f3eb2
Tags:	32exetrojan
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

OgcktrbHkI.exe (PID: 6672 cmdline: "C:\Users\user\Desktop\OgcktrbHkI.exe" MD5: 35F519000AD078D242C0BCE097C59B31)

cmd.exe (PID: 6796 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kofydeki\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6964 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\kofydeki\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7148 cmdline: "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 4428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3940 cmdline: "C:\Windows\System32\sc.exe" description kofydeki "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 1436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2316 cmdline: "C:\Windows\System32\sc.exe" start kofydeki MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 1856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6820 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7464 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 648 MD5: C31336C1EFC2CCB44B4326EA793040F2)

pspizbvl.exe (PID: 3156 cmdline: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d"C:\Users\user\Desktop\OgcktrbHkI.exe" MD5: B50406135DB8929E333AE2BDD1EE42FF)

svchost.exe (PID: 6912 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 7276 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 544 MD5: C31336C1EFC2CCB44B4326EA793040F2)

chrome.exe (PID: 6344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:/// MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7208 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1976,i,15118944360220751254,1504055466682295701,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

svchost.exe (PID: 7032 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 3940 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3156 -ip 3156 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7112 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6672 -ip 6672 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 6996 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7992 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.1671898553.0000000001C1B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x543d:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1671238466.0000000001B45000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4aa5:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: OgcktrbHkI.exe PID: 6672	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: pspizbvl.exe PID: 3156	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 6912	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.pspizbvl.exe.2310e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.pspizbvl.exe.2310e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.OgcktrbHkI.exe.1ba0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.OgcktrbHkI.exe.1ba0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.OgcktrbHkI.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.OgcktrbHkI.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.OgcktrbHkI.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.pspizbvl.exe.2490000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.pspizbvl.exe.2490000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.pspizbvl.exe.2490000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.OgcktrbHkI.exe.1bc0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.OgcktrbHkI.exe.1bc0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
11.3.pspizbvl.exe.2330000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.pspizbvl.exe.2330000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
13.2.svchost.exe.cd0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
13.2.svchost.exe.cd0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
13.2.svchost.exe.cd0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
13.2.svchost.exe.cd0000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
13.2.svchost.exe.cd0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
13.2.svchost.exe.cd0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.pspizbvl.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.pspizbvl.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.pspizbvl.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.pspizbvl.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.pspizbvl.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.pspizbvl.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.OgcktrbHkI.exe.1bc0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.OgcktrbHkI.exe.1bc0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.OgcktrbHkI.exe.1bc0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.OgcktrbHkI.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.OgcktrbHkI.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.OgcktrbHkI.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.pspizbvl.exe.2490000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.pspizbvl.exe.2490000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.pspizbvl.exe.2490000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.3.pspizbvl.exe.2330000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.3.pspizbvl.exe.2330000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.3.pspizbvl.exe.2330000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
11.2.pspizbvl.exe.2310e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.pspizbvl.exe.2310e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
11.2.pspizbvl.exe.2310e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d"C:\Users\user\Desktop\OgcktrbHkI.exe", ParentImage: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, ParentProcessId: 3156, ParentProcessName: pspizbvl.exe, ProcessCommandLine: svchost.exe, ProcessId: 6912, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\OgcktrbHkI.exe", ParentImage: C:\Users\user\Desktop\OgcktrbHkI.exe, ParentProcessId: 6672, ParentProcessName: OgcktrbHkI.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7148, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.47.53.36, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 6912, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49743

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d"C:\Users\user\Desktop\OgcktrbHkI.exe", ParentImage: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, ParentProcessId: 3156, ParentProcessName: pspizbvl.exe, ProcessCommandLine: svchost.exe, ProcessId: 6912, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 6912, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\kofydeki

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\OgcktrbHkI.exe", ParentImage: C:\Users\user\Desktop\OgcktrbHkI.exe, ParentProcessId: 6672, ParentProcessName: OgcktrbHkI.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7148, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 7032, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: OgcktrbHkI.exe

Avira: detected

Antivirus detection for URL or domain

Source: jotunheim.name:443	URL Reputation: Label: malware
Source: vanaheim.cn:443	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\pspizbvl.exe

Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2

Found malware configuration

Source: 0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for domain / URL

Source: vanaheim.cn

Virustotal: Detection: 15%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\pspizbvl.exe	Virustotal: Detection: 44%			Perma Link
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe (copy)	Virustotal: Detection: 44%			Perma Link

Multi AV Scanner detection for submitted file

Source: OgcktrbHkI.exe

Virustotal: Detection: 43%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\pspizbvl.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: OgcktrbHkI.exe

Joe Sandbox ML: detected

Source: https://ogs.google.com/widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en	HTTP Parser: No favicon
Source: https://ogs.google.com/widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en	HTTP Parser: No favicon
Source: https://ogs.google.com/widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en	HTTP Parser: No favicon

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Unpacked PE file: 0.2.OgcktrbHkI.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Unpacked PE file: 11.2.pspizbvl.exe.400000.0.unpack

Source: OgcktrbHkI.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49770 version: TLS 1.2

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\kofydeki

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 109.107.161.150 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 74.125.137.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.53.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.110 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 104.47.53.36 104.47.53.36
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 67.195.228.110 67.195.228.110

Source: Joe Sandbox View	ASN Name: TELEPORT-TV-ASRU TELEPORT-TV-ASRU
Source: Joe Sandbox View	ASN Name: YAHOO-GQ1US YAHOO-GQ1US

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.47.53.36:25
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 67.195.228.110:25
Source: global traffic	TCP traffic: 192.168.2.4:49759 -> 74.125.137.26:25
Source: global traffic	TCP traffic: 192.168.2.4:49773 -> 217.69.139.150:25

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.76
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.76
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.76
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.76
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+83avNG6Z9wwMVh&MD=ybDA+rmd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en HTTP/1.1Host: ogs.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+83avNG6Z9wwMVh&MD=ybDA+rmd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=ON-263QZXt9Weooq4tM-X7f_gPZYX_UROX833_yqu-2GKj7wBRvMMF_Z8Hh_g785FV-f1eGZZ3bmuxVot588IRQ_TPzkUmoPYhH9VZfNdSFfe5oLbWL0o3mTVMkjR2y5hkTF1a_qbB89fDZKW_cIDuWlJVWJsC3zjL1NGiEc0tU

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta6.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 787sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: text/plain;charset=UTF-8X-Goog-AuthUser: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://ogs.google.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ogs.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=mPPPqpDMrDFUKWs8QWCE0CfLRBKkKmj_o5FDyqsicCmeUBwk9I5OXwE3RMm_CMffzYSx9ZIPSTxmM-VQzSv_mLJjyXRSUzvk9haotAWoVcJ8iqK3NFmfA42wDu-YwqQ9vhflBU2dO2t8pCNEAbMtpv2HO6denIteuHo8gbtxJng

Source: svchost.exe, 00000013.00000002.2876220211.000001AB38284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000013.00000002.2876369214.000001AB382F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 00000013.00000003.1671389346.000001AB38418000.00000004.00000800.00020000.00000000.sdmp, edb.log.19.dr, qmgr.db.19.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.19.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.19.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.19.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000013.00000003.1671389346.000001AB38418000.00000004.00000800.00020000.00000000.sdmp, edb.log.19.dr, qmgr.db.19.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000013.00000003.1671389346.000001AB38418000.00000004.00000800.00020000.00000000.sdmp, edb.log.19.dr, qmgr.db.19.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000013.00000003.1671389346.000001AB3844D000.00000004.00000800.00020000.00000000.sdmp, edb.log.19.dr, qmgr.db.19.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000013.00000002.2876220211.000001AB38261000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2876300694.000001AB382D0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2875660734.000001AB33502000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2876079309.000001AB3820F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.2293597228.000001AB38142000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2876138784.000001AB3822C000.00000004.00000020.00020000.00000000.sdmp, edb.log.19.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/hhbs2fc5gftn5wsvpbv6ueh5wy_2024.4.30.0/go
Source: svchost.exe, 00000013.00000002.2876300694.000001AB382BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: qmgr.db.19.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: chromecache_60.20.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_72.20.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_72.20.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_60.20.dr, chromecache_72.20.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_59.20.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_72.20.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_72.20.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_72.20.dr	String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: chromecache_72.20.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_60.20.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_60.20.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_60.20.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_60.20.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: edb.log.19.dr, qmgr.db.19.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.19.dr, qmgr.db.19.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.19.dr, qmgr.db.19.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.19.dr, qmgr.db.19.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.19.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: chromecache_75.20.dr	String found in binary or memory: https://ogs.google.com/
Source: chromecache_75.20.dr	String found in binary or memory: https://ogs.google.com/widget/app/so
Source: edb.log.19.dr, qmgr.db.19.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.19.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: chromecache_60.20.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_72.20.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_72.20.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_75.20.dr	String found in binary or memory: https://ssl.gstatic.com
Source: chromecache_59.20.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_72.20.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_59.20.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_72.20.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_72.20.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_75.20.dr	String found in binary or memory: https://www.gstatic.com
Source: chromecache_75.20.dr	String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.atEDuNh539g.
Source: chromecache_60.20.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_60.20.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_60.20.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49770 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 0.2.OgcktrbHkI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.2490000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.cd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.OgcktrbHkI.exe.1bc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OgcktrbHkI.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.2490000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.pspizbvl.exe.2330000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.2310e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OgcktrbHkI.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pspizbvl.exe PID: 3156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6912, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.pspizbvl.exe.2310e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.pspizbvl.exe.2310e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.OgcktrbHkI.exe.1ba0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.OgcktrbHkI.exe.1ba0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.OgcktrbHkI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.OgcktrbHkI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.pspizbvl.exe.2490000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.pspizbvl.exe.2490000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.OgcktrbHkI.exe.1bc0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.OgcktrbHkI.exe.1bc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.pspizbvl.exe.2330000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.pspizbvl.exe.2330000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 13.2.svchost.exe.cd0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 13.2.svchost.exe.cd0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 13.2.svchost.exe.cd0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 13.2.svchost.exe.cd0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.OgcktrbHkI.exe.1bc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.OgcktrbHkI.exe.1bc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.OgcktrbHkI.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.OgcktrbHkI.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.pspizbvl.exe.2490000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.pspizbvl.exe.2490000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.3.pspizbvl.exe.2330000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.3.pspizbvl.exe.2330000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 11.2.pspizbvl.exe.2310e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 11.2.pspizbvl.exe.2310e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.1671898553.0000000001C1B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1671238466.0000000001B45000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\kofydeki\			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp			Jump to behavior

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Code function: 11_2_0040C913	11_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00CDC913	13_2_00CDC913

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: String function: 01BA27AB appears 35 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3156 -ip 3156

Source: OgcktrbHkI.exe, 00000000.00000000.1606556854.00000000019F8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesFirezer0 vs OgcktrbHkI.exe
Source: OgcktrbHkI.exe, 00000000.00000002.1672013177.0000000001C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesFirezer0 vs OgcktrbHkI.exe
Source: OgcktrbHkI.exe	Binary or memory string: OriginalFilenamesFirezer0 vs OgcktrbHkI.exe

Source: OgcktrbHkI.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.2.pspizbvl.exe.2310e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.pspizbvl.exe.2310e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.OgcktrbHkI.exe.1ba0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.OgcktrbHkI.exe.1ba0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.OgcktrbHkI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.OgcktrbHkI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.pspizbvl.exe.2490000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.pspizbvl.exe.2490000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.OgcktrbHkI.exe.1bc0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.OgcktrbHkI.exe.1bc0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.pspizbvl.exe.2330000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.pspizbvl.exe.2330000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 13.2.svchost.exe.cd0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 13.2.svchost.exe.cd0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 13.2.svchost.exe.cd0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 13.2.svchost.exe.cd0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.OgcktrbHkI.exe.1bc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.OgcktrbHkI.exe.1bc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.OgcktrbHkI.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.OgcktrbHkI.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.pspizbvl.exe.2490000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.pspizbvl.exe.2490000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.3.pspizbvl.exe.2330000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.3.pspizbvl.exe.2330000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 11.2.pspizbvl.exe.2310e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 11.2.pspizbvl.exe.2310e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.1671898553.0000000001C1B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1671238466.0000000001B45000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: classification engine

Classification label: mal100.troj.evad.winEXE@51/39@20/12

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_01C2046B CreateToolhelp32Snapshot,Module32First,

0_2_01C2046B

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00CD9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	13_2_00CD9A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1436:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3940:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1856:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7112:64:WilError_03

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

File created: C:\Users\user\AppData\Local\Temp\pspizbvl.exe

Jump to behavior

Source: OgcktrbHkI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OgcktrbHkI.exe

Virustotal: Detection: 43%

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

File read: C:\Users\user\Desktop\OgcktrbHkI.exe

Jump to behavior

Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_11-14996

Source: unknown	Process created: C:\Users\user\Desktop\OgcktrbHkI.exe "C:\Users\user\Desktop\OgcktrbHkI.exe"
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kofydeki\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\kofydeki\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description kofydeki "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start kofydeki
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d"C:\Users\user\Desktop\OgcktrbHkI.exe"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3156 -ip 3156
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6672 -ip 6672
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1976,i,15118944360220751254,1504055466682295701,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 544
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 648
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kofydeki\	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\kofydeki\	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description kofydeki "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start kofydeki	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1976,i,15118944360220751254,1504055466682295701,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6672 -ip 6672	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3156 -ip 3156	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 544	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 648	Jump to behavior

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: OgcktrbHkI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Unpacked PE file: 0.2.OgcktrbHkI.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Unpacked PE file: 11.2.pspizbvl.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Unpacked PE file: 0.2.OgcktrbHkI.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Unpacked PE file: 11.2.pspizbvl.exe.400000.0.unpack

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: 0_2_01C23753 push 0000002Bh; iretd	0_2_01C23759
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: 0_2_01C1B12B push edi; ret	0_2_01C1B1FA
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: 0_2_01C1B4B5 push eax; ret	0_2_01C1B4BA
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Code function: 11_2_01B4CDBB push 0000002Bh; iretd	11_2_01B4CDC1

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe (copy)			Jump to dropped file
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	File created: C:\Users\user\AppData\Local\Temp\pspizbvl.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kofydeki

Jump to behavior

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\ogcktrbhki.exe

Jump to behavior

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

13_2_00CD199C

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15328
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_11-16310
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_13-6419

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_13-6144

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_13-6711
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_11-15616
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-15286

Source: C:\Windows\SysWOW64\svchost.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_13-7423

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_13-6174
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_11-15011
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-14859

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	API coverage: 5.4 %
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	API coverage: 4.0 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 8068	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 8068	Thread sleep time: -31000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7304	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000013.00000002.2876176032.000001AB38258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000D.00000002.2874366057.0000000003200000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Source: svchost.exe, 00000013.00000002.2875300242.000001AB32C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	API call chain: ExitProcess graph end node	graph_0-15288
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_13-6178
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_13-6437

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe

Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep

graph_11-16371

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: 0_2_01BA0D90 mov eax, dword ptr fs:[00000030h]	0_2_01BA0D90
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: 0_2_01BA092B mov eax, dword ptr fs:[00000030h]	0_2_01BA092B
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: 0_2_01C1FD48 push dword ptr fs:[00000030h]	0_2_01C1FD48
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Code function: 11_2_01B493B0 push dword ptr fs:[00000030h]	11_2_01B493B0
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Code function: 11_2_0231092B mov eax, dword ptr fs:[00000030h]	11_2_0231092B
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Code function: 11_2_02310D90 mov eax, dword ptr fs:[00000030h]	11_2_02310D90

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Code function: 11_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	11_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00CD9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	13_2_00CD9A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 109.107.161.150 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 74.125.137.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.53.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.110 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: CD0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: CD0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: CD0000			Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: AC8008			Jump to behavior

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kofydeki\	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\kofydeki\	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description kofydeki "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start kofydeki	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6672 -ip 6672	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3156 -ip 3156	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 544	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 648	Jump to behavior

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

0_2_00407809

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\OgcktrbHkI.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 0.2.OgcktrbHkI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.2490000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.cd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.OgcktrbHkI.exe.1bc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OgcktrbHkI.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.2490000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.pspizbvl.exe.2330000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.2310e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OgcktrbHkI.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pspizbvl.exe PID: 3156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6912, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 0.2.OgcktrbHkI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.2490000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.cd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OgcktrbHkI.exe.1ba0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.OgcktrbHkI.exe.1bc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OgcktrbHkI.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.2490000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.pspizbvl.exe.2330000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.pspizbvl.exe.2310e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OgcktrbHkI.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pspizbvl.exe PID: 3156, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6912, type: MEMORYSTR

Source: C:\Users\user\Desktop\OgcktrbHkI.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe	Code function: 11_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	11_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00CD88B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	13_2_00CD88B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	2 Software Packing	NTDS	25 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
OgcktrbHkI.exe	44%	Virustotal		Browse
OgcktrbHkI.exe	100%	Avira	HEUR/AGEN.1311176
OgcktrbHkI.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\pspizbvl.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\Temp\pspizbvl.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\pspizbvl.exe	45%	Virustotal		Browse
C:\Windows\SysWOW64\kofydeki\pspizbvl.exe (copy)	45%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mta6.am0.yahoodns.net	0%	Virustotal		Browse
vanaheim.cn	15%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.broofa.com	0%	URL Reputation	safe
jotunheim.name:443	100%	URL Reputation	malware
vanaheim.cn:443	100%	URL Reputation	malware
https://csp.withgoogle.com/csp/lcreport/	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mta6.am0.yahoodns.net	67.195.228.110	true	true	0%, Virustotal, Browse	unknown
mxs.mail.ru	217.69.139.150	true	false		high
plus.l.google.com	142.250.176.14	true	false		high
www3.l.google.com	142.250.72.174	true	false		high
play.google.com	142.250.189.14	true	false		high
www.google.com	142.250.217.132	true	false		high
microsoft-com.mail.protection.outlook.com	104.47.53.36	true	false		high
vanaheim.cn	109.107.161.150	true	true	15%, Virustotal, Browse	unknown
smtp.google.com	74.125.137.26	true	false		high
google.com	unknown	unknown	false		high
ogs.google.com	unknown	unknown	false		high
yahoo.com	unknown	unknown	false		high
mail.ru	unknown	unknown	false		high
apis.google.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/async/newtab_promos	false		high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false		high
jotunheim.name:443	true	URL Reputation: malware	unknown
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
vanaheim.cn:443	true	URL Reputation: malware	unknown
https://ogs.google.com/widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ogs.google.com/	chromecache_75.20.dr	false		high
http://www.broofa.com	chromecache_60.20.dr	false	URL Reputation: safe	unknown
https://apis.google.com/js/api.js	chromecache_59.20.dr	false		high
https://www.google.com/log?format=json&hasfast=true	chromecache_59.20.dr	false		high
http://crl.ver)	svchost.exe, 00000013.00000002.2876220211.000001AB38284000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.19.dr, qmgr.db.19.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_72.20.dr	false		high
https://plus.google.com	chromecache_72.20.dr	false		high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_59.20.dr	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.19.dr, qmgr.db.19.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_60.20.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.19.dr, qmgr.db.19.dr	false		high
https://csp.withgoogle.com/csp/lcreport/	chromecache_72.20.dr	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.19.dr	false		high
https://apis.google.com	chromecache_60.20.dr, chromecache_72.20.dr	false		high
https://ogs.google.com/widget/app/so	chromecache_75.20.dr	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	edb.log.19.dr, qmgr.db.19.dr	false		high
https://domains.google.com/suggest/flow	chromecache_72.20.dr	false		high
https://clients6.google.com	chromecache_72.20.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.107.161.150	vanaheim.cn	Russian Federation	49973	TELEPORT-TV-ASRU	true
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	false
74.125.137.26	smtp.google.com	United States	15169	GOOGLEUS	false
104.47.53.36	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.217.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.176.14	plus.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
67.195.228.110	mta6.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	true
142.250.72.174	www3.l.google.com	United States	15169	GOOGLEUS	false
142.250.189.14	play.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436353
Start date and time:	2024-05-04 15:20:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OgcktrbHkI.exe renamed because original name is a hash value
Original Sample Name:	35f519000ad078d242c0bce097c59b31.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@51/39@20/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 63 Number of non-executed functions: 254
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 142.250.72.131, 142.250.188.238, 74.125.137.84, 34.104.35.123, 172.217.14.67, 20.231.239.246, 20.112.250.133, 20.236.44.162, 20.76.201.171, 20.70.246.20, 23.3.84.131, 199.232.210.172, 192.229.211.108, 172.217.12.131, 142.250.176.3, 142.250.72.163, 142.250.189.3, 142.251.40.46
Excluded domains from analysis (whitelisted): clients1.google.com, ssl.gstatic.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, www.gstatic.com, microsoft.com, prod.fs.microsoft.com.akadns.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:20:59	API Interceptor	6x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.18101.30858.exe	Get hash	malicious	Unknown	Browse
	mBW2MzlcHN.exe	Get hash	malicious	LockBit ransomware, PureLog Stealer	Browse
	0e46.scr.exe	Get hash	malicious	AgentTesla	Browse
	Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765.exe	Get hash	malicious	AgentTesla	Browse
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	#U00d6deme tavsiyesi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	E7236252-receipt.vbs	Get hash	malicious	XWorm	Browse
	4365078236450.LnK.lnk	Get hash	malicious	Unknown	Browse
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Dropper-CHS.435.30054.exe	Get hash	malicious	Unknown	Browse
217.69.139.150	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse
	x607DB0i08.exe	Get hash	malicious	Pushdo	Browse
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse
	EwK95WVtzI.exe	Get hash	malicious	Pushdo	Browse
	OWd39WUX3D.exe	Get hash	malicious	Pushdo	Browse
	0bv3c9AqYs.exe	Get hash	malicious	Pushdo	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	CX17SY6xF6.exe	Get hash	malicious	Pushdo	Browse
	PIyT9A3jfC.exe	Get hash	malicious	Pushdo	Browse
	nhVJ8J5qOt.exe	Get hash	malicious	Pushdo	Browse
67.195.228.110	file.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	data.log.exe	Get hash	malicious	Unknown	Browse
	Update-KB7390-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB6340-x86.exe	Get hash	malicious	Unknown	Browse
	JgC7A84YOU.exe	Get hash	malicious	Tofsee Xmrig	Browse
	wxdh9aIrfH.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse
104.47.53.36	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse
	lhs31fcc2k0lmr.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.5284.17028.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.9178.5965.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta6.am0.yahoodns.net	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.94
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.72
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	67.195.228.109
	webcam.txt.com.exe	Get hash	malicious	Unknown	Browse	67.195.204.73
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.106
	file.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	.exe	Get hash	malicious	Unknown	Browse	98.136.96.91
	file.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	file.log.exe	Get hash	malicious	Unknown	Browse	67.195.228.94
microsoft-com.mail.protection.outlook.com	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	file.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse	52.101.11.0
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse	104.47.53.36
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse	104.47.54.36
vanaheim.cn	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse	85.208.208.90
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	77.232.138.239
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	file.exe	Get hash	malicious	Tofsee	Browse	5.188.88.112
	mvu3vh0t.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
	bwntJQufLG.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
	lhs31fcc2k0lmr.exe	Get hash	malicious	Tofsee	Browse	194.169.163.56
mxs.mail.ru	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	94.100.180.31
	G7DyaA9iz9.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	x7RlIzQDk1.exe	Get hash	malicious	Unknown	Browse	217.69.139.150
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse	94.100.180.31
	PIyT9A3jfC.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	217.69.139.150
	rLDmqbpt5D.exe	Get hash	malicious	Pushdo, DanaBot, RedLine, SmokeLoader	Browse	94.100.180.31
	.exe	Get hash	malicious	Unknown	Browse	94.100.180.31
	file.exe	Get hash	malicious	Pushdo, DanaBot, SmokeLoader	Browse	217.69.139.150
	1EsDtA4mep.exe	Get hash	malicious	Pushdo	Browse	217.69.139.150

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEPORT-TV-ASRU	clik.exe	Get hash	malicious	CredGrabber, PureLog Stealer	Browse	109.107.181.83
	leadiadequatepro.exe	Get hash	malicious	CredGrabber, PureLog Stealer	Browse	109.107.181.83
	responsibilityleadpro.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.83
	CE1KVxYp5t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.83
	Ve6VeFSgkz.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.107.181.83
	fDTPlvsGfH.exe	Get hash	malicious	DCRat	Browse	109.107.182.145
	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	109.107.181.83
	SecuriteInfo.com.Win64.PWSX-gen.6289.18727.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer	Browse	109.107.181.83
	gKN4xIjj5o.exe	Get hash	malicious	CredGrabber, PureLog Stealer	Browse	109.107.181.83
	vRp56pf5a9.exe	Get hash	malicious	CredGrabber, PureLog Stealer, zgRAT	Browse	109.107.181.83
MAILRU-ASMailRuRU	c40snYcuW6.elf	Get hash	malicious	Mirai	Browse	5.61.23.80
	arm7.elf	Get hash	malicious	Mirai	Browse	217.69.134.17
	SkM9yWax29.elf	Get hash	malicious	Mirai	Browse	178.237.22.126
	base.apk	Get hash	malicious	Anubis BankBot	Browse	178.237.20.131
	UD6c1o6Fhg.elf	Get hash	malicious	Mirai	Browse	94.100.184.227
	BSKbaZ6Mij.elf	Get hash	malicious	Mirai	Browse	94.100.184.245
	https://cloud.mail.ru/stock/hG498Pfe7uJ1fEVeN7iTtbHo	Get hash	malicious	HTMLPhisher	Browse	5.61.23.11
	nigga.sh	Get hash	malicious	Mirai	Browse	5.61.21.188
	WY0hbWVwQF.elf	Get hash	malicious	Mirai	Browse	5.61.23.62
	4J8MjfJo3m.elf	Get hash	malicious	Mirai	Browse	128.140.169.82
YAHOO-GQ1US	q5C2tw1Pc6.elf	Get hash	malicious	Mirai	Browse	67.195.2.124
	8g0fGUcWeQ.elf	Get hash	malicious	Mirai	Browse	98.136.201.255
	Q00D5u1xHq.elf	Get hash	malicious	Mirai, Okiru	Browse	98.137.30.195
	gIzj2ZdSYV.elf	Get hash	malicious	Mirai, Moobot	Browse	98.137.99.74
	yjz3ZEaSau.elf	Get hash	malicious	Moobot	Browse	98.137.99.74
	TfpwQ763RO.elf	Get hash	malicious	Mirai, Moobot	Browse	68.180.200.211
	5m6jbTvemR.elf	Get hash	malicious	Mirai	Browse	98.136.201.222
	https://yahu.pages.dev/account/js-reporting/?crumb=F3RZp873jWJ&message=javascript_not_enabled&ref=%2F	Get hash	malicious	HTMLPhisher	Browse	98.137.11.161
	https://ousps88.cc/	Get hash	malicious	Unknown	Browse	98.137.11.144
	3rOSHAZ6SC.elf	Get hash	malicious	Mirai	Browse	98.137.103.190
MICROSOFT-CORP-MSN-AS-BLOCKUS	1CMweaqlKp.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	13.89.179.12
	sora.x86-20240504-0115.elf	Get hash	malicious	Mirai	Browse	20.199.232.188
	https://www.bjvpza.cn/	Get hash	malicious	Unknown	Browse	13.107.213.40
	https://www.uhnrya.cn/	Get hash	malicious	Unknown	Browse	13.107.213.69
	https://portal.cpscompressors.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.71
	https://www.soqsrkk.cn/	Get hash	malicious	Unknown	Browse	13.107.246.69
	https://www.evernote.com/shard/s593/sh/34d5323e-5e68-2022-e399-8b6a9f22d260/e4DIh4rAMOdx8UQxrqSgHb8GiJxwwBeZjn9dT_57KOFldDUBp5VNPxZHmw/res/782d1fe9-3270-5412-662f-9e3e990fa372	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	Copy of BARBOT CONSTRUCTION.xlsx	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	52.109.28.46
	Scanned from Xerox KwlawMultiftr.rtf	Get hash	malicious	HTMLPhisher	Browse	52.109.52.131
	Purchase_Order_1803075641.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.18101.30858.exe	Get hash	malicious	Unknown	Browse	40.68.123.157 20.114.59.183
	mBW2MzlcHN.exe	Get hash	malicious	LockBit ransomware, PureLog Stealer	Browse	40.68.123.157 20.114.59.183
	eiQXaKJ75nCjEWn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.68.123.157 20.114.59.183
	0e46.scr.exe	Get hash	malicious	AgentTesla	Browse	40.68.123.157 20.114.59.183
	Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765.exe	Get hash	malicious	AgentTesla	Browse	40.68.123.157 20.114.59.183
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.68.123.157 20.114.59.183
	#U00d6deme tavsiyesi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.68.123.157 20.114.59.183
	E7236252-receipt.vbs	Get hash	malicious	XWorm	Browse	40.68.123.157 20.114.59.183
	4365078236450.LnK.lnk	Get hash	malicious	Unknown	Browse	40.68.123.157 20.114.59.183
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse	40.68.123.157 20.114.59.183

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3277036929714994
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrM:KooCEYhgYEL0In
MD5:	EE3F3F77F324488AA4568A17CD2EF7F6
SHA1:	27811C94101482C3F7D9BB111447E85C550E1EA1
SHA-256:	416BE34422EB8D668E6D3D9B8B8E64510442623E55085E95C40A9DD9568A8C0E
SHA-512:	9378B5060A8EFDA0763A14322108F1915295C2F8EB11270BE58E120C2A9C681D9C1B95D62354A1839BC882F604B682FE70323DBE944C80A7BE8D16B4A81767EA
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x26eb8c3f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42210152543902413
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	1B2EE00520C8EF37E25C211C701EB1B0
SHA1:	AB4ADB81F23066A94A91FC5C3F7CFFC7FF959BCA
SHA-256:	7EB2EB0FC940B53DE1253F83AAE2B69AFEABF45AA3DD21D4BB3B1D5E5049453B
SHA-512:	40CA2A17A10E526F2C0EC64B1D2ED7E4E0196FA85844219721DD43F36236B39D97223D90F8A89D4DB233B259DD270886219DF2D873A0C8D3AB2C267625D14D19
Malicious:	false
Preview:	&.?... .......A.......X\...;...{......................0.!..........{A......\|+.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................R........\|K.................4.K......\|+..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07522799253122159
Encrypted:	false
SSDEEP:	3:uggXKYeSdhlAjjn13a/S8ThtillcVO/lnlZMxZNQl:uggXKz0bAj53qS8TaOewk
MD5:	8D31AA9093F9436BB3E44D7372299AD9
SHA1:	C31C13DA442566DF5B56A841940749736F958F99
SHA-256:	6003469EA60D53A6038AF4B9F847B9999C7762E20EDA0AE9D28C57DA15333851
SHA-512:	CB44F125874B6FA3A52D07C983104B8229DDF8ADFA93B03B91A975832E24278EE72D730AEA0227408837363FD5062DFD2643E1A6D2B7F94CCB7AAF3087C1F64E
Malicious:	false
Preview:	........................................;...{.......\|+......{A..............{A......{A..........{A]................4.K......\|+.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pspizbvl.exe

Download File

Process:	C:\Users\user\Desktop\OgcktrbHkI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14476288
Entropy (8bit):	5.31278696874138
Encrypted:	false
SSDEEP:	24576:Jc4Rz2LgMvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv:zRz2c
MD5:	B50406135DB8929E333AE2BDD1EE42FF
SHA1:	16305C9EC4589A84EC96FEC9CC7EAF05D99A79CF
SHA-256:	CD7849F93D395A35D766C01B9D1077B5026D33B030CC8EB3CC2FF389B8431C87
SHA-512:	63D679AA3D40ED6575FEDD6A244FA09B0B3DA98F380BF99F5C8E6A0C1520CDD299711311ADBB24B4FA2703320A95AEFED8B9EB26D3525032DE6343167C1CC5E1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 45%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r.....................................................?g..............?g......Rich....................PE..L...r..d......................`......@....... ....@...........................a.....0..........................................<....._.0-.......................... ................................y..@............ ...............................text...e........................... ..`.rdata...m... ...n..................@..@.data.....]......l..................@....rsrc...0-...._.....................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SysWOW64\kofydeki\pspizbvl.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14476288
Entropy (8bit):	5.31278696874138
Encrypted:	false
SSDEEP:	24576:Jc4Rz2LgMvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv:zRz2c
MD5:	B50406135DB8929E333AE2BDD1EE42FF
SHA1:	16305C9EC4589A84EC96FEC9CC7EAF05D99A79CF
SHA-256:	CD7849F93D395A35D766C01B9D1077B5026D33B030CC8EB3CC2FF389B8431C87
SHA-512:	63D679AA3D40ED6575FEDD6A244FA09B0B3DA98F380BF99F5C8E6A0C1520CDD299711311ADBB24B4FA2703320A95AEFED8B9EB26D3525032DE6343167C1CC5E1
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 45%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r.....................................................?g..............?g......Rich....................PE..L...r..d......................`......@....... ....@...........................a.....0..........................................<....._.0-.......................... ................................y..@............ ...............................text...e........................... ..`.rdata...m... ...n..................@..@.data.....]......l..................@....rsrc...0-...._.....................@..@........................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2200)
Category:	downloaded
Size (bytes):	184072
Entropy (8bit):	5.457813410298979
Encrypted:	false
SSDEEP:	3072:LaXH2HHSBV2qoSKRd8mQ3jfA8j3yViKE5rmVqpzE:NHgxohRdUfFyQKEnpzE
MD5:	E5FCBC4D28FD8054A03E23C62057111F
SHA1:	A25AB167CC29D60286E7E3EEAEA77DEC677190C4
SHA-256:	52094E235144F4EFBB9873F05AC25F1E9ADF0F5BD513B6FC4D9E0499331B3486
SHA-512:	7AEEC24270661E4658CB9DC19C075B71E5EDDC22859B1269529EFC0F159F165BE680D2D864BDF4D41B937556D72ED5B4F65011205D80D55EBFED05155753CA1E
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.atEDuNh539g.es5.O/am=EGDQuQMg/d=1/excm=_b,_tp,appwidgetnoauthview/ed=1/dg=0/wt=2/ujg=1/rs=AM-SdHvRM4rmzL0TklJKtWu6JILwVFGwEg/m=_b,_tp"
Preview:	"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x39d06010, 0x800e, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT./.var ia,aaa,Ha,caa,Qa,Sa,Ta,Ua,Va,Wa,Xa,ab,daa,eaa,cb,eb,tb,xb,Lb,Nb,Rb,Ub,Wb,gaa,ac,cc,dc,kc,rc,uc,wc,oc,jaa,Fc,Gc,kaa,Nc,laa,Rc,Tc,cd,dd,hd,jd,kd,pd,id,ld,Sc,Cd,Ad,Dd,y,Hd,Kd,raa,saa,taa,uaa,vaa,waa,xaa,yaa,xe,Be,Eaa,Caa,Qe,Ye,Haa,Iaa,$e,of,Maa,Naa,vf,Oaa,Paa,Qaa,Raa,Kf,Lf,Mf,Saa,Taa,Uaa,Vaa,Waa,Xaa,Yaa,$aa,aba,aa,hg,ig,bba,kg,lg,og,cba,tg,ug,vg,fba,gba,Bg,Cg,hba,iba;_.ba=function(a){return function(){return aa[a].apply(this,arguments)}};_.ca=function(a,b){

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2294)
Category:	downloaded
Size (bytes):	163286
Entropy (8bit):	5.544045381504343
Encrypted:	false
SSDEEP:	3072:CMiFOP4roKgkk/EFZMQbxjZW1BKo6JMI6l0nt8Uv1ziwtXOmDsY+WwYLF/HrY7+A:CMiroKfbMQbxjZW1BKo6JMI6l0nt8Uvq
MD5:	9D9987F6E83F101A097A0BD64A14C71B
SHA1:	E71E10897E0E874DE4D12125D5DF2F7FCE08F585
SHA-256:	D0975FC00A61201A54714BE8DF5E50F02B277E133BA08ABD9DEEA33934FA28A9
SHA-512:	5AE557145F0E0FF3E768AFC63B3E4855F53DCA49D46A22ACB169CC6DC58FF2B11C776B419141EB12C8B0CF7BBD16E928F9EE5AF5014DD976130B00A1995B325E
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ics7SFQVxbg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTtpRznzVJk75Y4TcT-zpGGUjebtAg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.cj=function(a,b,c){return c?a\|b:a&~b};_.dj=function(a,b,c,d){a=_.jb(a,b,c,d);return Array.isArray(a)?a:_.kc};_.ej=function(a,b){a=_.cj(a,2,!!(2&b));a=_.cj(a,32,!0);return a=_.cj(a,2048,!1)};_.fj=function(a,b){0===a&&(a=_.ej(a,b));return a=_.cj(a,1,!0)};_.gj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.hj=function(a,b,c){32&b&&c\|\|(a=_.cj(a,32,!1));return a};._.ij=function(a,b,c,d,e,f){var g=!!(2&b),h=g?1:2;const k=1===h;h=2===h;e=!!e;f&&(f=!g);g=_.dj(a,b,d);var l=g[_.v]\|0;const n=!!(4&l);if(!n){l=_.fj(l,b);var p=g,t=b,r;(r=!!(2&l))&&(t=_.cj(t,2,!0));let B=!r,aa=!0,K=0,F=0;for(;K<p.length;K++){const ba=_.Ua(p[K],c,t);if(ba instanceof c){if(!r){const Ca=!!((ba.ka[_.v]\|0)&2);B&&(B=!Ca);aa&&(aa=Ca)}p[F++]=ba}}F<K&&(p.length=F);l=_.cj(l,4,!0);l=_.cj(l,16,aa);l=_.cj(l,8,B);_.ya(p,l);r&&Object.freeze(p)}c=!!(8&l)\|\|k&&!g.length;if(f&&!c){_.gj(l)&&(g=_.xa(g),.l=_.ej(l,b),b=_.ib(a,b,d,g));f=g;c=l;for(p=0;p<f.length;p++)l=f[p],t=_

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3183)
Category:	downloaded
Size (bytes):	3188
Entropy (8bit):	5.8365715329833385
Encrypted:	false
SSDEEP:	96:9KUelimIN6666VD11q5h/5w0jbP5He2FXvF79XffffQo:9KBsN6666VDe5h/5PhHe2ZJ9b
MD5:	5AEAB4B89584FAF631800183D6BD349D
SHA1:	6B6F87DC2B2ADBD3FA93D46D7CCD42396CA577AA
SHA-256:	D88F87E24EC47E377469C0DB0984C81FB5ADDF653F90A641E13CF24770BCE361
SHA-512:	99CC85A03E23D77B72F9F70CBE37C49A55FB6BD253A6ABFB84B7ABEB6AB7D06ABF7DBE41820265B05E1F2C8A13CB4B815A71C1A73BB2AE485BC2735BDC9A5C81
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["pittsburgh oakland construction accident","fall guy movie ryan gosling","12 cilindri ferrari","red lobster endless shrimp","harper murray nebraska volleyball","hawley texas tornadoes","dua lipa album review","sony psn account helldivers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgkvbS8wMTA0em0SGEhhd2xleSDigJQgQ2l0eSBpbiBUZXhhczLTDGRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWJBQUFDQXdFQkFRQUFBQUFBQUFBQUFBQUVCUUlEQmdjQUFmL0VBRGNRQUFFREFnUUNCd1lFQndBQUFBQUFBQUVDQXhFQUJBVVNJVEV

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 106 x 5210, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	137432
Entropy (8bit):	7.981759932974614
Encrypted:	false
SSDEEP:	3072:SWkkEsWBwvkw/2i4fhpATVmE6383x4L6EWL3UQ7lE7sPE:SVAwwswerUv3S4nhdPE
MD5:	387ED93F42803B1EC6697E3B57FBCEF0
SHA1:	2EA8A5BFBF99144BD0EBAEBE60AC35406A8B613E
SHA-256:	982AAC952E2C938BD55550D0409ECE5F4430D38F370161D8318678FA25316587
SHA-512:	7C90F69A53E49BAD03C4CEFD9868B4C4BA145E5738218E8C445FF6AE5347153E3A2F2B918CBE184B0366AFD53B984634D2894FEA6F31A4603E58CCB6BFA5C625
Malicious:	false
URL:	https://ssl.gstatic.com/gb/images/sprites/p_2x_387ed93f4280.png
Preview:	.PNG........IHDR...j...Z.......{.....IDATx...S`......V.4gzl.>.m.m.m.>c......8.J..p....k..i.k...f..v.VeG....V.^,.Y8>..U.(+...fbJ...q.G.kb#.T)F......~..&)+&....'..].~.j5....!.j.<..xJ..&.T91<.......3...\|.4.Uu...c..t..\<#S.........+...M?ew.(....w..h.c.PU.>.C.:.P..Wq...4..[.......k{TG.C.~.$=U..>.....4c+9.s...d.,...h...$.dk..0T3..63$.l.6...O.O..z..J..C...fjZ...i...J..P-T.B5-T..PM..B5-T.B.PM..P-T.B5.].....9...cZ../.b.I....Z..\......^...(..............u.G..O.c.....`k....qx/..U-.U..0.[.:..$.......fx5.l..h..g..O'9..%.E=...x&.P.....?R.\..../.......s.-MU..U..o..Q.1.%.l.gb.....I.zxD..t.&.u[.:R.N..:.d.............].{..z.M..-}Sw@b....[.D..#1$s.I..0..L....I.....i.Z....... MZ...j....i.Z...jZ...i.....jZ...i......z"/...._....q...gU.b.IHO.5....,n........PX..$.._.9(Mw..D../.C......l.....x..Q\|...(..$#../.....GB...7bS..B..G.....Tb.Yx6^.9..C.F..oMrx..p..<N3.=.1...$.....-N.t.jt6..&..J...G..z!..Ff.i...v._..a.....R%I....f....t....._..5.l...A..C.=c(V..)......0$.jg..KT..*E.r

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3572), with no line terminators
Category:	downloaded
Size (bytes):	3572
Entropy (8bit):	5.140651484312947
Encrypted:	false
SSDEEP:	48:vZUJVKLICJEconBdpZUvGCUvGULHg7OTehn5hsbrc7g8IO8u0Y8D2n:yJYI/coXqCg7OSfg8IO8uB8D2n
MD5:	122C0858F7D38991F14E5ADC6BDB3C3B
SHA1:	FFC64755EB42990A73C4878426A641CFB94B57EE
SHA-256:	06D1296A6F6611AC795B27882FE88823EE857D0F49F7018CF00C6A199976DC0D
SHA-512:	149A1FB533C8C7D5EA363B80982DC1EC4C39E5EF9BB37E45BC80E105B18C3FA4DC610449BBD70DE9B9AC7339FEBBBD4FF76C2A9D1FD104D1943A386539AC4D44
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.RS0dNtaZmo0.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuhe2hCYlalU7rKCW-qT_-zMhVRaw"
Preview:	.gb_2e{background:rgba(60,64,67,.9);-webkit-border-radius:4px;border-radius:4px;color:#fff;font:500 12px "Roboto",arial,sans-serif;letter-spacing:.8px;line-height:16px;margin-top:4px;min-height:14px;padding:4px 8px;position:absolute;z-index:1000;-webkit-font-smoothing:antialiased}.gb_Fc{text-align:left}.gb_Fc>*{color:#bdc1c6;line-height:16px}.gb_Fc div:first-child{color:white}.gb_pa{background:none;border:1px solid transparent;-webkit-border-radius:50%;border-radius:50%;-webkit-box-sizing:border-box;box-sizing:border-box;cursor:pointer;height:40px;margin:8px;outline:none;padding:1px;position:absolute;right:0;top:0;width:40px}.gb_pa:hover{background-color:rgba(68,71,70,.08)}.gb_pa:focus,.gb_pa:active{background-color:rgba(68,71,70,.12)}.gb_pa:focus-visible{border-color:#0b57d0;outline:1px solid transparent;outline-offset:-1px}.gb_i .gb_pa:hover,.gb_i .gb_pa:focus,.gb_i .gb_pa:active{background-color:rgba(227,227,227,.08)}.gb_i .gb_pa:focus-visible{border-color:#a8c7fa}.gb_qa{-webkit-box

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	137077
Entropy (8bit):	5.441424088159115
Encrypted:	false
SSDEEP:	1536:jdGuEyNn2zuFRDP6nWysx3DMqPKnrzNSpGiV1p+RHPGb4guje18jZRLM9rZxMkPr:DLnoap3DTKnrQpG4nQUduZ6ZxMkmwXd
MD5:	4B78E2A0E5BAF050D8EDF97BE9CEE75F
SHA1:	8C4C54AF17247898E9FA012589CA516EFCB27C05
SHA-256:	A1CDA0D03D19A9C08E2C4328B2DB277169173BA25F23A8F913609AD4235AC145
SHA-512:	DBDF355688AEB57D29557A6D9B74A574F7B5C2C30F55B998F196790C7C960A7A9908E36416C8DF8839AFC99D418FBB0563D6DB6107AD81AB42FAE69D7D310D64
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Qa gb_hb gb_Td gb_nd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Hd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_rd gb_kd gb_xd gb_wd\"\u003e\u003cdiv class\u003d\"gb_qd gb_gd\"\u003e\u003cdiv class\u003d\"gb_Oc gb_q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Oc gb_Rc gb_q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (769)
Category:	downloaded
Size (bytes):	1424
Entropy (8bit):	5.31660097498527
Encrypted:	false
SSDEEP:	24:kWfS+Xg1QmYTY29/RbFTVebYaThG8VgI4+O6tp41SZGbwfKGbeZPx/sMGOwsNEZ9:ZfS+wmmc/bFpw/A8R3fpWgGb+KGbipsZ
MD5:	13D1BE6BC9AA2CA332D553D2D4491DE1
SHA1:	F7E7A540E69006ED7470EB2AED4EF19BE4A1AF0C
SHA-256:	4C205DD66FDACFF32EB2B63273FB74DB1E29DBD5C9B97F0F6641378174257F39
SHA-512:	A1DD99D4ED179D4FA138A7C500589896F3A5DA06758ED72F67D05243519FB5EADF2184D9B67F0F9337FF55B5F5982D93245A8FF41E6F8F1D619CAC8D47C9FF4A
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.atEDuNh539g.es5.O/ck=boq-one-google.OneGoogleWidgetUi.tmXdt9lP4MI.L.B1.O/am=EGDQuQMg/d=1/exm=A7fCU,BVgquf,COQbmf,EEDORb,EFQ78c,GkRiKb,IZT63,JNoxi,KG2eXe,KUM7Z,L1AAkb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,PrPYRd,QIhFr,RMhBfe,RqjULd,SdcwHb,SpsfSb,U0aPgd,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,VwDzFe,XVMNvd,Z5uLle,ZfAoz,ZwDk9d,_b,_tp,aDfbSd,aW3pY,aurFic,byfTOb,e5qFLc,fKUV3e,gychg,hKSk3e,hc6Ubd,kWgXee,kjKdXe,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,n73qwf,ovKuLd,pjICDe,pw70Gc,s39S4,w9hDv,wmnU7d,ws9Tlc,xQtZb,xUdipf,yDVVkb,zbML3c,zr1jrb/excm=_b,_tp,appwidgetnoauthview/ed=1/wt=2/ujg=1/rs=AM-SdHuoOol6PGq-lFlTYeoE9lb9o902mQ/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:QIhFr;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:GkRiKb/m=bm51tf"
Preview:	"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi\|\|{};(function(_){var window=this;.try{._.q("bm51tf");.var Uoa=!!(_.Jg[0]>>17&1);var Voa=function(a,b,c,d,e){this.o=a;this.N=b;this.v=c;this.O=d;this.W=e;this.j=0;this.l=tW(this)},Woa=function(a){var b={};_.Da(a.tq(),function(e){b[e]=!0});var c=a.kq(),d=a.mq();return new Voa(a.lq(),1E3c.j(),a.fq(),1E3d.j(),b)},tW=function(a){return Math.random()Math.min(a.NMath.pow(a.v,a.j),a.O)},uW=function(a,b){return a.j>=a.o?!1:null!=b?!!a.W[b]:!0};var vW=function(a){_.Q.call(this,a.oa);this.o=a.service.Jr;this.v=a.service.metadata;a=a.service.ID;this.l=a.o.bind(a)};_.G(vW,_.Q);vW.qa=_.Q.qa;vW.V=function(){return{service:{Jr:_.rW,metadata:_.nW,ID:_.DU}}};vW.prototype.j=function(a,b){if(1!=this.v.getType(a.Cb()))return _.Nn(a);var c=this.o.j;(c=c?Woa(c):null)&&uW(c)?(b=wW(this,a,b,c),a=new _.Mn(a,b,2)):a=_.Nn(a);return a};.var wW=function(a,b,c,d){return c.then(function(e){return e},function(e){if(Uoa)if(e instanceof _.ee)

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 106 x 5210, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	137432
Entropy (8bit):	7.981759932974614
Encrypted:	false
SSDEEP:	3072:SWkkEsWBwvkw/2i4fhpATVmE6383x4L6EWL3UQ7lE7sPE:SVAwwswerUv3S4nhdPE
MD5:	387ED93F42803B1EC6697E3B57FBCEF0
SHA1:	2EA8A5BFBF99144BD0EBAEBE60AC35406A8B613E
SHA-256:	982AAC952E2C938BD55550D0409ECE5F4430D38F370161D8318678FA25316587
SHA-512:	7C90F69A53E49BAD03C4CEFD9868B4C4BA145E5738218E8C445FF6AE5347153E3A2F2B918CBE184B0366AFD53B984634D2894FEA6F31A4603E58CCB6BFA5C625
Malicious:	false
Preview:	.PNG........IHDR...j...Z.......{.....IDATx...S`......V.4gzl.>.m.m.m.>c......8.J..p....k..i.k...f..v.VeG....V.^,.Y8>..U.(+...fbJ...q.G.kb#.T)F......~..&)+&....'..].~.j5....!.j.<..xJ..&.T91<.......3...\|.4.Uu...c..t..\<#S.........+...M?ew.(....w..h.c.PU.>.C.:.P..Wq...4..[.......k{TG.C.~.$=U..>.....4c+9.s...d.,...h...$.dk..0T3..63$.l.6...O.O..z..J..C...fjZ...i...J..P-T.B5-T..PM..B5-T.B.PM..P-T.B5.].....9...cZ../.b.I....Z..\......^...(..............u.G..O.c.....`k....qx/..U-.U..0.[.:..$.......fx5.l..h..g..O'9..%.E=...x&.P.....?R.\..../.......s.-MU..U..o..Q.1.%.l.gb.....I.zxD..t.&.u[.:R.N..:.d.............].{..z.M..-}Sw@b....[.D..#1$s.I..0..L....I.....i.Z....... MZ...j....i.Z...jZ...i.....jZ...i......z"/...._....q...gU.b.IHO.5....,n........PX..$.._.9(Mw..D../.C......l.....x..Q\|...(..$#../.....GB...7bS..B..G.....Tb.Yx6^.9..C.F..oMrx..p..<N3.=.1...$.....-N.t.jt6..&..J...G..z!..Ff.i...v._..a.....R%I....f....t....._..5.l...A..C.=c(V..)......0$.jg..KT..*E.r

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (736)
Category:	downloaded
Size (bytes):	3506
Entropy (8bit):	5.552607887805469
Encrypted:	false
SSDEEP:	96:86yHtxMPvVSbAtxNYiSJ6vq67scSlIcBfGx:FwIOT6LsHIIc
MD5:	593442F87585F1132C36467C73BFE543
SHA1:	BA98753092124B479848B1E1F21E6061AA2AF023
SHA-256:	AC97464705BCFF9AF73D579E851C12940AAF8C11B31B6306B1C1163CEE904CCA
SHA-512:	0552B2EC488E8C5BC03EE6A5A861D202980309E6C99B35891EEAD33319054BB91CA439ECF8C5E1402EC51AB30399F5265BB63838A5249A3487EDBA30F2807417
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.atEDuNh539g.es5.O/ck=boq-one-google.OneGoogleWidgetUi.tmXdt9lP4MI.L.B1.O/am=EGDQuQMg/d=1/exm=A7fCU,BVgquf,COQbmf,EEDORb,EFQ78c,GkRiKb,IZT63,JNoxi,KG2eXe,KUM7Z,L1AAkb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,PrPYRd,QIhFr,RMhBfe,RqjULd,SdcwHb,SpsfSb,U0aPgd,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,VwDzFe,XVMNvd,Z5uLle,ZfAoz,ZwDk9d,_b,_tp,aDfbSd,aW3pY,aurFic,bm51tf,byfTOb,e5qFLc,fKUV3e,gychg,hKSk3e,hc6Ubd,kWgXee,kjKdXe,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,n73qwf,ovKuLd,pjICDe,pw70Gc,s39S4,w9hDv,wmnU7d,ws9Tlc,xQtZb,xUdipf,yDVVkb,zbML3c,zr1jrb/excm=_b,_tp,appwidgetnoauthview/ed=1/wt=2/ujg=1/rs=AM-SdHuoOol6PGq-lFlTYeoE9lb9o902mQ/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:QIhFr;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:GkRiKb/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
Preview:	"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi\|\|{};(function(_){var window=this;.try{._.q("Wt6vjf");.var uy=function(a){this.ua=_.x(a,0,uy.ob)};_.G(uy,_.C);uy.prototype.Ya=function(){return _.nk(this,1)};uy.prototype.oc=function(a){_.Fk(this,1,a)};uy.ob="f.bo";var vy=function(){_.ln.call(this)};_.G(vy,_.ln);vy.prototype.mb=function(){this.Fq=!1;wy(this);_.ln.prototype.mb.call(this)};vy.prototype.j=function(){xy(this);if(this.Tj)return yy(this),!1;if(!this.Qr)return zy(this),!0;this.dispatchEvent("p");if(!this.So)return zy(this),!0;this.Nn?(this.dispatchEvent("r"),zy(this)):yy(this);return!1};.var Ay=function(a){var b=new _.mt(a.gx);null!=a.Ip&&b.l.set("authuser",a.Ip);return b},yy=function(a){a.Tj=!0;var b=Ay(a),c="rt=r&f_uid="+_.mi(a.So);_.Qo(b,(0,_.E)(a.l,a),"POST",c)};.vy.prototype.l=function(a){a=a.target;xy(this);if(_.Xo(a)){this.Pm=0;if(this.Nn)this.Tj=!1,this.dispatchEvent("r");else if(this.Qr)this.dispatchEvent("s");else{try{var b=_.Yo(a),c=JSON.pars

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1657)
Category:	downloaded
Size (bytes):	264743
Entropy (8bit):	5.479126042995795
Encrypted:	false
SSDEEP:	3072:XdPMHc2NQzfk5eINolYDt6QYGfOvNoK42TCboc:yNQz4NolQwQz2lVZmboc
MD5:	951F5CB1728D3C62E6006801A61D2BE3
SHA1:	3B9B0CD9203226263F8E32B336ADC5532E54A308
SHA-256:	A50889187D77C8E3E0439A0D5C155159EAA7A3DBEC35111D7131EC88C0A228F7
SHA-512:	E030EBF4A1683F176C1873DAD0B717D307253CC0EA1D40BF39F22E3B95C71FCD58907A6B1DFE9F9740FBE1303C59DF1FE70E4B102BFA86269EC49AAA29664FB8
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.atEDuNh539g.es5.O/ck=boq-one-google.OneGoogleWidgetUi.tmXdt9lP4MI.L.B1.O/am=EGDQuQMg/d=1/exm=_b,_tp/excm=_b,_tp,appwidgetnoauthview/ed=1/wt=2/ujg=1/rs=AM-SdHuoOol6PGq-lFlTYeoE9lb9o902mQ/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:QIhFr;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:GkRiKb/m=ws9Tlc,n73qwf,GkRiKb,e5qFLc,IZT63,UUJqVe,O1Gjze,byfTOb,lsjVmc,xUdipf,OTA3Ae,COQbmf,fKUV3e,aurFic,U0aPgd,ZwDk9d,V3dDOb,mI3LFb,aDfbSd,O6y8ed,PrPYRd,MpJwZc,LEikZe,NwH0H,OmgaI,lazG7b,XVMNvd,L1AAkb,KUM7Z,Mlhmy,s39S4,lwddkf,gychg,w9hDv,EEDORb,RMhBfe,SdcwHb,aW3pY,pw70Gc,EFQ78c,Ulmmrd,ZfAoz,mdR7q,wmnU7d,xQtZb,JNoxi,kWgXee,MI6k7c,kjKdXe,BVgquf,QIhFr,ovKuLd,hKSk3e,yDVVkb,hc6Ubd,SpsfSb,KG2eXe,Z5uLle,MdUzUe,VwDzFe,zbML3c,A7fCU,zr1jrb,Uas9Hd,pjICDe"
Preview:	"use strict";_F_installCss(".KL4X6e{background:#eee;bottom:0;left:0;opacity:0;position:absolute;right:0;top:0}.TuA45b{opacity:.8}sentinel{}");.this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi\|\|{};(function(_){var window=this;.try{.var Ky;_.Cy=function(a,b,c,d,e,f,g){a=a.ua;var h=(0,_.Wc)(a);_.lc(h);b=_.rd(a,h,c,b,2,f,!0);c=null!=d?d:new c;if(g&&("number"!==typeof e\|\|0>e\|\|e>b.length))throw Error();void 0!=e?b.splice(e,g,c):b.push(c);(0,_.jc)(c.ua)&2?(0,_.gk)(b,8):(0,_.gk)(b,16)};_.Qr.prototype.Mb=_.ca(28,function(){if(0<this.ub.length){var a=this.ub[0];if("textContent"in a)return(0,_.Eh)(a.textContent);if("innerText"in a)return(0,_.Eh)(a.innerText)}return""});._.Qr.prototype.kc=_.ca(27,function(){return 0==this.ub.length?null:new _.M(this.ub[0])});_.M.prototype.kc=_.ca(26,function(){return this});_.Qr.prototype.Ka=_.ca(25,function(){return this.ub.length?this.ub[0]:null});_.M.prototype.Ka=_.ca(24,function(){return this.ub[0]});_.Dy=function(a,b,c){if(!b&&!c)return null;var

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2124)
Category:	downloaded
Size (bytes):	121628
Entropy (8bit):	5.506662476672723
Encrypted:	false
SSDEEP:	3072:QI9yvwslCsrCF9f/U2Dj3Fkk7rEehA5L1kx:l9ygsrieDkVaL1kx
MD5:	F46ACD807A10216E6EEE8EA51E0F14D6
SHA1:	4702F47070F7046689432DCF605F11364BC0FBED
SHA-256:	D6B84873D27E7E83CF5184AAEF778F1CCB896467576CD8AF2CAD09B31B3C6086
SHA-512:	811263DC85C8DAA3A6E5D8A002CCCB953CD01E6A77797109835FE8B07CABE0DEE7EB126274E84266229880A90782B3B016BA034E31F0E3B259BF9E66CA797028
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	5.249530958699059
Encrypted:	false
SSDEEP:	24:hY6svN/6zSU6pedQf3Zvcn1BZdAe1nCr1LTHI5z1sW:3qN/2+pUAew85zf
MD5:	FBE36EB2EECF1B90451A3A72701E49D2
SHA1:	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
SHA-256:	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
SHA-512:	7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2956)
Category:	downloaded
Size (bytes):	18834
Entropy (8bit):	5.407489764960331
Encrypted:	false
SSDEEP:	384:aRFPTuu4q5oOTm1j8B0K5WXv/8bU2wnO/mgzI4QSIZ0n9vDBTTY0TXCnh/9Clf9c:a/Tuu4q5oOTLB0K5WXv/8bU2wnO/mgze
MD5:	676CD2F5702D832A1E3E2F08257FEB37
SHA1:	1019B84107A8F84A77A651BDCBE0A7F425DE3661
SHA-256:	F58B6E0D4393A8BB15423EC49867875FB38EB820E0A7D13A7E80F4DCE7EB342E
SHA-512:	FF43FA6A37CE55F660052AE71F9301064638BC6D14F0DE8161E3E4E9C66D7CC5BE72D752540031BFF801228F905DDBA515DFAE15DFC6AAAC0654691C2A0AE365
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.atEDuNh539g.es5.O/ck=boq-one-google.OneGoogleWidgetUi.tmXdt9lP4MI.L.B1.O/am=EGDQuQMg/d=1/exm=A7fCU,BVgquf,COQbmf,EEDORb,EFQ78c,GkRiKb,IZT63,JNoxi,KG2eXe,KUM7Z,L1AAkb,LEikZe,MI6k7c,MdUzUe,Mlhmy,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,PrPYRd,QIhFr,RMhBfe,SdcwHb,SpsfSb,U0aPgd,UUJqVe,Uas9Hd,Ulmmrd,V3dDOb,VwDzFe,XVMNvd,Z5uLle,ZfAoz,ZwDk9d,_b,_tp,aDfbSd,aW3pY,aurFic,byfTOb,e5qFLc,fKUV3e,gychg,hKSk3e,hc6Ubd,kWgXee,kjKdXe,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,n73qwf,ovKuLd,pjICDe,pw70Gc,s39S4,w9hDv,wmnU7d,ws9Tlc,xQtZb,xUdipf,yDVVkb,zbML3c,zr1jrb/excm=_b,_tp,appwidgetnoauthview/ed=1/wt=2/ujg=1/rs=AM-SdHuoOol6PGq-lFlTYeoE9lb9o902mQ/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:QIhFr;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:O1Gjze;xqZiqf:wmnU7d;yxTchf:KUM7Z;zxnPse:GkRiKb/m=RqjULd"
Preview:	"use strict";this.default_OneGoogleWidgetUi=this.default_OneGoogleWidgetUi\|\|{};(function(_){var window=this;.try{._.q("RqjULd");.var sha=function(a){if(_.n&&_.n.performance&&_.n.performance.memory){var b=_.n.performance.memory;if(b){var c=new cF;isNaN(b.jsHeapSizeLimit)\|\|_.ae(c,1,_.Ec(Math.round(b.jsHeapSizeLimit).toString()));isNaN(b.totalJSHeapSize)\|\|_.ae(c,2,_.Ec(Math.round(b.totalJSHeapSize).toString()));isNaN(b.usedJSHeapSize)\|\|_.ae(c,3,_.Ec(Math.round(b.usedJSHeapSize).toString()));_.sk(a,cF,1,c)}}},tha=function(a){if(dF()){var b=performance.getEntriesByType("navigation");if(b&&b.length){var c=new eF;if(b=b[0]){switch(b.type){case "navigate":c.tg(1);.break;case "reload":c.tg(2);break;case "back_forward":c.tg(3);break;case "prerender":c.tg(4);break;default:c.tg(0)}var d=_.Gk(c,2,Math.round(b.startTime));d=_.Gk(d,3,Math.round(b.fetchStart));d=_.Gk(d,4,Math.round(b.domainLookupStart));d=_.Gk(d,5,Math.round(b.domainLookupEnd));d=_.Gk(d,6,Math.round(b.connectStart));d=_.Gk(d,7,Math.ro

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (21072)
Category:	downloaded
Size (bytes):	53487
Entropy (8bit):	5.7389274800710295
Encrypted:	false
SSDEEP:	768:+ImEghhvpu75y1C6kb02aFe04FV6HbWb1wYpIZQzFJ/N4SxkAyvA:RA1CwbW+mI019xovA
MD5:	6CD454A7EC68230B6D021CA33F5D1C9D
SHA1:	DE2D3D027A71FEC4FC9E1E8598D8511526D7BAA0
SHA-256:	AA5809F08CA7433146FC57994CF863787C8E5FBF86C34DC7267E26E010FBDD9F
SHA-512:	0D46D5C49037D0C8DB4069D18F5CCB54E8AFFC9CC7406EB1C60BDF3FBE7647C0A98C0AF7C528675F80871BA0D4ABC88B3DCB4AB3D269ADEE5AEB4337F13BA044
Malicious:	false
URL:	https://ogs.google.com/widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en
Preview:	<!doctype html><html lang="en" dir="ltr"><head><base href="https://ogs.google.com/"><link ref="preconnect" href="//www.gstatic.com"><meta name="referrer" content="origin"><link rel="canonical" href="https://ogs.google.com/widget/app/so"><link rel="preconnect" href="https://www.gstatic.com"><link rel="preconnect" href="https://ssl.gstatic.com"><script data-id="_gd" nonce="ANFaue5R-ScgTYax3LfSMg">window.WIZ_global_data = {"DpimGf":false,"EP1ykd":["/_/*"],"FdrFJe":"1553026729349046999","Im6cmf":"/_/OneGoogleWidgetUi","LVIXXb":1,"LoQv7e":true,"MT7f9b":[],"NrSucd":false,"OwAJ6e":false,"QrtxK":"","S06Grb":"","S6lZl":128566913,"TSDtV":"%.@.[[null,[[45459555,null,false,null,null,null,\"Imeoqb\"]],\"CAMSEx0W2eicEJbkAdysuBIIgvnaBgg\\u003d\"]]]","Vvafkd":false,"Yllh3e":"%.@.1714828903450540,174279443,2869475043]","ZwjLXe":243,"cfb2h":"boq_onegooglehttpserver_20240430.01_p1","eptZe":"/_/OneGoogleWidgetUi/","fPDxwd":[48691166,48802160,93880156,97517170],"gGcLoe":false,"nQyAE":{},"qwAQke":"OneGoogle

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.644490421223367
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OgcktrbHkI.exe
File size:	334'336 bytes
MD5:	35f519000ad078d242c0bce097c59b31
SHA1:	41a3c859c36a4240a51e6ce17ab269e8d2728eb0
SHA256:	1dc79692db8709e88fee042c5555f8432dc4638442887d8150b8b7c67f5f3eb2
SHA512:	260f2efe4757c518f96269ba3a3fd5b5c603fa6a52d9c0d976222158609911004ce48df4e75298c11de67ea29d91969f217986e4c0f1b83bb2f5d2a43a772997
SSDEEP:	3072:KLTZ5XJKQsp6NU4tqwCyc40r+oeHpmCR54kDSWegJSVE+Er20L4fdoiKuIov5QId:KbCt44p40rqHPbDb86r2LiNovrb/a
TLSH:	53645A83E3D17D51E5268B32AE1F86E4366DF9618E1D7B2F722CAA1F14700B1C263B51
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........r.....................................................?g..............?g......Rich....................PE..L...r..d...........

File Icon


Icon Hash:	53256551494d710d

Static PE Info

General

Entrypoint:	0x4040e2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6482FD72 [Fri Jun 9 10:22:42 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	8c46e70ae529243985f9b527b4223811

Entrypoint Preview

Instruction
call 00007F893D0928E5h
jmp 00007F893D08D564h
cmp ecx, dword ptr [00419408h]
jne 00007F893D08D6E4h
rep ret
jmp 00007F893D092E75h
push ebp
mov ebp, esp
sub esp, 20h
push esi
push edi
push 00000008h
pop ecx
mov esi, 00413058h
lea edi, dword ptr [ebp-20h]
rep movsd
mov esi, dword ptr [ebp+0Ch]
mov edi, dword ptr [ebp+08h]
test esi, esi
je 00007F893D08D6F5h
test byte ptr [esi], 00000010h
je 00007F893D08D6F0h
mov ecx, dword ptr [edi]
sub ecx, 04h
push ecx
mov eax, dword ptr [ecx]
mov esi, dword ptr [eax+18h]
call dword ptr [eax+20h]
mov dword ptr [ebp-08h], edi
mov dword ptr [ebp-04h], esi
test esi, esi
je 00007F893D08D6EEh
test byte ptr [esi], 00000008h
je 00007F893D08D6E9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [004120B8h]
pop edi
pop esi
mov esp, ebp
pop ebp
retn 0008h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00419408h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push ebp
mov ebp, esp
push esi
cld
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [esi+08h]
xor ecx, esi
call 00007F893D08D62Bh
push 00000000h
push esi

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x184e4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15f8000	0x22d30	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x18520	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x179b8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x12000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10c65	0x10e00	ca2ae006464ad4dd687d4cdac0431d31	False	0.6018807870370371	data	6.696247910531625	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x6db8	0x6e00	b527d95631608a07ca0f092f718a1ae6	False	0.3915127840909091	data	4.749698531330876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x15de6c0	0x16c00	9c9c168a9495ea7819ef496b9e57a22d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x15f8000	0x22d30	0x22e00	70695cd905c427d7b1b95218c3fbb214	False	0.45000980062724016	data	5.271554303929021	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_CURSOR	0x1617ca8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.26439232409381663
RT_CURSOR	0x1618b50	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.3686823104693141
RT_CURSOR	0x16193f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.49060693641618497
RT_ICON	0x15f8a90	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.3696695095948827
RT_ICON	0x15f9938	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.45938628158844763
RT_ICON	0x15fa1e0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.45564516129032256
RT_ICON	0x15fa8a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.45447976878612717
RT_ICON	0x15fae10	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.2687759336099585
RT_ICON	0x15fd3b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.3062851782363977
RT_ICON	0x15fe460	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.35815602836879434
RT_ICON	0x15fe930	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.56636460554371
RT_ICON	0x15ff7d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.5473826714801444
RT_ICON	0x1600080	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.6170520231213873
RT_ICON	0x16005e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.4628630705394191
RT_ICON	0x1602b90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.48827392120075047
RT_ICON	0x1603c38	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.49631147540983606
RT_ICON	0x16045c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.449468085106383
RT_ICON	0x1604a90	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.4256396588486141
RT_ICON	0x1605938	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.4927797833935018
RT_ICON	0x16061e0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.5921658986175116
RT_ICON	0x16068a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.5180635838150289
RT_ICON	0x1606e10	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.46856846473029046
RT_ICON	0x16093b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.4821763602251407
RT_ICON	0x160a460	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.48565573770491804
RT_ICON	0x160ade8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.5212765957446809
RT_ICON	0x160b2c8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.49173773987206826
RT_ICON	0x160c170	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.4684115523465704
RT_ICON	0x160ca18	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.440028901734104
RT_ICON	0x160cf80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.2794605809128631
RT_ICON	0x160f528	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.2879924953095685
RT_ICON	0x16105d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.3061475409836066
RT_ICON	0x1610f58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.33156028368794327
RT_ICON	0x1611428	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.4107142857142857
RT_ICON	0x16122d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.5947653429602888
RT_ICON	0x1612b78	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.6509216589861752
RT_ICON	0x1613240	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.6329479768786127
RT_ICON	0x16137a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.5797717842323652
RT_ICON	0x1615d50	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.6186679174484052
RT_ICON	0x1616df8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.589344262295082
RT_ICON	0x1617780	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.6835106382978723
RT_DIALOG	0x1619c18	0x5a	data	0.8666666666666667
RT_STRING	0x1619c78	0x4b2	data	0.44342762063227953
RT_STRING	0x161a130	0x56a	data	0.4379509379509379
RT_STRING	0x161a6a0	0x68e	data	0.4237187127532777
RT_ACCELERATOR	0x1617c60	0x48	data	0.8333333333333334
RT_GROUP_CURSOR	0x1619960	0x30	data	0.9375
RT_GROUP_ICON	0x1604a28	0x68	data	0.7019230769230769
RT_GROUP_ICON	0x15fe8c8	0x68	data	0.6826923076923077
RT_GROUP_ICON	0x160b250	0x76	data	0.6779661016949152
RT_GROUP_ICON	0x1617be8	0x76	data	0.6694915254237288
RT_GROUP_ICON	0x16113c0	0x68	data	0.7211538461538461
RT_VERSION	0x1619990	0x284	data	0.5295031055900621

Imports

DLL

Import

KERNEL32.dll

GlobalMemoryStatus, SetComputerNameExA, CommConfigDialogA, LoadLibraryExW, InterlockedIncrement, GetConsoleAliasA, InterlockedDecrement, GetComputerNameW, BackupSeek, GetModuleHandleW, GetWindowsDirectoryA, EnumTimeFormatsA, SetCommState, GlobalAlloc, GetSystemDirectoryW, GlobalFindAtomA, LoadLibraryW, GetLocaleInfoW, CreateEventA, GetACP, GetConsoleOutputCP, GetLastError, SetLastError, GetProcAddress, LockFileEx, SetComputerNameA, SetFileAttributesA, BuildCommDCBW, WriteConsoleA, CreateHardLinkW, SetConsoleCtrlHandler, AddAtomA, GetModuleFileNameA, VirtualProtect, GetVersionExA, ReadConsoleInputW, GetCurrentProcessId, GetTempPathA, GetVolumeInformationW, LocalFileTimeToFileTime, CloseHandle, WriteConsoleW, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineW, RaiseException, RtlUnwind, HeapFree, HeapAlloc, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, HeapSize, IsDebuggerPresent, EnterCriticalSection, LeaveCriticalSection, ReadFile, GetConsoleMode, ReadConsoleW, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, SetFilePointerEx, GetCurrentThreadId, GetProcessHeap, GetModuleFileNameW, WriteFile, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, IsValidCodePage, GetOEMCP, GetCPInfo, HeapReAlloc, SetStdHandle, LCMapStringW, GetConsoleCP, FlushFileBuffers, OutputDebugStringW, GetStringTypeW, CreateFileW

USER32.dll

ChangeMenuA

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 15:20:50.803286076 CEST	49678	443	192.168.2.4	104.46.162.224
May 4, 2024 15:20:50.975805044 CEST	49675	443	192.168.2.4	173.222.162.32
May 4, 2024 15:20:59.840543032 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.840572119 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:20:59.840624094 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.841167927 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.841176987 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:20:59.841227055 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.841358900 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.841387033 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:20:59.841434956 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.841698885 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.841726065 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:20:59.841777086 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.844533920 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.844551086 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:20:59.844913960 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.844923973 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:20:59.845298052 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.845305920 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:20:59.845685005 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:20:59.845700979 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.156265020 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.159094095 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.160001040 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.160922050 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.273819923 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.289328098 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.289331913 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.289391041 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.588893890 CEST	49675	443	192.168.2.4	173.222.162.32
May 4, 2024 15:21:00.751188040 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.751214027 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.752995014 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.753004074 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.753051996 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.797452927 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.797468901 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.798654079 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.798665047 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.798718929 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.846596956 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.846615076 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.847564936 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.847592115 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.847635031 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.894514084 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:00.894536972 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.895486116 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.895498037 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:21:00.895550966 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.088009119 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.088176012 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.093605995 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.093703985 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.096170902 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.096235037 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.097778082 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.097795010 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.099266052 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.099332094 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.100251913 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.100263119 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.101059914 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.101069927 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.101692915 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.101710081 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.193092108 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.193108082 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.193114042 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.259799004 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.273360968 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.273488045 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.273540974 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.275028944 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.275098085 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.275125027 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.275135040 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.275156021 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.275192976 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.277451992 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.277606010 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.277643919 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.278358936 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.278979063 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.279021025 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.286144018 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.286192894 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.286225080 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.286231041 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.286278009 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.286309958 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.286313057 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.286365986 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.286397934 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.286401033 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.296487093 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.296530962 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.296534061 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.306653976 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.306740999 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.306746960 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.311945915 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.312004089 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.312006950 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.380583048 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.380592108 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.435518026 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.435578108 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.435583115 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.440886021 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.440942049 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.440946102 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.451138020 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.451184034 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.451186895 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.463265896 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.463310957 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.463315010 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.473836899 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.473896980 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.473900080 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.483197927 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.483253002 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.483257055 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.492229939 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.492276907 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.492280006 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.501364946 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.501420975 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.501425028 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.510776043 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.510848045 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.510850906 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.520215034 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.520266056 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.520268917 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.529644012 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.529695988 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.529697895 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.548505068 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.548554897 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.548557997 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.553236008 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.553283930 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.553286076 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.579363108 CEST	49733	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.579380989 CEST	443	49733	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.586968899 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.587008953 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.587013006 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.590413094 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.590451956 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.590455055 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.597660065 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.597686052 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.597925901 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.597964048 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.597966909 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.605210066 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.605247021 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.605251074 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.607749939 CEST	49734	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.607759953 CEST	443	49734	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.612076998 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.612118006 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.612121105 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.618951082 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.618987083 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.618989944 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.625843048 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.625883102 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.625885010 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.632689953 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.632730961 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.632734060 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.639538050 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.639581919 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.639585972 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.646375895 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.646420956 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.646424055 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.653261900 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.653301001 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.653302908 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.663568974 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.663602114 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.663604975 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.670398951 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.670433044 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.670435905 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.677290916 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.677329063 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.677333117 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.677340031 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.677375078 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.684192896 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.691019058 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.691051006 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.691055059 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.697904110 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.697937012 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.697940111 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.704574108 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.704606056 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.704607964 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.710882902 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.710912943 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.710916042 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.717206001 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.717247963 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.717250109 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.723238945 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.723268986 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.723272085 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.729161024 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.729195118 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.729202986 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.729207993 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.729243994 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.735122919 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.741141081 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.741183996 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.741189003 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.744177103 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.744220018 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.744223118 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.750116110 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.750158072 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.750159979 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.756131887 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.756174088 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.756175995 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.759845018 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.759886026 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.759887934 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.763510942 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.763555050 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.763557911 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.767170906 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.767218113 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.767220974 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.770838022 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.770881891 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.770884037 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.774375916 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.774421930 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.774424076 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.777911901 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.777954102 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.777956963 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.781440020 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.781476974 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.781478882 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.784919977 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.784964085 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.784966946 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.788310051 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.788345098 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.788347960 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.788443089 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:01.788479090 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.788764954 CEST	49735	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:01.788774967 CEST	443	49735	142.250.217.132	192.168.2.4
May 4, 2024 15:21:02.945353985 CEST	49743	25	192.168.2.4	104.47.53.36
May 4, 2024 15:21:03.366069078 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.366136074 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.366229057 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.366419077 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.366451979 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.668523073 CEST	49745	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:03.668544054 CEST	443	49745	142.250.217.132	192.168.2.4
May 4, 2024 15:21:03.668772936 CEST	49745	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:03.668992996 CEST	49745	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:03.669006109 CEST	443	49745	142.250.217.132	192.168.2.4
May 4, 2024 15:21:03.679744005 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.685674906 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.685689926 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.686547041 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.686616898 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.755160093 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.755223036 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.755249023 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.800121069 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.818067074 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.818073988 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.865001917 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.974328995 CEST	49743	25	192.168.2.4	104.47.53.36
May 4, 2024 15:21:03.978516102 CEST	443	49745	142.250.217.132	192.168.2.4
May 4, 2024 15:21:03.983496904 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.983542919 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.983575106 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.983587980 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.983596087 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.983623981 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.983643055 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.983648062 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.986278057 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.986284018 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.993876934 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:03.995273113 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:03.995279074 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.004391909 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.007379055 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.007384062 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.014842987 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.019366980 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.019372940 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.036741972 CEST	49745	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:04.083607912 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.083612919 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.130477905 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.133053064 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.138201952 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.138230085 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.138369083 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.138375998 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.138421059 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.148663044 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.159275055 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.159301043 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.159343958 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.159352064 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.159502983 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.169616938 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.180119038 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.180136919 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.180282116 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.180289030 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.180334091 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.190567970 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.200284004 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.200313091 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.200458050 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.200465918 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.200522900 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.210134983 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.219794989 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.219818115 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.219973087 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.219979048 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.220024109 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.229548931 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.241556883 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.241588116 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.241730928 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.241738081 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.241802931 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.249039888 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.263051033 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.263098001 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.263251066 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.263257027 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.263302088 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.284926891 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.287302017 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.287333965 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.287473917 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.287482023 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.287524939 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.296026945 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.304402113 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.304433107 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.304483891 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.304490089 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.304651022 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.312494040 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.320429087 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.320456028 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.320611954 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.320617914 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.320664883 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.327651024 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.335490942 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.335525036 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.335575104 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.335582018 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.335743904 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.344743967 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.352649927 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.352679014 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.352824926 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.352832079 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.352873087 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.359167099 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.363027096 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.367275000 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.367280960 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.370635986 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.373399973 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.373405933 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.378288031 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.379275084 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.379281044 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.385056973 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.385112047 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.385117054 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.391838074 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.394300938 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.394306898 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.398703098 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.403295994 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.403301954 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.405220985 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.406402111 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.406408072 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.411561966 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.411612034 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.411617994 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.423572063 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.423604965 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.423772097 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.423779011 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.423826933 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.429591894 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.435523987 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.435575962 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.435713053 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.435720921 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.435764074 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.441288948 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.444256067 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.445274115 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.445280075 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.450052023 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.451384068 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.451390028 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.453712940 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.454282999 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.454288006 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.457329035 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.460946083 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.460974932 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.460992098 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.460999012 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.461020947 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.464551926 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.464613914 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.464656115 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.859121084 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.859457970 CEST	49745	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:04.859477997 CEST	443	49745	142.250.217.132	192.168.2.4
May 4, 2024 15:21:04.859858990 CEST	443	49745	142.250.217.132	192.168.2.4
May 4, 2024 15:21:04.860547066 CEST	49745	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:04.860604048 CEST	443	49745	142.250.217.132	192.168.2.4
May 4, 2024 15:21:04.895205975 CEST	49744	443	192.168.2.4	142.250.176.14
May 4, 2024 15:21:04.895216942 CEST	443	49744	142.250.176.14	192.168.2.4
May 4, 2024 15:21:04.911470890 CEST	49745	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:05.974586964 CEST	49743	25	192.168.2.4	104.47.53.36
May 4, 2024 15:21:06.000761986 CEST	49748	443	192.168.2.4	109.107.161.150
May 4, 2024 15:21:06.000782013 CEST	443	49748	109.107.161.150	192.168.2.4
May 4, 2024 15:21:06.000869036 CEST	49748	443	192.168.2.4	109.107.161.150
May 4, 2024 15:21:09.990716934 CEST	49743	25	192.168.2.4	104.47.53.36
May 4, 2024 15:21:12.971812963 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:12.971841097 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:12.971915007 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:12.972873926 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:12.972887993 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:13.526290894 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:13.526365042 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:13.528765917 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:13.528774977 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:13.528978109 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:13.736123085 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:13.736174107 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:13.996234894 CEST	443	49745	142.250.217.132	192.168.2.4
May 4, 2024 15:21:13.996293068 CEST	443	49745	142.250.217.132	192.168.2.4
May 4, 2024 15:21:13.996361971 CEST	49745	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:14.053172112 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:14.096117973 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:14.115614891 CEST	49745	443	192.168.2.4	142.250.217.132
May 4, 2024 15:21:14.115629911 CEST	443	49745	142.250.217.132	192.168.2.4
May 4, 2024 15:21:14.413738966 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:14.413757086 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:14.413769960 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:14.413810968 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:14.413822889 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:14.413835049 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:14.413836956 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:14.413861990 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:14.413867950 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:14.413880110 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:14.413949013 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:14.413986921 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:14.746140957 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:14.746151924 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:14.746182919 CEST	49751	443	192.168.2.4	20.114.59.183
May 4, 2024 15:21:14.746187925 CEST	443	49751	20.114.59.183	192.168.2.4
May 4, 2024 15:21:17.991318941 CEST	49743	25	192.168.2.4	104.47.53.36
May 4, 2024 15:21:23.260438919 CEST	49757	25	192.168.2.4	67.195.228.110
May 4, 2024 15:21:24.271121979 CEST	49757	25	192.168.2.4	67.195.228.110
May 4, 2024 15:21:26.270936966 CEST	49757	25	192.168.2.4	67.195.228.110
May 4, 2024 15:21:30.286809921 CEST	49757	25	192.168.2.4	67.195.228.110
May 4, 2024 15:21:38.302359104 CEST	49757	25	192.168.2.4	67.195.228.110
May 4, 2024 15:21:42.865564108 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:42.865592003 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:42.865664959 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:42.865910053 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:42.865923882 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.174560070 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.174823999 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.174834967 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.175139904 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.175199986 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.175755024 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.175806046 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.180577993 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.180634975 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.180733919 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.180741072 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.225277901 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.569185972 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.569204092 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.569272041 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.569284916 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.579473972 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.579540014 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.579546928 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.580976963 CEST	49759	25	192.168.2.4	74.125.137.26
May 4, 2024 15:21:43.590049028 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.590116978 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.590123892 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.600502968 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.600562096 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.600568056 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.610980034 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.611031055 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.611037016 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.621459961 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.621512890 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.621517897 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.631952047 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.632000923 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.632006884 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.677205086 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.718463898 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.718511105 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.723653078 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.723710060 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.734138966 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.734206915 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.744653940 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.744728088 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.755121946 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.755182981 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.765577078 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.765631914 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.776082039 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.776129961 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.776134968 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.776160955 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.776221991 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.776227951 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.786556005 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.786624908 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.786631107 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.797063112 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.797120094 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.797126055 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.811785936 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.811811924 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.811850071 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.811856985 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.811892986 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.821126938 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.830460072 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.830485106 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.830529928 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.830537081 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.830579996 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.839829922 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.849144936 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.849172115 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.849208117 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.849212885 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.849255085 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.849260092 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.849280119 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:43.849335909 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.849517107 CEST	49758	443	192.168.2.4	142.250.72.174
May 4, 2024 15:21:43.849524021 CEST	443	49758	142.250.72.174	192.168.2.4
May 4, 2024 15:21:44.583539009 CEST	49759	25	192.168.2.4	74.125.137.26
May 4, 2024 15:21:46.005501032 CEST	49748	443	192.168.2.4	109.107.161.150
May 4, 2024 15:21:46.005558014 CEST	443	49748	109.107.161.150	192.168.2.4
May 4, 2024 15:21:46.005614996 CEST	49748	443	192.168.2.4	109.107.161.150
May 4, 2024 15:21:46.115487099 CEST	49765	443	192.168.2.4	109.107.161.150
May 4, 2024 15:21:46.115493059 CEST	443	49765	109.107.161.150	192.168.2.4
May 4, 2024 15:21:46.115555048 CEST	49765	443	192.168.2.4	109.107.161.150
May 4, 2024 15:21:46.593939066 CEST	49759	25	192.168.2.4	74.125.137.26
May 4, 2024 15:21:50.598898888 CEST	49759	25	192.168.2.4	74.125.137.26
May 4, 2024 15:21:51.345231056 CEST	49770	443	192.168.2.4	40.68.123.157
May 4, 2024 15:21:51.345257998 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:51.345340967 CEST	49770	443	192.168.2.4	40.68.123.157
May 4, 2024 15:21:51.345741987 CEST	49770	443	192.168.2.4	40.68.123.157
May 4, 2024 15:21:51.345755100 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:52.238426924 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:52.238495111 CEST	49770	443	192.168.2.4	40.68.123.157
May 4, 2024 15:21:52.242914915 CEST	49770	443	192.168.2.4	40.68.123.157
May 4, 2024 15:21:52.242923021 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:52.243160963 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:52.251466036 CEST	49770	443	192.168.2.4	40.68.123.157
May 4, 2024 15:21:52.292120934 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:53.120028019 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:53.120049000 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:53.120106936 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:53.120235920 CEST	49770	443	192.168.2.4	40.68.123.157
May 4, 2024 15:21:53.120261908 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:53.120332956 CEST	49770	443	192.168.2.4	40.68.123.157
May 4, 2024 15:21:53.127206087 CEST	49770	443	192.168.2.4	40.68.123.157
May 4, 2024 15:21:53.127223969 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:53.127239943 CEST	49770	443	192.168.2.4	40.68.123.157
May 4, 2024 15:21:53.127244949 CEST	443	49770	40.68.123.157	192.168.2.4
May 4, 2024 15:21:58.598862886 CEST	49759	25	192.168.2.4	74.125.137.26
May 4, 2024 15:22:03.725330114 CEST	49772	443	192.168.2.4	142.250.217.132
May 4, 2024 15:22:03.725356102 CEST	443	49772	142.250.217.132	192.168.2.4
May 4, 2024 15:22:03.725461006 CEST	49772	443	192.168.2.4	142.250.217.132
May 4, 2024 15:22:03.725675106 CEST	49772	443	192.168.2.4	142.250.217.132
May 4, 2024 15:22:03.725687981 CEST	443	49772	142.250.217.132	192.168.2.4
May 4, 2024 15:22:03.886938095 CEST	49773	25	192.168.2.4	217.69.139.150
May 4, 2024 15:22:04.033154011 CEST	443	49772	142.250.217.132	192.168.2.4
May 4, 2024 15:22:04.033446074 CEST	49772	443	192.168.2.4	142.250.217.132
May 4, 2024 15:22:04.033453941 CEST	443	49772	142.250.217.132	192.168.2.4
May 4, 2024 15:22:04.033735037 CEST	443	49772	142.250.217.132	192.168.2.4
May 4, 2024 15:22:04.034164906 CEST	49772	443	192.168.2.4	142.250.217.132
May 4, 2024 15:22:04.034225941 CEST	443	49772	142.250.217.132	192.168.2.4
May 4, 2024 15:22:04.083364964 CEST	49772	443	192.168.2.4	142.250.217.132
May 4, 2024 15:22:04.895889997 CEST	49773	25	192.168.2.4	217.69.139.150
May 4, 2024 15:22:06.895875931 CEST	49773	25	192.168.2.4	217.69.139.150
May 4, 2024 15:22:09.740679979 CEST	49723	80	192.168.2.4	23.206.229.76
May 4, 2024 15:22:09.740685940 CEST	49724	80	192.168.2.4	23.206.229.76
May 4, 2024 15:22:09.890600920 CEST	80	49724	23.206.229.76	192.168.2.4
May 4, 2024 15:22:09.890760899 CEST	49724	80	192.168.2.4	23.206.229.76
May 4, 2024 15:22:09.890806913 CEST	80	49723	23.206.229.76	192.168.2.4
May 4, 2024 15:22:09.890857935 CEST	49723	80	192.168.2.4	23.206.229.76
May 4, 2024 15:22:10.896810055 CEST	49773	25	192.168.2.4	217.69.139.150
May 4, 2024 15:22:14.032886028 CEST	443	49772	142.250.217.132	192.168.2.4
May 4, 2024 15:22:14.032946110 CEST	443	49772	142.250.217.132	192.168.2.4
May 4, 2024 15:22:14.033093929 CEST	49772	443	192.168.2.4	142.250.217.132
May 4, 2024 15:22:14.425909042 CEST	49772	443	192.168.2.4	142.250.217.132
May 4, 2024 15:22:14.425924063 CEST	443	49772	142.250.217.132	192.168.2.4
May 4, 2024 15:22:17.157304049 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:17.157363892 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:17.157460928 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:17.157691002 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:17.157697916 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:17.471966982 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:17.521872044 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.311526060 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.311547995 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.311970949 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.312033892 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.312587976 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.312648058 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.314632893 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.314692974 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.314930916 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.314939022 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.370073080 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.471287012 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.471354008 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.471402884 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.471903086 CEST	49774	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.471931934 CEST	443	49774	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.472887039 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.472923994 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.472984076 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.473356009 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.473371029 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.783845901 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.786875010 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.786887884 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.787214994 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.787277937 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.787815094 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.787864923 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.787976027 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.788033009 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.788120031 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.788132906 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.788146973 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.835338116 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:18.835345984 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:18.912066936 CEST	49773	25	192.168.2.4	217.69.139.150
May 4, 2024 15:22:19.117588043 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:19.117707014 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:19.117841959 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:19.120457888 CEST	49775	443	192.168.2.4	142.250.189.14
May 4, 2024 15:22:19.120479107 CEST	443	49775	142.250.189.14	192.168.2.4
May 4, 2024 15:22:19.278431892 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.278455973 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.278575897 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.279284954 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.279298067 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.587614059 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.587857008 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.587867975 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.588187933 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.588237047 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.588792086 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.588835955 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.588962078 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.589011908 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.589121103 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.589127064 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.630793095 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.898260117 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.898282051 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.898364067 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.898374081 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.899993896 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:19.900024891 CEST	443	49776	142.250.176.14	192.168.2.4
May 4, 2024 15:22:19.900084972 CEST	49776	443	192.168.2.4	142.250.176.14
May 4, 2024 15:22:26.130115032 CEST	49765	443	192.168.2.4	109.107.161.150
May 4, 2024 15:22:26.130188942 CEST	443	49765	109.107.161.150	192.168.2.4
May 4, 2024 15:22:26.130253077 CEST	49765	443	192.168.2.4	109.107.161.150
May 4, 2024 15:22:26.240277052 CEST	49777	443	192.168.2.4	109.107.161.150
May 4, 2024 15:22:26.240317106 CEST	443	49777	109.107.161.150	192.168.2.4
May 4, 2024 15:22:26.240402937 CEST	49777	443	192.168.2.4	109.107.161.150

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 15:20:59.688174963 CEST	59216	53	192.168.2.4	1.1.1.1
May 4, 2024 15:20:59.688174963 CEST	61116	53	192.168.2.4	1.1.1.1
May 4, 2024 15:20:59.760735989 CEST	53	53212	1.1.1.1	192.168.2.4
May 4, 2024 15:20:59.811029911 CEST	53	51826	1.1.1.1	192.168.2.4
May 4, 2024 15:20:59.839366913 CEST	53	61116	1.1.1.1	192.168.2.4
May 4, 2024 15:20:59.839405060 CEST	53	59216	1.1.1.1	192.168.2.4
May 4, 2024 15:21:01.753509045 CEST	53	63418	1.1.1.1	192.168.2.4
May 4, 2024 15:21:02.037156105 CEST	53	61391	1.1.1.1	192.168.2.4
May 4, 2024 15:21:02.709583044 CEST	57287	53	192.168.2.4	1.1.1.1
May 4, 2024 15:21:02.944638968 CEST	53	57287	1.1.1.1	192.168.2.4
May 4, 2024 15:21:03.210967064 CEST	49566	53	192.168.2.4	1.1.1.1
May 4, 2024 15:21:03.211328983 CEST	50952	53	192.168.2.4	1.1.1.1
May 4, 2024 15:21:03.361237049 CEST	53	49566	1.1.1.1	192.168.2.4
May 4, 2024 15:21:03.363080978 CEST	53	50952	1.1.1.1	192.168.2.4
May 4, 2024 15:21:05.197182894 CEST	64392	53	192.168.2.4	1.1.1.1
May 4, 2024 15:21:06.000072956 CEST	53	64392	1.1.1.1	192.168.2.4
May 4, 2024 15:21:19.764558077 CEST	53	51860	1.1.1.1	192.168.2.4
May 4, 2024 15:21:21.338567019 CEST	138	138	192.168.2.4	192.168.2.255
May 4, 2024 15:21:22.958383083 CEST	64663	53	192.168.2.4	1.1.1.1
May 4, 2024 15:21:23.108664036 CEST	53	64663	1.1.1.1	192.168.2.4
May 4, 2024 15:21:23.109292030 CEST	65141	53	192.168.2.4	1.1.1.1
May 4, 2024 15:21:23.259823084 CEST	53	65141	1.1.1.1	192.168.2.4
May 4, 2024 15:21:38.625904083 CEST	53	59734	1.1.1.1	192.168.2.4
May 4, 2024 15:21:42.713696957 CEST	50848	53	192.168.2.4	1.1.1.1
May 4, 2024 15:21:42.713850021 CEST	61986	53	192.168.2.4	1.1.1.1
May 4, 2024 15:21:42.864095926 CEST	53	50848	1.1.1.1	192.168.2.4
May 4, 2024 15:21:42.865144014 CEST	53	61986	1.1.1.1	192.168.2.4
May 4, 2024 15:21:43.271225929 CEST	55440	53	192.168.2.4	1.1.1.1
May 4, 2024 15:21:43.423000097 CEST	53	55440	1.1.1.1	192.168.2.4
May 4, 2024 15:21:43.423614979 CEST	54697	53	192.168.2.4	1.1.1.1
May 4, 2024 15:21:43.574397087 CEST	53	54697	1.1.1.1	192.168.2.4
May 4, 2024 15:21:43.733818054 CEST	53	50751	1.1.1.1	192.168.2.4
May 4, 2024 15:21:45.001261950 CEST	53	57548	1.1.1.1	192.168.2.4
May 4, 2024 15:21:46.302423954 CEST	53	61985	1.1.1.1	192.168.2.4
May 4, 2024 15:21:59.235908031 CEST	53	56510	1.1.1.1	192.168.2.4
May 4, 2024 15:22:01.313009977 CEST	53	57552	1.1.1.1	192.168.2.4
May 4, 2024 15:22:03.583894968 CEST	59522	53	192.168.2.4	1.1.1.1
May 4, 2024 15:22:03.734599113 CEST	53	59522	1.1.1.1	192.168.2.4
May 4, 2024 15:22:03.735274076 CEST	62346	53	192.168.2.4	1.1.1.1
May 4, 2024 15:22:03.886388063 CEST	53	62346	1.1.1.1	192.168.2.4
May 4, 2024 15:22:16.987966061 CEST	50872	53	192.168.2.4	1.1.1.1
May 4, 2024 15:22:16.988145113 CEST	65275	53	192.168.2.4	1.1.1.1
May 4, 2024 15:22:17.139319897 CEST	53	50872	1.1.1.1	192.168.2.4
May 4, 2024 15:22:17.139729023 CEST	53	65275	1.1.1.1	192.168.2.4
May 4, 2024 15:22:19.126493931 CEST	65379	53	192.168.2.4	1.1.1.1
May 4, 2024 15:22:19.126653910 CEST	52814	53	192.168.2.4	1.1.1.1
May 4, 2024 15:22:19.276923895 CEST	53	65379	1.1.1.1	192.168.2.4
May 4, 2024 15:22:19.277420044 CEST	53	52814	1.1.1.1	192.168.2.4
May 4, 2024 15:22:27.676461935 CEST	53	64314	1.1.1.1	192.168.2.4
May 4, 2024 15:22:42.647651911 CEST	53087	53	192.168.2.4	1.1.1.1
May 4, 2024 15:22:42.982033014 CEST	53	53087	1.1.1.1	192.168.2.4
May 4, 2024 15:23:01.066675901 CEST	60561	53	192.168.2.4	1.1.1.1
May 4, 2024 15:23:01.300811052 CEST	53	60561	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 4, 2024 15:20:59.688174963 CEST	192.168.2.4	1.1.1.1	0xb0e1	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 4, 2024 15:20:59.688174963 CEST	192.168.2.4	1.1.1.1	0x9286	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:02.709583044 CEST	192.168.2.4	1.1.1.1	0xc17c	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:03.210967064 CEST	192.168.2.4	1.1.1.1	0x9910	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:03.211328983 CEST	192.168.2.4	1.1.1.1	0xb03b	Standard query (0)	apis.google.com	65	IN (0x0001)	false
May 4, 2024 15:21:05.197182894 CEST	192.168.2.4	1.1.1.1	0x4ea6	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:22.958383083 CEST	192.168.2.4	1.1.1.1	0x813	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
May 4, 2024 15:21:23.109292030 CEST	192.168.2.4	1.1.1.1	0x58f3	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:42.713696957 CEST	192.168.2.4	1.1.1.1	0xfb6c	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:42.713850021 CEST	192.168.2.4	1.1.1.1	0x64e1	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
May 4, 2024 15:21:43.271225929 CEST	192.168.2.4	1.1.1.1	0xe8e4	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
May 4, 2024 15:21:43.423614979 CEST	192.168.2.4	1.1.1.1	0x35a6	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 15:22:03.583894968 CEST	192.168.2.4	1.1.1.1	0x674d	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
May 4, 2024 15:22:03.735274076 CEST	192.168.2.4	1.1.1.1	0x6ea6	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
May 4, 2024 15:22:16.987966061 CEST	192.168.2.4	1.1.1.1	0xce6d	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 15:22:16.988145113 CEST	192.168.2.4	1.1.1.1	0xcc61	Standard query (0)	play.google.com	65	IN (0x0001)	false
May 4, 2024 15:22:19.126493931 CEST	192.168.2.4	1.1.1.1	0x87	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 15:22:19.126653910 CEST	192.168.2.4	1.1.1.1	0x7a10	Standard query (0)	play.google.com	65	IN (0x0001)	false
May 4, 2024 15:22:42.647651911 CEST	192.168.2.4	1.1.1.1	0xdf35	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
May 4, 2024 15:23:01.066675901 CEST	192.168.2.4	1.1.1.1	0x6152	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 4, 2024 15:20:59.839366913 CEST	1.1.1.1	192.168.2.4	0x9286	No error (0)	www.google.com		142.250.217.132	A (IP address)	IN (0x0001)	false
May 4, 2024 15:20:59.839405060 CEST	1.1.1.1	192.168.2.4	0xb0e1	No error (0)	www.google.com			65	IN (0x0001)	false
May 4, 2024 15:21:02.944638968 CEST	1.1.1.1	192.168.2.4	0xc17c	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:02.944638968 CEST	1.1.1.1	192.168.2.4	0xc17c	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:03.361237049 CEST	1.1.1.1	192.168.2.4	0x9910	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 4, 2024 15:21:03.361237049 CEST	1.1.1.1	192.168.2.4	0x9910	No error (0)	plus.l.google.com		142.250.176.14	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:03.363080978 CEST	1.1.1.1	192.168.2.4	0xb03b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 4, 2024 15:21:06.000072956 CEST	1.1.1.1	192.168.2.4	0x4ea6	No error (0)	vanaheim.cn		109.107.161.150	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:23.108664036 CEST	1.1.1.1	192.168.2.4	0x813	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
May 4, 2024 15:21:23.108664036 CEST	1.1.1.1	192.168.2.4	0x813	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
May 4, 2024 15:21:23.108664036 CEST	1.1.1.1	192.168.2.4	0x813	No error (0)	yahoo.com			MX (Mail exchange)	IN (0x0001)	false
May 4, 2024 15:21:23.259823084 CEST	1.1.1.1	192.168.2.4	0x58f3	No error (0)	mta6.am0.yahoodns.net		67.195.228.110	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:23.259823084 CEST	1.1.1.1	192.168.2.4	0x58f3	No error (0)	mta6.am0.yahoodns.net		67.195.228.111	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:23.259823084 CEST	1.1.1.1	192.168.2.4	0x58f3	No error (0)	mta6.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:23.259823084 CEST	1.1.1.1	192.168.2.4	0x58f3	No error (0)	mta6.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:23.259823084 CEST	1.1.1.1	192.168.2.4	0x58f3	No error (0)	mta6.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:23.259823084 CEST	1.1.1.1	192.168.2.4	0x58f3	No error (0)	mta6.am0.yahoodns.net		67.195.204.77	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:23.259823084 CEST	1.1.1.1	192.168.2.4	0x58f3	No error (0)	mta6.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:23.259823084 CEST	1.1.1.1	192.168.2.4	0x58f3	No error (0)	mta6.am0.yahoodns.net		98.136.96.77	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:42.864095926 CEST	1.1.1.1	192.168.2.4	0xfb6c	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 4, 2024 15:21:42.864095926 CEST	1.1.1.1	192.168.2.4	0xfb6c	No error (0)	www3.l.google.com		142.250.72.174	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:42.865144014 CEST	1.1.1.1	192.168.2.4	0x64e1	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 4, 2024 15:21:43.423000097 CEST	1.1.1.1	192.168.2.4	0xe8e4	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
May 4, 2024 15:21:43.574397087 CEST	1.1.1.1	192.168.2.4	0x35a6	No error (0)	smtp.google.com		74.125.137.26	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:43.574397087 CEST	1.1.1.1	192.168.2.4	0x35a6	No error (0)	smtp.google.com		142.251.2.26	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:43.574397087 CEST	1.1.1.1	192.168.2.4	0x35a6	No error (0)	smtp.google.com		74.125.137.27	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:43.574397087 CEST	1.1.1.1	192.168.2.4	0x35a6	No error (0)	smtp.google.com		142.250.141.27	A (IP address)	IN (0x0001)	false
May 4, 2024 15:21:43.574397087 CEST	1.1.1.1	192.168.2.4	0x35a6	No error (0)	smtp.google.com		142.250.101.27	A (IP address)	IN (0x0001)	false
May 4, 2024 15:22:03.734599113 CEST	1.1.1.1	192.168.2.4	0x674d	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
May 4, 2024 15:22:03.886388063 CEST	1.1.1.1	192.168.2.4	0x6ea6	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
May 4, 2024 15:22:03.886388063 CEST	1.1.1.1	192.168.2.4	0x6ea6	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
May 4, 2024 15:22:17.139319897 CEST	1.1.1.1	192.168.2.4	0xce6d	No error (0)	play.google.com		142.250.189.14	A (IP address)	IN (0x0001)	false
May 4, 2024 15:22:19.276923895 CEST	1.1.1.1	192.168.2.4	0x87	No error (0)	play.google.com		142.250.176.14	A (IP address)	IN (0x0001)	false
May 4, 2024 15:22:42.982033014 CEST	1.1.1.1	192.168.2.4	0xdf35	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
May 4, 2024 15:22:42.982033014 CEST	1.1.1.1	192.168.2.4	0xdf35	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
May 4, 2024 15:23:01.300811052 CEST	1.1.1.1	192.168.2.4	0x6152	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)	false
May 4, 2024 15:23:01.300811052 CEST	1.1.1.1	192.168.2.4	0x6152	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

slscr.update.microsoft.com

ogs.google.com

https:

play.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	142.250.217.132	443	7208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:21:01 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 13:21:01 UTC	1283	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 13:21:01 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-a65WkldqaYivDBjQbqaHFg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Viewport-Width Accept-CH: Sec-CH-Viewport-Height Accept-CH: Sec-CH-DPR Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-04 13:21:01 UTC	884	IN	Data Raw: 33 36 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 69 74 74 73 62 75 72 67 68 20 6f 61 6b 6c 61 6e 64 20 63 6f 6e 73 74 72 75 63 74 69 6f 6e 20 61 63 63 69 64 65 6e 74 22 2c 22 66 61 6c 6c 20 67 75 79 20 6d 6f 76 69 65 20 72 79 61 6e 20 67 6f 73 6c 69 6e 67 22 2c 22 31 32 20 63 69 6c 69 6e 64 72 69 20 66 65 72 72 61 72 69 22 2c 22 72 65 64 20 6c 6f 62 73 74 65 72 20 65 6e 64 6c 65 73 73 20 73 68 72 69 6d 70 22 2c 22 68 61 72 70 65 72 20 6d 75 72 72 61 79 20 6e 65 62 72 61 73 6b 61 20 76 6f 6c 6c 65 79 62 61 6c 6c 22 2c 22 68 61 77 6c 65 79 20 74 65 78 61 73 20 74 6f 72 6e 61 64 6f 65 73 22 2c 22 64 75 61 20 6c 69 70 61 20 61 6c 62 75 6d 20 72 65 76 69 65 77 22 2c 22 73 6f 6e 79 20 70 73 6e 20 61 63 63 6f 75 6e 74 20 68 65 6c 6c 64 69 76 65 72 73 22 5d 2c Data Ascii: 36d)]}'["",["pittsburgh oakland construction accident","fall guy movie ryan gosling","12 cilindri ferrari","red lobster endless shrimp","harper murray nebraska volleyball","hawley texas tornadoes","dua lipa album review","sony psn account helldivers"],
2024-05-04 13:21:01 UTC	1255	IN	Data Raw: 39 30 37 0d 0a 51 6b 6c 6e 51 55 4e 46 55 55 56 45 52 56 46 49 4c 33 68 42 51 57 4a 42 51 55 46 44 51 58 64 46 51 6b 46 52 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 56 43 55 55 6c 45 51 6d 64 6a 51 55 46 6d 4c 30 56 42 52 47 4e 52 51 55 46 46 52 45 46 6e 55 55 4e 43 64 31 6c 46 51 6e 64 42 51 55 46 42 51 55 46 42 51 55 56 44 51 58 68 46 51 55 4a 42 56 56 4e 4a 56 45 56 48 52 58 6c 4b 51 6c 56 58 52 6e 68 76 5a 45 5a 35 5a 31 6c 4c 55 6e 4e 6a 52 56 56 4a 65 6b 70 44 51 6e 68 56 56 30 30 77 55 6c 4e 76 64 69 39 46 51 55 4a 6e 51 6b 46 42 54 55 4a 42 55 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 30 46 33 55 55 49 76 4f 46 46 42 53 48 68 46 51 6b 46 42 52 55 52 43 55 55 56 43 51 55 46 42 51 55 46 42 51 55 46 42 51 55 Data Ascii: 907QklnQUNFUUVERVFIL3hBQWJBQUFDQXdFQkFRQUFBQUFBQUFBQUFBQUVCUUlEQmdjQUFmL0VBRGNRQUFFREFnUUNCd1lFQndBQUFBQUFBQUVDQXhFQUJBVVNJVEVHRXlKQlVXRnhvZEZ5Z1lLUnNjRVVJekpDQnhVV00wUlNvdi9FQUJnQkFBTUJBUUFBQUFBQUFBQUFBQUFBQUFBQ0F3UUIvOFFBSHhFQkFBRURCUUVCQUFBQUFBQUFBQU
2024-05-04 13:21:01 UTC	1063	IN	Data Raw: 70 4c 57 6b 63 30 4e 6e 46 4a 55 54 5a 30 57 55 4e 75 61 55 39 5a 55 6a 42 30 57 6a 46 77 62 57 4a 6a 52 47 46 76 62 48 4e 71 5a 45 6c 51 61 57 31 6f 63 45 64 4f 64 55 30 78 4d 6b 5a 59 59 6c 52 57 64 47 78 56 4e 45 4a 30 54 53 74 35 53 7a 6c 6b 57 57 64 33 62 54 64 57 54 44 64 5a 53 32 30 79 63 33 4e 78 52 33 59 31 61 47 31 4c 65 55 4e 57 4e 57 52 42 51 31 42 61 54 56 5a 58 4f 46 56 50 52 55 74 58 56 6d 74 6e 55 55 70 50 4d 56 42 4b 53 33 70 76 62 33 56 42 64 45 6c 56 61 32 64 6e 5a 7a 64 48 59 55 5a 34 53 6d 56 68 65 6d 52 54 63 6d 46 43 53 55 35 5a 61 45 59 32 4f 44 42 6f 53 30 56 4d 62 45 6b 79 51 6e 46 54 63 31 68 6c 51 57 68 54 55 57 5a 43 55 6b 5a 6a 56 47 6c 48 57 6d 39 58 64 55 68 4d 62 56 46 44 4b 33 70 49 59 6e 49 32 56 56 63 7a 64 33 5a 6a 53 Data Ascii: pLWkc0NnFJUTZ0WUNuaU9ZUjB0WjFwbWJjRGFvbHNqZElQaW1ocEdOdU0xMkZYYlRWdGxVNEJ0TSt5SzlkWWd3bTdWTDdZS20yc3NxR3Y1aG1LeUNWNWRBQ1BaTVZXOFVPRUtXVmtnUUpPMVBKS3pvb3VBdElVa2dnZzdHYUZ4SmVhemRTcmFCSU5ZaEY2ODBoS0VMbEkyQnFTc1hlQWhTUWZCUkZjVGlHWm9XdUhMbVFDK3pIYnI2VVczd3ZjS
2024-05-04 13:21:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	142.250.217.132	443	7208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:21:01 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 13:21:01 UTC	967	IN	HTTP/1.1 200 OK Version: 630032337 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 04 May 2024 13:21:01 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-04 13:21:01 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-05-04 13:21:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	142.250.217.132	443	7208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:21:01 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 13:21:01 UTC	967	IN	HTTP/1.1 200 OK Version: 630032337 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 04 May 2024 13:21:01 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-04 13:21:01 UTC	288	IN	Data Raw: 32 31 35 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 51 61 20 67 62 5f 68 62 20 67 62 5f 54 64 20 67 62 5f 6e 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 215c)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Qa gb_hb gb_Td gb_nd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-05-04 13:21:01 UTC	1255	IN	Data Raw: 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 72 64 20 67 62 5f 6b 64 20 67 62 5f 78 64 20 67 62 5f 77 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 71 64 20 67 62 5f 67 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4f 63 20 67 62 5f 71 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 Data Ascii: 03e\u003c\/div\u003e\u003cdiv class\u003d\"gb_rd gb_kd gb_xd gb_wd\"\u003e\u003cdiv class\u003d\"gb_qd gb_gd\"\u003e\u003cdiv class\u003d\"gb_Oc gb_q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u00
2024-05-04 13:21:01 UTC	1255	IN	Data Raw: 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4e 63 20 67 62 5f 35 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 71 64 20 67 62 5f 65 64 20 67 62 Data Ascii: label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Nc gb_5d\" aria-hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_qd gb_ed gb
2024-05-04 13:21:01 UTC	1255	IN	Data Raw: 22 67 62 5f 55 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 37 63 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 78 20 67 62 5f 4b 20 67 62 5f 6a 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 66 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 53 65 61 72 63 68 20 4c 61 62 73 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 68 74 74 70 73 3a 2f 2f 6c 61 62 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 Data Ascii: "gb_Ud\"\u003e\u003cdiv class\u003d\"gb_7c\"\u003e \u003cdiv class\u003d\"gb_x gb_K gb_j\"\u003e \u003cdiv class\u003d\"gb_f\"\u003e \u003ca class\u003d\"gb_d\" aria-label\u003d\"Search Labs\" href\u003d\"https://labs.google.com/search?source\u003dntp\" t
2024-05-04 13:21:01 UTC	1255	IN	Data Raw: 6d 2f 69 6e 74 6c 2f 65 6e 2f 61 62 6f 75 74 2f 70 72 6f 64 75 63 74 73 3f 74 61 62 5c 75 30 30 33 64 72 68 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 68 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 36 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c Data Ascii: m/intl/en/about/products?tab\u003drh\" aria-expanded\u003d\"false\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg class\u003d\"gb_h\" focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M6,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,
2024-05-04 13:21:01 UTC	1255	IN	Data Raw: 75 30 30 33 64 5c 22 67 62 5f 36 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 48 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 49 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 38 64 20 67 62 5f 4a 63 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4e 63 20 67 62 5f 35 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c Data Ascii: u003d\"gb_6c\"\u003e\u003cdiv class\u003d\"gb_Hc\"\u003e\u003cdiv class\u003d\"gb_Ic\"\u003e\u003ca class\u003d\"gb_8d gb_Jc gb_6d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Nc gb_5d\" aria-hidden\u003d\"true\
2024-05-04 13:21:01 UTC	1255	IN	Data Raw: 6e 28 29 7b 69 66 28 21 5f 2e 71 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 7c 7c 21 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 61 5c 75 30 30 33 64 21 31 2c 62 5c 75 30 30 33 64 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 7b 7d 2c 5c 22 70 61 73 73 69 76 65 5c 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 61 5c 75 30 30 33 64 21 30 7d 7d 29 3b 74 72 79 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 28 29 5c 75 30 30 33 64 5c 75 30 30 33 65 7b 7d 3b 5f 2e 71 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 5c 22 74 65 73 74 5c 22 2c 63 2c 62 29 3b 5f 2e 71 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 5c 22 74 65 73 74 5c 22 2c 63 2c 62 29 Data Ascii: n(){if(!_.q.addEventListener\|\|!Object.defineProperty)return!1;var a\u003d!1,b\u003dObject.defineProperty({},\"passive\",{get:function(){a\u003d!0}});try{const c\u003d()\u003d\u003e{};_.q.addEventListener(\"test\",c,b);_.q.removeEventListener(\"test\",c,b)
2024-05-04 13:21:01 UTC	730	IN	Data Raw: 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 30 5c 75 30 30 33 63 62 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 5f 2e 75 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 74 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 44 5c 22 29 3b 7d 3b 77 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 76 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e Data Ascii: nction(a){const b\u003da.length;if(0\u003cb){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};_.ud\u003dfunction(a){if(a instanceof _.td)return a.i;throw Error(\"D\");};wd\u003dfunction(a){return new vd(b\u003d\u003eb.
2024-05-04 13:21:01 UTC	451	IN	Data Raw: 31 62 63 0d 0a 2e 61 70 70 6c 79 28 64 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 74 68 69 73 2c 64 29 7d 7d 3b 5f 2e 44 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 5c 75 30 30 33 64 5c 75 30 30 33 64 5f 2e 6b 62 28 61 2c 62 2c 63 2c 21 31 29 7d 3b 5f 2e 45 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 72 64 28 5f 2e 71 63 28 61 2c 62 29 29 7d 3b 5c 6e 5f 2e 52 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 5c 75 30 30 33 64 5f 2e 71 63 28 61 2c 62 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 5c 75 30 30 33 64 5c 75 30 30 33 64 61 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 Data Ascii: 1bc.apply(d,arguments);return a.apply(this,d)}};_.Dd\u003dfunction(a,b,c){return void 0!\u003d\u003d_.kb(a,b,c,!1)};_.Ed\u003dfunction(a,b){return _.rd(_.qc(a,b))};\n_.R\u003dfunction(a,b){a\u003d_.qc(a,b);return null\u003d\u003da?a:Number.isFinite(a)?a
2024-05-04 13:21:01 UTC	1255	IN	Data Raw: 38 30 30 30 0d 0a 48 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 6e 75 6c 6c 2c 63 5c 75 30 30 33 64 5f 2e 71 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 69 66 28 21 63 7c 7c 21 63 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 62 3b 74 72 79 7b 62 5c 75 30 30 33 64 63 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 61 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 48 64 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 48 64 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 48 64 7d 29 7d 63 61 74 63 68 28 64 29 7b 5f 2e 71 2e 63 6f 6e 73 6f 6c 65 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 71 2e 63 6f 6e 73 6f 6c 65 2e 65 Data Ascii: 8000Hd\u003dfunction(a){return a};_.Id\u003dfunction(a){var b\u003dnull,c\u003d_.q.trustedTypes;if(!c\|\|!c.createPolicy)return b;try{b\u003dc.createPolicy(a,{createHTML:Hd,createScript:Hd,createScriptURL:Hd})}catch(d){_.q.console\u0026\u0026_.q.console.e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	142.250.217.132	443	7208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:21:01 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 13:21:01 UTC	922	IN	HTTP/1.1 200 OK Version: 630032337 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 04 May 2024 13:21:01 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-04 13:21:01 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-05-04 13:21:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	142.250.176.14	443	7208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:21:03 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 13:21:03 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 121628 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 30 Apr 2024 06:53:06 GMT Expires: Wed, 30 Apr 2025 06:53:06 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 15 Apr 2024 17:34:54 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 368877 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-04 13:21:03 UTC	339	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 62 61 2c 63 61 2c 64 61 2c 6e 61 2c 70 61 2c 76 61 2c 77 61 2c 7a 61 3b 62 61 3d 66 75 6e 63 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);var ba,ca,da,na,pa,va,wa,za;ba=func
2024-05-04 13:21:03 UTC	1255	IN	Data Raw: 7d 7d 3b 63 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c Data Ascii: }};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,
2024-05-04 13:21:03 UTC	1255	IN	Data Raw: 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 63 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 61 28 62 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 75 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 Data Ascii: on"===typeof d&&"function"!=typeof d.prototype[a]&&ca(d.prototype,a,{configurable:!0,writable:!0,value:function(){return pa(ba(this))}})}return a});pa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a};_.ua=function(a){var b="und
2024-05-04 13:21:03 UTC	1255	IN	Data Raw: 2e 50 66 29 7b 74 68 69 73 2e 50 66 3d 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 74 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 45 37 28 29 7d 29 7d 74 68 69 73 2e 50 66 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 5f 2e 6d 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 45 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 50 66 26 26 74 68 69 73 2e 50 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 50 66 3b 74 68 69 73 2e 50 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d Data Ascii: .Pf){this.Pf=[];var k=this;this.tP(function(){k.E7()})}this.Pf.push(h)};var d=_.ma.setTimeout;b.prototype.tP=function(h){d(h,0)};b.prototype.E7=function(){for(;this.Pf&&this.Pf.length;){var h=this.Pf;this.Pf=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=
2024-05-04 13:21:03 UTC	1255	IN	Data Raw: 74 6f 74 79 70 65 2e 6e 65 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 67 63 61 28 29 29 7b 76 61 72 20 6b 3d 5f 2e 6d 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6b 26 26 6b 2e 65 72 72 6f 72 28 68 2e 46 66 29 7d 7d 2c 0a 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 63 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 73 56 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 68 3d 5f 2e 6d 61 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 6b 3d 5f 2e 6d 61 2e 45 76 65 6e 74 2c 6c 3d 5f 2e 6d 61 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 6c 29 72 65 74 Data Ascii: totype.nea=function(){var h=this;d(function(){if(h.gca()){var k=_.ma.console;"undefined"!==typeof k&&k.error(h.Ff)}},1)};e.prototype.gca=function(){if(this.sV)return!1;var h=_.ma.CustomEvent,k=_.ma.Event,l=_.ma.dispatchEvent;if("undefined"===typeof l)ret
2024-05-04 13:21:03 UTC	1255	IN	Data Raw: 3b 74 68 69 73 2e 73 56 3d 21 30 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 5f 2e 75 61 28 68 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e 65 78 74 28 29 29 63 28 6e 2e 76 61 6c 75 65 29 2e 42 79 28 6b 2c 6c 29 7d 29 7d 3b 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 5f 2e 75 61 28 68 29 2c 6c 3d 6b 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6c 2e 64 6f 6e 65 3f 63 Data Ascii: ;this.sV=!0};e.resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=_.ua(h),n=m.next();!n.done;n=m.next())c(n.value).By(k,l)})};e.all=function(h){var k=_.ua(h),l=k.next();return l.done?c
2024-05-04 13:21:03 UTC	1255	IN	Data Raw: 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6e 3d 6e 65 77 20 61 28 5b 5b 6c 2c 32 5d 2c 5b 6d 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6e 2e 67 65 74 28 6c 29 7c 7c 33 21 3d 6e 2e 67 65 74 28 6d 29 29 72 65 74 75 72 6e 21 31 3b 6e 2e 64 65 6c 65 74 65 28 6c 29 3b 6e 2e 73 65 74 28 6d 2c 34 29 3b 72 65 74 75 72 6e 21 6e 2e 68 61 73 28 6c 29 26 26 34 3d 3d 6e 2e 67 65 74 28 6d 29 7d 63 61 74 63 68 28 70 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 66 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b Data Ascii: ct.seal)return!1;try{var l=Object.seal({}),m=Object.seal({}),n=new a([[l,2],[m,3]]);if(2!=n.get(l)\|\|3!=n.get(m))return!1;n.delete(l);n.set(m,4);return!n.has(l)&&4==n.get(m)}catch(p){return!1}}())return a;var f="$jscomp_hidden_"+Math.random();e("freeze");
2024-05-04 13:21:03 UTC	1255	IN	Data Raw: 20 62 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 5f 2e 75 61 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6b 3d 30 3d 3d 3d 6b 3f 30 3a 6b 3b 76 61 72 20 6d 3d 64 28 74 68 69 73 2c 6b 29 3b 6d 2e 6c 69 73 74 7c 7c 28 6d 2e 6c 69 73 74 3d 74 68 69 73 5b 30 5d 5b 6d 2e 69 64 5d 3d 5b 5d 29 3b 6d 2e 6e 66 3f 6d 2e 6e 66 2e 76 61 6c 75 65 3d 6c 3a 28 6d Data Ascii: b=new WeakMap,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=_.ua(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};c.prototype.set=function(k,l){k=0===k?0:k;var m=d(this,k);m.list\|\|(m.list=this[0][m.id]=[]);m.nf?m.nf.value=l:(m
2024-05-04 13:21:04 UTC	1255	IN	Data Raw: 6d 3d 62 2e 67 65 74 28 6c 29 3a 28 6d 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6c 2c 6d 29 29 3a 6d 3d 22 70 5f 22 2b 6c 3b 76 61 72 20 6e 3d 6b 5b 30 5d 5b 6d 5d 3b 69 66 28 6e 26 26 76 61 28 6b 5b 30 5d 2c 6d 29 29 66 6f 72 28 6b 3d 30 3b 6b 3c 6e 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 70 3d 6e 5b 6b 5d 3b 69 66 28 6c 21 3d 3d 6c 26 26 70 2e 6b 65 79 21 3d 3d 70 2e 6b 65 79 7c 7c 6c 3d 3d 3d 70 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 6b 2c 6e 66 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 2d 31 2c 6e 66 3a 76 6f 69 64 20 30 7d 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 76 61 72 20 6d 3d 6b 5b 31 5d 3b 72 65 74 75 72 6e 20 70 61 28 66 Data Ascii: m=b.get(l):(m=""+ ++h,b.set(l,m)):m="p_"+l;var n=k[0][m];if(n&&va(k[0],m))for(k=0;k<n.length;k++){var p=n[k];if(l!==l&&p.key!==p.key\|\|l===p.key)return{id:m,list:n,index:k,nf:p}}return{id:m,list:n,index:-1,nf:void 0}},e=function(k,l){var m=k[1];return pa(f
2024-05-04 13:21:04 UTC	1255	IN	Data Raw: 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 34 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 7d 63 61 74 63 68 28 68 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 74 68 69 73 2e 44 61 3d 6e 65 77 20 4d 61 70 3b 69 66 28 63 29 7b 63 3d Data Ascii: urn!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|4!=f.value[0].x\|\|f.value[1]!=f.value[0]?!1:e.next().done}catch(h){return!1}}())return a;var b=function(c){this.Da=new Map;if(c){c=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49751	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:21:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+83avNG6Z9wwMVh&MD=ybDA+rmd HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-04 13:21:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5d5b0ae0-5efd-44c2-b325-fdbc45475428 MS-RequestId: 02592977-878a-4b0b-b239-dba19969eebd MS-CV: Mzb/eVdc90+VKMcL.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 04 May 2024 13:21:13 GMT Connection: close Content-Length: 24490
2024-05-04 13:21:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-04 13:21:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49758	142.250.72.174	443	7208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:21:43 UTC	872	OUT	GET /widget/app/so?awwd=1&gm3=1&origin=chrome-untrusted%3A%2F%2Fnew-tab-page&origin=chrome%3A%2F%2Fnew-tab-page&cn=app&pid=1&spid=243&hl=en HTTP/1.1 Host: ogs.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 13:21:43 UTC	2497	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM chrome-untrusted://new-tab-page Content-Security-Policy: frame-ancestors chrome-untrusted://new-tab-page chrome://new-tab-page Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/OneGoogleWidgetUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ANFaue5R-ScgTYax3LfSMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/OneGoogleWidgetUi/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/OneGoogleWidgetUi/cspreport/allowlist x-ua-compatible: IE=edge Expires: Sat, 04 May 2024 13:21:43 GMT Date: Sat, 04 May 2024 13:21:43 GMT Cache-Control: private, max-age=259200 P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="CoepOneGoogleWidgetUi" Report-To: {"group":"CoepOneGoogleWidgetUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/OneGoogleWidgetUi"}]} reporting-endpoints: default="/_/OneGoogleWidgetUi/web-reports?context=eJzjstHikmLw0pBiUAjbyXTv-zOmgpUvmCS-vmTSAGKn9BmsQUDsUz-DNQaIW2-eY50KxEn_zrMWAbEQD8fzNzc2sgmsOHzmISMATVggKQ" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Set-Cookie: NID=513=mPPPqpDMrDFUKWs8QWCE0CfLRBKkKmj_o5FDyqsicCmeUBwk9I5OXwE3RMm_CMffzYSx9ZIPSTxmM-VQzSv_mLJjyXRSUzvk9haotAWoVcJ8iqK3NFmfA42wDu-YwqQ9vhflBU2dO2t8pCNEAbMtpv2HO6denIteuHo8gbtxJng; expires=Sun, 03-Nov-2024 13:21:43 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-04 13:21:43 UTC	2497	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 67 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 22 3e 3c 6c 69 6e 6b 20 72 65 66 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 67 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 77 69 64 67 65 74 2f 61 70 70 2f 73 6f 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 Data Ascii: 8000<!doctype html><html lang="en" dir="ltr"><head><base href="https://ogs.google.com/"><link ref="preconnect" href="//www.gstatic.com"><meta name="referrer" content="origin"><link rel="canonical" href="https://ogs.google.com/widget/app/so"><link rel="p
2024-05-04 13:21:43 UTC	2497	IN	Data Raw: 6d 6c 45 6c 3d 6d 3b 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 3d 62 2e 74 61 72 67 65 74 3b 76 61 72 20 63 3b 22 49 4d 47 22 21 3d 62 2e 74 61 67 4e 61 6d 65 7c 7c 62 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 69 69 64 22 29 7c 7c 61 2e 5f 69 73 4c 61 7a 79 49 6d 61 67 65 28 62 29 7c 7c 62 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6e 6f 61 66 74 22 29 7c 7c 28 63 3d 6d 28 62 29 29 3b 69 66 28 61 2e 61 66 74 5f 63 6f 75 6e 74 65 72 26 26 28 62 3d 61 2e 61 66 74 5f 63 6f 75 6e 74 65 72 2e 69 6e 64 65 78 4f 66 28 62 29 2c 2d 31 21 3d 3d 62 26 26 28 62 3d 31 3d 3d 3d 61 2e 61 66 74 Data Ascii: mlEl=m;document.documentElement.addEventListener("load",function(b){b=b.target;var c;"IMG"!=b.tagName\|\|b.hasAttribute("data-iid")\|\|a._isLazyImage(b)\|\|b.hasAttribute("data-noaft")\|\|(c=m(b));if(a.aft_counter&&(b=a.aft_counter.indexOf(b),-1!==b&&(b=1===a.aft
2024-05-04 13:21:43 UTC	2497	IN	Data Raw: 74 62 7b 68 65 69 67 68 74 3a 35 36 70 78 7d 2e 6b 46 77 50 65 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7a 2d 69 6e 64 65 78 3a 31 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 79 64 4d 4d 45 62 7b 68 65 69 67 68 74 3a 35 36 70 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 53 53 50 47 4b 66 7b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 72 69 67 68 74 3a 30 3b 74 6f 70 3a 30 7d 2e 65 63 4a 45 69 62 20 2e 41 4f 71 34 74 62 2c 2e 65 63 4a 45 69 62 20 2e 79 64 4d 4d 45 62 7b 68 65 69 67 68 74 3a 36 34 70 78 7d 2e 65 32 47 33 46 62 2e 45 57 5a 63 75 64 20 2e 41 4f 71 34 74 62 2c 2e 65 32 47 33 46 62 2e 45 57 5a 63 75 64 20 2e 79 64 4d 4d Data Ascii: tb{height:56px}.kFwPee{position:relative;z-index:1;height:100%}.ydMMEb{height:56px;width:100%}.SSPGKf{overflow-y:hidden;position:absolute;bottom:0;left:0;right:0;top:0}.ecJEib .AOq4tb,.ecJEib .ydMMEb{height:64px}.e2G3Fb.EWZcud .AOq4tb,.e2G3Fb.EWZcud .ydMM
2024-05-04 13:21:43 UTC	2497	IN	Data Raw: 2e 6e 7a 39 73 71 62 2e 6f 30 37 47 35 20 2e 74 58 39 75 31 62 3a 61 63 74 69 76 65 3a 68 6f 76 65 72 20 2e 52 71 35 47 63 62 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 64 32 65 33 30 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 6f 70 61 63 69 74 79 3a 2e 38 7d 2e 74 58 39 75 31 62 5b 64 72 61 67 67 61 62 6c 65 3d 66 61 6c 73 65 5d 7b 2d 77 65 62 6b 69 74 2d 74 6f 75 63 68 2d 63 61 6c 6c 6f 75 74 3a 6e 6f 6e 65 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 7d 2e 4d 72 45 66 4c 63 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 35 33 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 77 69 64 74 68 3a 35 33 70 78 7d 2e 43 67 77 54 44 62 7b 68 65 69 Data Ascii: .nz9sqb.o07G5 .tX9u1b:active:hover .Rq5Gcb{background-color:#2d2e30;border-color:transparent;opacity:.8}.tX9u1b[draggable=false]{-webkit-touch-callout:none;user-select:none}.MrEfLc{display:inline-block;height:53px;vertical-align:top;width:53px}.CgwTDb{hei
2024-05-04 13:21:43 UTC	2497	IN	Data Raw: 72 6f 6c 6c 62 61 72 2d 74 68 75 6d 62 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 28 39 35 2c 39 39 2c 31 30 34 29 7d 2e 45 48 7a 63 65 63 3a 3a 2d 77 65 62 6b 69 74 2d 73 63 72 6f 6c 6c 62 61 72 2d 74 72 61 63 6b 2c 2e 45 48 7a 63 65 63 3a 3a 2d 77 65 62 6b 69 74 2d 73 63 72 6f 6c 6c 62 61 72 2d 74 72 61 63 6b 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 7d 2e 6a 46 56 30 6e 7b 68 65 69 67 68 74 3a 34 30 70 78 3b 6d 61 72 67 69 6e 3a 38 70 78 3b 77 69 64 74 68 3a 34 30 70 78 7d 2e 6e 7a 39 73 71 62 20 2e 6a 46 56 30 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 4f 75 6e 5a 39 63 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 62 6f 72 64 65 72 3a 31 70 78 20 Data Ascii: rollbar-thumb{background-color:rgb(95,99,104)}.EHzcec::-webkit-scrollbar-track,.EHzcec::-webkit-scrollbar-track:hover{background:none;border:none}.jFV0n{height:40px;margin:8px;width:40px}.nz9sqb .jFV0n{position:relative}.OunZ9c{background:#fff;border:1px
2024-05-04 13:21:43 UTC	2497	IN	Data Raw: 31 30 70 78 7d 2e 75 34 52 63 55 64 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 7d 2e 6e 7a 39 73 71 62 2e 45 48 7a 63 65 63 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 32 38 32 61 32 63 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 73 75 72 66 61 63 65 2d 63 6f 6e 74 61 69 6e 65 72 2d 68 69 67 68 2c 23 32 38 32 61 32 63 29 7d 2e 6e 7a 39 73 71 62 2e 45 48 7a 63 65 63 20 2e 4c 56 61 6c 37 62 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 31 62 31 62 31 62 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 73 75 72 66 61 63 65 2d 63 6f 6e 74 61 69 6e 65 72 2d 6c 6f 77 2c 23 31 62 31 62 31 62 29 3b 63 6f 6c 6f 72 3a 23 63 34 63 37 63 35 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 Data Ascii: 10px}.u4RcUd{padding-top:0}.nz9sqb.EHzcec{background:#282a2c;background:var(--gm3-sys-color-surface-container-high,#282a2c)}.nz9sqb.EHzcec .LVal7b{background:#1b1b1b;background:var(--gm3-sys-color-surface-container-low,#1b1b1b);color:#c4c7c5;color:var(--g
2024-05-04 13:21:43 UTC	2497	IN	Data Raw: 25 3b 6f 70 61 63 69 74 79 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 62 35 37 64 30 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 70 72 69 6d 61 72 79 2c 23 30 62 35 37 64 30 29 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 35 73 20 65 61 73 65 2d 6f 75 74 7d 2e 4e 51 56 33 6d 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 37 34 37 37 37 35 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 6f 75 74 6c 69 6e 65 2c 23 37 34 37 37 37 35 29 7d 2e 4e 51 56 33 6d 3a 68 6f 76 65 72 3a 62 65 66 6f 72 65 7b 6f 70 61 63 Data Ascii: %;opacity:0;border-radius:100px;background:#0b57d0;background:var(--gm3-sys-color-primary,#0b57d0);transition:opacity .5s ease-out}.NQV3m:hover{background:none;border-color:#747775;border-color:var(--gm3-sys-color-outline,#747775)}.NQV3m:hover:before{opac
2024-05-04 13:21:43 UTC	2497	IN	Data Raw: 63 6f 6c 6f 72 2d 70 72 69 6d 61 72 79 2c 23 61 38 63 37 66 61 29 7d 2e 45 48 7a 63 65 63 3a 3a 2d 77 65 62 6b 69 74 2d 73 63 72 6f 6c 6c 62 61 72 7b 77 69 64 74 68 3a 38 70 78 7d 2e 45 48 7a 63 65 63 3a 3a 2d 77 65 62 6b 69 74 2d 73 63 72 6f 6c 6c 62 61 72 2d 74 68 75 6d 62 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6c 69 70 3a 70 61 64 64 69 6e 67 2d 62 6f 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 33 31 2c 33 31 2c 33 31 2c 2e 31 36 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 31 38 35 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 33 33 25 7d 2e 45 48 7a 63 65 63 Data Ascii: color-primary,#a8c7fa)}.EHzcec::-webkit-scrollbar{width:8px}.EHzcec::-webkit-scrollbar-thumb{background-clip:padding-box;background-color:rgba(31,31,31,.16);border-radius:8px;border:1px solid transparent;box-shadow:none;height:185px;max-height:33%}.EHzcec
2024-05-04 13:21:43 UTC	2497	IN	Data Raw: 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 31 70 78 3b 62 6f 72 64 65 72 3a 2e 35 70 78 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 66 38 66 61 66 64 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 73 75 72 66 61 63 65 2d 63 6f 6e 74 61 69 6e 65 72 2d 6c 6f 77 2c 23 66 38 66 61 66 64 29 7d 2e 51 67 64 64 55 63 20 2e 6b 69 62 50 36 62 3a 66 6f 63 75 73 2c 2e 51 67 64 64 55 63 20 2e 6c 48 74 53 62 64 3a 66 6f 63 75 73 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 64 65 33 65 61 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 67 6d 33 2d 73 79 73 2d 63 6f 6c 6f 72 2d 73 75 72 66 61 63 65 2d 63 6f 6e 74 Data Ascii: px;position:absolute;top:1px;border:.5px solid;border-color:#f8fafd;border-color:var(--gm3-sys-color-surface-container-low,#f8fafd)}.QgddUc .kibP6b:focus,.QgddUc .lHtSbd:focus{border:1px solid;background:#dde3ea;background:var(--gm3-sys-color-surface-cont
2024-05-04 13:21:43 UTC	2497	IN	Data Raw: 55 2b 30 33 30 30 2d 30 33 30 31 2c 55 2b 30 33 30 33 2d 30 33 30 34 2c 55 2b 30 33 30 38 2d 30 33 30 39 2c 55 2b 30 33 32 33 2c 55 2b 30 33 32 39 2c 55 2b 31 45 41 30 2d 31 45 46 39 2c 55 2b 32 30 41 42 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 52 6f 62 6f 74 6f 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 73 72 63 3a 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 30 31 30 30 2d 30 32 41 46 2c 55 2b 30 33 30 34 Data Ascii: U+0300-0301,U+0303-0304,U+0308-0309,U+0323,U+0329,U+1EA0-1EF9,U+20AB;}@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)format('woff2');unicode-range:U+0100-02AF,U+0304

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49770	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:21:52 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+83avNG6Z9wwMVh&MD=ybDA+rmd HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-04 13:21:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 423c526f-025f-4836-af73-b50d84986dfc MS-RequestId: 13c884fd-6385-4575-81bd-6a1a0cc8c823 MS-CV: fEo8KPAIWEOXggT3.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 04 May 2024 13:21:51 GMT Connection: close Content-Length: 25457
2024-05-04 13:21:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-04 13:21:53 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49774	142.250.189.14	443	7208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:22:18 UTC	539	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://ogs.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://ogs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 13:22:18 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://ogs.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 04 May 2024 13:22:18 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49775	142.250.189.14	443	7208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:22:18 UTC	947	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 787 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: text/plain;charset=UTF-8 X-Goog-AuthUser: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ogs.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ogs.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=mPPPqpDMrDFUKWs8QWCE0CfLRBKkKmj_o5FDyqsicCmeUBwk9I5OXwE3RMm_CMffzYSx9ZIPSTxmM-VQzSv_mLJjyXRSUzvk9haotAWoVcJ8iqK3NFmfA42wDu-YwqQ9vhflBU2dO2t8pCNEAbMtpv2HO6denIteuHo8gbtxJng
2024-05-04 13:22:18 UTC	787	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 6f 6e 65 67 6f 6f 67 6c 65 68 74 74 70 73 65 72 76 65 72 5f 32 30 32 34 30 34 33 30 2e 30 31 5f 70 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_onegooglehttpserver_20240430.01_p1",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],1
2024-05-04 13:22:19 UTC	920	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://ogs.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=ON-263QZXt9Weooq4tM-X7f_gPZYX_UROX833_yqu-2GKj7wBRvMMF_Z8Hh_g785FV-f1eGZZ3bmuxVot588IRQ_TPzkUmoPYhH9VZfNdSFfe5oLbWL0o3mTVMkjR2y5hkTF1a_qbB89fDZKW_cIDuWlJVWJsC3zjL1NGiEc0tU; expires=Sun, 03-Nov-2024 13:22:19 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 04 May 2024 13:22:19 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 04 May 2024 13:22:19 GMT Connection: close Transfer-Encoding: chunked
2024-05-04 13:22:19 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-05-04 13:22:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49776	142.250.176.14	443	7208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 13:22:19 UTC	664	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=ON-263QZXt9Weooq4tM-X7f_gPZYX_UROX833_yqu-2GKj7wBRvMMF_Z8Hh_g785FV-f1eGZZ3bmuxVot588IRQ_TPzkUmoPYhH9VZfNdSFfe5oLbWL0o3mTVMkjR2y5hkTF1a_qbB89fDZKW_cIDuWlJVWJsC3zjL1NGiEc0tU
2024-05-04 13:22:19 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Sat, 04 May 2024 13:22:19 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-04 13:22:19 UTC	985	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-05-04 13:22:19 UTC	570	IN	Data Raw: 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 Data Ascii: -image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-rep

Target ID:	0
Start time:	15:20:52
Start date:	04/05/2024
Path:	C:\Users\user\Desktop\OgcktrbHkI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\OgcktrbHkI.exe"
Imagebase:	0x400000
File size:	334'336 bytes
MD5 hash:	35F519000AD078D242C0BCE097C59B31
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1671898553.0000000001C1B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.1608000419.0000000001BC0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:20:53
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kofydeki\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:20:53
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:20:54
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\pspizbvl.exe" C:\Windows\SysWOW64\kofydeki\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:20:54
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:20:55
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create kofydeki binPath= "C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d\"C:\Users\user\Desktop\OgcktrbHkI.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0x760000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:20:55
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:20:56
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description kofydeki "wifi internet conection"
Imagebase:	0x760000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:20:56
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start kofydeki
Imagebase:	0x760000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\kofydeki\pspizbvl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\kofydeki\pspizbvl.exe /d"C:\Users\user\Desktop\OgcktrbHkI.exe"
Imagebase:	0x400000
File size:	14'476'288 bytes
MD5 hash:	B50406135DB8929E333AE2BDD1EE42FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.1671546746.0000000002490000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.1671238466.0000000001B45000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000003.1653423380.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0xef0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3156 -ip 3156
Imagebase:	0xe60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6672 -ip 6672
Imagebase:	0xe60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:20:57
Start date:	04/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	15:20:58
Start date:	04/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1976,i,15118944360220751254,1504055466682295701,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	15:20:58
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 544
Imagebase:	0xe60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:20:58
Start date:	04/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 648
Imagebase:	0xe60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:21:41
Start date:	04/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	25.6%
Total number of Nodes:	1550
Total number of Limit Nodes:	18

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

D, xrefs: 00409F8E
", xrefs: 0040A189
", xrefs: 00409EDB
", xrefs: 0040A078
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
P, xrefs: 00409DAA
%X%08X, xrefs: 0040A0B0
\, xrefs: 00409D0C

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 01C2046B Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 01C20493
Module32First.KERNEL32(00000000,00000224), ref: 01C204B3

Memory Dump Source

Source File: 00000000.00000002.1671898553.0000000001C1B000.00000040.00000020.00020000.00000000.sdmp, Offset: 01C1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c1b000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 3c84d87d7cc011b529535a3edf7ca431b678e720a3ec34b2917f70c824b1146c
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: D7F0F632100321EFE7203BF8AC8DB6E76F8BF49230F20462AF646910C0DB70E9054660

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
", xrefs: 00407227

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 01BA003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 01BA024D

Strings

kernel32.dll, xrefs: 01BA008F, 01BA0095
cess, xrefs: 01BA018D

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 17c8ab306c13c338b87bc1105f843d92ba2bf3a8ceff4a51ee0e811d5dbf232b
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 47527974A01229DFDB64CF68C984BACBBB1BF09304F5480D9E94DAB351DB30AA94CF14

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Uniqueness

Uniqueness Score: -1.00%

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Strings

Xw, xrefs: 00406E06

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID: Xw
API String ID: 1823874839-290828094
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 01BA0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,01BA0223,?,?), ref: 01BA0E19
SetErrorMode.KERNELBASE(00000000,?,?,01BA0223,?,?), ref: 01BA0E1E

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 8e1551b3fd85681e0abde4d6efc29f5ad6f6bc8350b15209521bb16e22067699
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: C0D0123154512877DB003A94DC09BCD7F1CDF09B62F408051FB0DD9080C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 01C2012A Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 01C2017B

Memory Dump Source

Source File: 00000000.00000002.1671898553.0000000001C1B000.00000040.00000020.00020000.00000000.sdmp, Offset: 01C1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c1b000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 7dde187c58915179e08def3c5b9d32fae7148e36ff8c9104328cc631ff60b43e
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 33113C79A00208EFDB01DF98C985E98BFF5AF08350F158095F9489B361D371EA90EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

local_time, xrefs: 0040CACD
\, xrefs: 0040D39D
drivers\, xrefs: 0040D067
srv_time, xrefs: 0040CABB
wtm_w, xrefs: 0040C96C
wtm_c, xrefs: 0040C956
4, xrefs: 0040D9F7
flags_upd, xrefs: 0040CE4A
lid_file_upd, xrefs: 0040CE6A
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
\, xrefs: 0040D3A7
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
@, xrefs: 0040D754
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
wtm_r, xrefs: 0040C97F
.sys, xrefs: 0040D0CC
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlSetLastWin32Error, xrefs: 004010D6
RtlLengthSid, xrefs: 00401246
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlNtStatusToDosError, xrefs: 00401194
NtOpenProcessToken, xrefs: 004011D4
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtSetInformationThread, xrefs: 00401155
NtFilterToken, xrefs: 0040122B
NtDuplicateToken, xrefs: 004011F3
RtlFreeSid, xrefs: 00401116
NtSetInformationToken, xrefs: 00401175
ntdll.dll, xrefs: 0040100D
RtlInitUnicodeString, xrefs: 00401135
NtTerminateProcess, xrefs: 004010F6
NtClose, xrefs: 004011B4
NtQueryInformationToken, xrefs: 00401262

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Feb, xrefs: 0040B25D
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Jul, xrefs: 0040B280
May, xrefs: 0040B272
Nov, xrefs: 0040B29C
Sun, xrefs: 0040B225
Oct, xrefs: 0040B295
Sep, xrefs: 0040B28E
Apr, xrefs: 0040B26B
Jan, xrefs: 0040B256
Fri, xrefs: 0040B248
Mar, xrefs: 0040B264
Aug, xrefs: 0040B287
Mon, xrefs: 0040B22C
Tue, xrefs: 0040B233
Wed, xrefs: 0040B23A
Jun, xrefs: 0040B279
Thu, xrefs: 0040B241
Dec, xrefs: 0040B2A3
Sat, xrefs: 0040B24F

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

PDu, xrefs: 0040139A
<, xrefs: 00401378
%systemroot%\system32\cmd.exe, xrefs: 00401316
useless, xrefs: 0040161E
uac, xrefs: 00401628
, xrefs: 00401462
@, xrefs: 00401380
wusa.exe, xrefs: 00401388
D, xrefs: 004015C6

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
born_date, xrefs: 00401EAD, 00401ECC
net_type, xrefs: 00401E87
start_srv, xrefs: 00401E6C
kernel32, xrefs: 00401DF7
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
lid_file_upd, xrefs: 00401E25
IsWow64Process, xrefs: 00401DF2
work_srv, xrefs: 00401E5E
loader_id, xrefs: 00401F4B, 00401F6B

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 01BA65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 01BA65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 01BA6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 01BA6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 01BA6652

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 11e5f4793ea04acf4d2f810d5cd764ab4a0277495068909ef4800a02a9697b0b
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 0211A3B1604219BFEB259F79DC05FDB3FA8EB057A5F044064FA08E7250D7B1DD0086A4

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 01BA092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 01BA09DC, 01BA09DF, 01BA09E4
l, xrefs: 01BA0966
., xrefs: 01BA095F

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: f7622bca67e8a0fabde06d80a345122eb701df6b79c10c88792d6d3f5031eead
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 4A318DB6904609DFEB14DF99C880AAEBBF5FF08324F54418AE841A7310D771EA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03fd4745e96db8b8e148b9ba84f42d287e57e518810e0ff804ed2376424d8b03
Instruction ID: d38669364c2824b197179c0a83fb8b6da93bb079ef524c7dff3da19512612e44
Opcode Fuzzy Hash: 03fd4745e96db8b8e148b9ba84f42d287e57e518810e0ff804ed2376424d8b03
Instruction Fuzzy Hash: 5C715BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790CBB86488CF98

Uniqueness

Uniqueness Score: -1.00%

Function 01C1FD48 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671898553.0000000001C1B000.00000040.00000020.00020000.00000000.sdmp, Offset: 01C1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c1b000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 6f20f355e19978d19393eca3ae304c83d516e1a07ca65d2cfe620551aad9505d
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 7011C272380101DFD700DF69DC90FB277EAEB8A220B598069ED14CB319E675E802C761

Uniqueness

Uniqueness Score: -1.00%

Function 01BA0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: a9288426af110887927f38d54eb2e1c204fe17af71f6a895adfea3484f7c3f4a
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0001F773A006009FDF26EF24C804BAE33E5EB86205F8940E4EA0697242E370A9418B80

Uniqueness

Uniqueness Score: -1.00%

Function 01BA9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 01BA9E6D
lstrcpy.KERNEL32(?,00000000), ref: 01BA9FE1
lstrcat.KERNEL32(?,?), ref: 01BA9FF2
lstrcat.KERNEL32(?,0041070C), ref: 01BAA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 01BAA054
DeleteFileA.KERNEL32(?), ref: 01BAA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 01BAA0D6
lstrcpy.KERNEL32 ref: 01BAA12F
lstrlen.KERNEL32(00000022), ref: 01BAA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 01BA9F13

Part of subcall function 01BA7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 01BA7081

Part of subcall function 01BA6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\kofydeki,01BA7043), ref: 01BA6F4E
Part of subcall function 01BA6F30: GetProcAddress.KERNEL32(00000000), ref: 01BA6F55
Part of subcall function 01BA6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 01BA6F7B
Part of subcall function 01BA6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 01BA6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 01BAA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 01BAA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 01BAA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 01BAA21B
GetDriveTypeA.KERNEL32(?), ref: 01BAA265
lstrcat.KERNEL32(?,00000000), ref: 01BAA29F
lstrcat.KERNEL32(?,00410A34), ref: 01BAA2C5
lstrcat.KERNEL32(?,00000022), ref: 01BAA2D9
lstrcat.KERNEL32(?,00410A34), ref: 01BAA2F4
wsprintfA.USER32 ref: 01BAA31D
lstrcat.KERNEL32(?,00000000), ref: 01BAA345
lstrcat.KERNEL32(?,?), ref: 01BAA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 01BAA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 01BAA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 01BAA1D1

Part of subcall function 01BA9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 01BA999D
Part of subcall function 01BA9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 01BA99BD
Part of subcall function 01BA9966: RegCloseKey.ADVAPI32(?), ref: 01BA99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 01BAA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 01BAA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 01BAA41D

Strings

P, xrefs: 01BAA011
", xrefs: 01BAA3F0
D, xrefs: 01BAA1F5
", xrefs: 01BAA142
\, xrefs: 01BA9F73
", xrefs: 01BAA2DF

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 840337fd80ca1390cf98264b212ab3c904ddb727a67e9a59ef406b4004719167
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: F7F130B1C44259AEDF25DBB4CC88EEF7BBCEB18304F8444E6E605E2141E7759A84CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 01BA7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 01BA7D21
GetUserNameA.ADVAPI32(?,?), ref: 01BA7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 01BA7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 01BA7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 01BA7DC0
EqualSid.ADVAPI32(?,?), ref: 01BA7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 01BA7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 01BA7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 01BA7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 01BA7E12
LocalFree.KERNEL32(00000000), ref: 01BA7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 01BA7E35

Strings

D, xrefs: 01BA7D73
PromptOnSecureDesktop, xrefs: 01BA7FA0

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: deaf6837e076087170967d9c33c9feff18e65c9de7742827fec301becc721fb7
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: C6A15071904219AFDF259FA4DD48FEEBFBDFB08301F4480A9E605E2150DB768A85CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

localcfg, xrefs: 0040672D
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
va=%08X%08X uef=%p, xrefs: 00406595
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
12:08:32, xrefs: 00406535
Jan 13 2018, xrefs: 0040653A
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
%d=%p, xrefs: 004066F9
except_info, xrefs: 00406728
plgs:, xrefs: 004066AA

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ehlo %s, xrefs: 0040A7F5
rcpt to:<%s>, xrefs: 0040A855
Too small respons, xrefs: 0040A9C9
helo %s, xrefs: 0040A803
localcfg, xrefs: 0040AB0B
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ESMTP, xrefs: 0040AA38
Incorrect respons, xrefs: 0040AB39
., xrefs: 0040A8CA
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
mail from:<%s>, xrefs: 0040A848
data, xrefs: 0040A85E
AUTH LOGIN, xrefs: 0040A80C
quit, xrefs: 0040A86C

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 01BA7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 01BA7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 01BA7ACD
GetLengthSid.ADVAPI32(?), ref: 01BA7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 01BA7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 01BA7B1F
EqualSid.ADVAPI32(?,?), ref: 01BA7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 01BA7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 01BA7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 01BA7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 01BA7B77
LocalFree.KERNEL32(00000000), ref: 01BA7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 01BA7B9A
GetAce.ADVAPI32(?,?,?), ref: 01BA7BCA
EqualSid.ADVAPI32(?,?), ref: 01BA7BF1
DeleteAce.ADVAPI32(?,?), ref: 01BA7C0A
EqualSid.ADVAPI32(?,?), ref: 01BA7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 01BA7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 01BA7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 01BA7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 01BA7CE0
LocalFree.KERNEL32(00000000), ref: 01BA7CEE

Strings

D, xrefs: 01BA7AC3

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 154fb69196c4edf94e1570a8a24e1f2b794250cb37dd7f883ef3840bcdee17d4
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: B0814E71908219AFDB15CFA4DD44FEEBFB8EF08300F4481BAE605E6150EB769645CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4
localcfg, xrefs: 004019A3
123.45.67.89, xrefs: 004019A6
GetAdaptersInfo, xrefs: 004019DC
GetBestInterface, xrefs: 004019EF

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 01BA858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 01BA865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 01BA867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 01BA86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 01BA86B1

Strings

PromptOnSecureDesktop, xrefs: 01BA85B6, 01BA8645, 01BA86BD, 01BA8708, 01BA87C5, 01BA8812, 01BA88E9, 01BA8905
", xrefs: 01BA896C

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 98cef93c622c76c28ef1122a60446c3e7b1ceb8cbc6e6f143ea161a6437f54ba
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 00C1C4B1944109BEFF15ABA8EC84EEF7FBDEB18301F5440E5F604E6050EB704A948B65

Uniqueness

Uniqueness Score: -1.00%

Function 01BA14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 01BA1601
lstrlenW.KERNEL32(-00000003), ref: 01BA17D8

Strings

<, xrefs: 01BA15DF
D, xrefs: 01BA182D
, xrefs: 01BA16C9
@, xrefs: 01BA15E7

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: dbec250d873bfd32235f88a1ca9f436a2f89b3ed8de6859b79b937f9834d023d
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 2FF19FB15083419FD724CF68C888BABBBE5FB88304F80896DF69697390D7B4D944CB56

Uniqueness

Uniqueness Score: -1.00%

Function 01BA7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 01BA76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 01BA7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 01BA778F
___ascii_stricmp.LIBCMT ref: 01BA78B4
RegCloseKey.ADVAPI32(?), ref: 01BA794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 01BA796D
RegCloseKey.ADVAPI32(?), ref: 01BA797E
RegCloseKey.ADVAPI32(?), ref: 01BA79AC
RegCloseKey.ADVAPI32(?), ref: 01BA7A56

Part of subcall function 01BAF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,01BA772A,?), ref: 01BAF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 01BA79F6
RegCloseKey.ADVAPI32(?), ref: 01BA7A4D

Strings

", xrefs: 01BA7800
PromptOnSecureDesktop, xrefs: 01BA76C5, 01BA76CA, 01BA76E5, 01BA7782, 01BA77E6, 01BA7862, 01BA787B, 01BA79C2

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 0df2ac55ec15c26ccd376e453ddbc45771a6e97e69a2a5f124d81ac36deb45b3
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 15C1847190C10ABBEF259FA8DC44FEE7BB9EF55310F9440E6E504E6150EF729A848B60

Uniqueness

Uniqueness Score: -1.00%

Function 01BA2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 01BA2CED
socket.WS2_32(00000002,00000002,00000011), ref: 01BA2D07
htons.WS2_32(00000000), ref: 01BA2D42
select.WS2_32 ref: 01BA2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 01BA2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 01BA2E62

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 0c407ff5aa5cfbd3363c3443276a1f7afa6302e656a43c7c48ad310ba9dc8fba
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 7A61057150C305AFC729AF64DC48B6BBBE8FB48341F4048D9FA8897151D7B5D8848BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%s%d, xrefs: 0040AE58
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_HST, xrefs: 0040AEC5
127.0.0.1, xrefs: 0040ADEB

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 01BA958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 01BA95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 01BA95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 01BA95DC
wsprintfA.USER32 ref: 01BA9635
wsprintfA.USER32 ref: 01BA9673
wsprintfA.USER32 ref: 01BA96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 01BA9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 01BA978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 01BA97D8

Strings

PromptOnSecureDesktop, xrefs: 01BA9604, 01BA9624, 01BA9662, 01BA9683, 01BA96B6, 01BA96DF, 01BA9701, 01BA9734, 01BA9780, 01BA97B7

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: d0921e2365c1bff9afb475d9790d0106b33abe0729cba344b647963a7ec55810
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: AAA19CB1904208EBEF29DFA4CC84FDE3BACEB04744F5040A6FA15D2151E7B5D9849BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77
86A, xrefs: 0040BF98
06A, xrefs: 0040BF70
46A, xrefs: 0040BF85
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_HASH, xrefs: 0040B4B0
%TO_USER, xrefs: 0040B488
%FROM_DOMAIN, xrefs: 0040B41E
%DATE, xrefs: 0040B4D2
%M5DATE, xrefs: 0040B50F
%FROM_EMAIL, xrefs: 0040B3E9
%TO_DOMAIN, xrefs: 0040B44B
%s@%s, xrefs: 0040B461
%TO_EMAIL, xrefs: 0040B473
%FROM_USER, xrefs: 0040B431
%P5DATE, xrefs: 0040B4F2

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 01BA3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 01BA3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 01BA3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 01BA3095
RtlAllocateHeap.NTDLL(00000000), ref: 01BA30B6
htons.WS2_32(00000035), ref: 01BA30EF
inet_addr.WS2_32(?), ref: 01BA30FA
gethostbyname.WS2_32(?), ref: 01BA310D
HeapFree.KERNEL32(00000000), ref: 01BA314D

Strings

iphlpapi.dll, xrefs: 01BA3062, 01BA3067, 01BA3077

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: b817f1597e199ab4dbe396c61b7621fed9c74f030b1f56632ef56c06fb6d62cc
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: A531D631A04606ABEF159BBD9C48BAE7BF8FF04360F5441A5E618E32A0DB74E5418B58

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 01BA6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 01BA67C3
htonl.WS2_32(?), ref: 01BA67DF
htonl.WS2_32(?), ref: 01BA67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 01BA68F1
ExitProcess.KERNEL32 ref: 01BA69BC

Strings

localcfg, xrefs: 01BA6994
except_info, xrefs: 01BA698F

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: d3fe59b055f06adc5bab866fac99d4a6617e837cdd138f42e90a02869a4fdad0
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 8A617EB1A40208AFDF649FB4DC45FEA77E9FB08300F14806AFA6DD2161EB7599948F14

Uniqueness

Uniqueness Score: -1.00%

Function 01BAF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(01BACC84), ref: 01BAF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 01BAF5CE
closesocket.WS2_32(00000000), ref: 01BAF5DC

Strings

time_cfg, xrefs: 01BAF58A

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: fb939f77be6905a3aad12d27ab332ea98117b704b2f5162a63c470b5c75825a0
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: C2315A72904119ABDB11DFA9DC88DEE7BBCEF88310F5045AAF915E3150E7709A81CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 01BA2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 01BA2FA1
LoadLibraryA.KERNEL32(?), ref: 01BA2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 01BA2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 01BA3000
RtlAllocateHeap.NTDLL(00000000), ref: 01BA3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 01BA3032

Strings

dnsapi.dll, xrefs: 01BA2F90

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: dfc353f720bc6f83d1acfffa06d8e7319a6b9b2d6c5ceeb2a2921108af891ef3
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 2121A471944225BBCB229B58DC44AEEBFBCFF08B10F4084A1F901E7150D7B59A8187D4

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 01BA6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\kofydeki,01BA7043), ref: 01BA6F4E
GetProcAddress.KERNEL32(00000000), ref: 01BA6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 01BA6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 01BA6F92

Strings

C:\Windows\SysWOW64\, xrefs: 01BA6F30, 01BA6F38, 01BA6F65, 01BA6F6C, 01BA6F7A, 01BA6F85, 01BA6F91, 01BA6FA9, 01BA6FC6, 01BA6FEC
PromptOnSecureDesktop, xrefs: 01BA6F9D, 01BA6FBF, 01BA6FCF, 01BA6FE5, 01BA6FF5
\\.\pipe\kofydeki, xrefs: 01BA6F37

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\kofydeki
API String ID: 1082366364-34391367
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 752ad4b3389728f3932b5d96b692ddd5f9ef73d66be85e54c07e1b2e681fe47d
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 6421F26178834179F73A67399C88FFB2E4CCB66710F9840E9F504D6081DBDA84D682AD

Uniqueness

Uniqueness Score: -1.00%

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 01BA92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 01BA92E2
wsprintfA.USER32 ref: 01BA9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 01BA9375
lstrlen.KERNEL32(?,?,00000000), ref: 01BA9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 01BA9394
CloseHandle.KERNEL32(00000000), ref: 01BA939B

Strings

PromptOnSecureDesktop, xrefs: 01BA932B, 01BA9343, 01BA935E

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 06dc13e205dacc6574d412b54c9edc31cab6aea0870b8e70fbc978fee3081191
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 781184B17441147BFB287B32EC0DFEF3A6DDBD8B11F4080A5BB09E5090EBB59A418664

Uniqueness

Uniqueness Score: -1.00%

Function 01BA99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 01BA9A18
GetThreadContext.KERNEL32(?,?), ref: 01BA9A52
TerminateProcess.KERNEL32(?,00000000), ref: 01BA9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 01BA9A98
SetThreadContext.KERNEL32(?,00010002), ref: 01BA9AB5
ResumeThread.KERNEL32(?), ref: 01BA9AC2

Strings

D, xrefs: 01BA9A10

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 1eabe425df1386ccb734e9f5822cd8d1c6b3f6da563b98aeb15e69e8075d481e
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: E7213BB1A05219BBDF219BA1DC49EEF7FBCEF08754F8040A1FA19E5050E7758A44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01BA1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 01BA1C18
LoadLibraryA.KERNEL32(004102C8), ref: 01BA1C26
GetProcessHeap.KERNEL32 ref: 01BA1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 01BA1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 01BA1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 01BA1D02
FreeLibrary.KERNEL32(?), ref: 01BA1D0B

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 7dea643b570ad01e1f4406c32df8cf67750c871cf3b41f57884638fd892807db
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: B8315E31D04219BFDB55AFA8DC888AEBEB9EB45301F6444BAE601A6110D7B54E80CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01BA6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 01BA6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 01BA6D22
GetLastError.KERNEL32 ref: 01BA6DA7
CloseHandle.KERNEL32(?), ref: 01BA6DB5
GetLastError.KERNEL32 ref: 01BA6DD6
DeleteFileA.KERNEL32(?), ref: 01BA6DE7
GetLastError.KERNEL32 ref: 01BA6DFD

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: bd50fe4483f859d446ad0c864689f4b0d6f15c57ebc6dd1e9b8d17f798c2ea7d
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6F3123B2804249BFDB05DFA8DD48ADE7F78EB48340F4881A5E291E3250D7708A858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 01BA93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 01BA93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 01BA93CD
CharToOemA.USER32(?,?), ref: 01BA93DB
wsprintfA.USER32 ref: 01BA9410

Part of subcall function 01BA92CB: GetTempPathA.KERNEL32(00000400,?), ref: 01BA92E2
Part of subcall function 01BA92CB: wsprintfA.USER32 ref: 01BA9350
Part of subcall function 01BA92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 01BA9375
Part of subcall function 01BA92CB: lstrlen.KERNEL32(?,?,00000000), ref: 01BA9389
Part of subcall function 01BA92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 01BA9394
Part of subcall function 01BA92CB: CloseHandle.KERNEL32(00000000), ref: 01BA939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 01BA9448

Strings

PromptOnSecureDesktop, xrefs: 01BA93FA, 01BA93FF, 01BA941C

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 65f24feee07d5feac568e6077fc3f8410726befaf008420350189a4bbba9a9ff
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 01019EF69001187BEB21A7619D89EDF3B7CDB95701F0000A2BB09E2080EBB49BC48F75

Uniqueness

Uniqueness Score: -1.00%

Function 01BAAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 01BAAAE5

Strings

, xrefs: 01BAABB3
localcfg, xrefs: 01BAAD72

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction ID: 074c13fcb9bf45fdc4ca3d2f7794d19ee6bb1e94e207356d86dd99aaa347a78f
Opcode Fuzzy Hash: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction Fuzzy Hash: 3D712A71A4C3056BEF399A78DC85FEE3B69DB00704FA404EAFA45A30D0DB629584C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 01BAE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01BADF6C: GetCurrentThreadId.KERNEL32 ref: 01BADFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 01BAE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,01BA6128), ref: 01BAE950
lstrcmp.KERNEL32(?,00000008), ref: 01BAE989

Strings

A, xrefs: 01BAE8C6, 01BAE8CD, 01BAE936, 01BAE998
A, xrefs: 01BAE9A0
A, xrefs: 01BAE960, 01BAE965

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: ce89ffb482e53db0b8bbff6c874050dd996fa981decb13d49e7d22f9605b7d2a
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 5531C431608706DBDF7ACF28C884BAA7BE4FF05720F8085ABE65587551D370E884CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01BA6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 01BA6E19

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 39db06b2da2632014b00f20b98b2dba888d1bb45191fcb192d212d80ea2b86fb
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 12216DB2208115FFDB19AB74EC48EDF7FADDB48260B5485A1F602D1090EB70DA009674

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 01BAC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 01BAC6B4
InterlockedIncrement.KERNEL32(01BAC74B), ref: 01BAC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,01BAC747), ref: 01BAC728
CloseHandle.KERNEL32(00000000,?,01BAC747,00413588,01BA8A77), ref: 01BAC733

Strings

localcfg, xrefs: 01BAC544

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: d42521b93ca9f295ec90a86199a0acdf29f305e2f107a0c361cf24c8c2195f49
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: B55115B1A05B418FD7688F6DC68562ABFE9FB48300B90597EE18BC7A90D774F8448B50

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 01BAE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,01BAE50A,00000000,00000000,00000000,00020106,00000000,01BAE50A,00000000,000000E4), ref: 01BAE319
RegSetValueExA.ADVAPI32(01BAE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 01BAE38E
RegDeleteValueA.ADVAPI32(01BAE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 01BAE3BF
RegCloseKey.ADVAPI32(01BAE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,01BAE50A), ref: 01BAE3C8

Strings

PromptOnSecureDesktop, xrefs: 01BAE33A

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 68f93ae01dacd65650f38b19bf8d6053cf183d76481fc8baba7f937db0cf19a2
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: AA217C31A0421DBBDF219FA8EC88EEE7FB8EF08750F4080A1F904A6051E771CA54C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 01BA71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 01BA71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 01BA7228
LocalFree.KERNEL32(?,?,?), ref: 01BA7286
wsprintfA.USER32 ref: 01BA729D

Strings

|, xrefs: 01BA721A

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 2b4c9d1f75f84e8468592d64fabc699806b0c6fe6daf9424d4bf407636691f39
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 52314B72A08209BFDB05DFA8DC44ADE3BACEF04310F14C0A6F959DB101EB75E6488B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 01BAB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 01BAB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 01BAB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 01BAB548
GetTimeZoneInformation.KERNEL32(?), ref: 01BAB590
wsprintfA.USER32 ref: 01BAB61E

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 256986010881a7c502806f9f047562f9cd4b9b533d37586ba76adbcd853e40ba
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 8B513FB1D0021DAACF18DFD5D9885EEBBB9FF48304F50816AF511A6150E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 01BA62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 01BA6303
LoadLibraryA.KERNEL32(?), ref: 01BA632A
GetProcAddress.KERNEL32(00000000,?), ref: 01BA63B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 01BA6405

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 99ca3721b7738516c823628d2907f0151cda862059dc3b68f2a54df60e807a0d
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: A6416DB1A08205EFEB18CF5CC884AADBBF5FF04354F5881A9E915D7290DB71E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 01BAE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 01BADF6C: GetCurrentThreadId.KERNEL32 ref: 01BADFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,01BAA6AC), ref: 01BAE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,01BAA6AC), ref: 01BAE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,01BAA6AC), ref: 01BAE819

Strings

PromptOnSecureDesktop, xrefs: 01BAE840, 01BAE845, 01BAE87C, 01BAE89B

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 0f0a07f658bc98a62b17f2b9161086beb5a76d130b14b5aeed5b86ded1eead9d
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: B92137B1A483023AFA257B759C05FEB3E0CCB74760F9000A5BA09A11D2EB65D55082B5

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 01BA7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 01BA76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 01BA796D
RegCloseKey.ADVAPI32(?), ref: 01BA797E

Strings

PromptOnSecureDesktop, xrefs: 01BA76C5, 01BA76CA, 01BA76E5

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 80cad8bdb78226bb900a4667f59d5cc37705c6b554b6f09df3521380fd4ebeaf
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: A011D370A08109AFEB128FADDC44FEFBF79EF55710F540195F615E6290EBB289408B60

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 01BA9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 01BA999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 01BA99BD
RegCloseKey.ADVAPI32(?), ref: 01BA99C6

Strings

PromptOnSecureDesktop, xrefs: 01BA9989, 01BA998E, 01BA99B0, 01BA99D3

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 8d9a5144cedc6703a6f117e77f04b309b17ccef7352bb4aafdde3deeb802fa4b
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 6EF0C2B2680208BBF7116B54EC06FDF3A2CDB94B14F5000A0FA05B5081F7E59F9082B9

Uniqueness

Uniqueness Score: -1.00%

Function 01BA28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 01BA28FA
gethostbyname.WS2_32(u6A), ref: 01BA2906

Strings

u6A, xrefs: 01BA28EC, 01BA28F9, 01BA2905
time_cfg, xrefs: 01BA28EB

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 5d02147f21a0653b5fd121cbe75de5db8d443bd760461e2ad4d9de345225a20d
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: EBE0C7306082218FDB418B2CF848ACA3BE4EF0A230F4081D1F080C32A1C734DCC0AB80

Uniqueness

Uniqueness Score: -1.00%

Function 01BA69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 01BA69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 01BA6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 01BA6A3A
CloseHandle.KERNEL32(000000FF), ref: 01BA6BD8

Part of subcall function 01BAEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,01BA1DCF,?), ref: 01BAEEA8
Part of subcall function 01BAEE95: HeapFree.KERNEL32(00000000), ref: 01BAEEAF

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: c0b6b90bdb1c2aa2888dbe4c2fb6ab4a43461667529e3ef616a84d1df39de95c
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 8E7139B190421DEFDF15DFA8CC81AEEBBB9FB04310F9445AAE615E6190D7309E92CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 01BA41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 01BA421F
GetLastError.KERNEL32 ref: 01BA4229
WaitForSingleObject.KERNEL32(?,?), ref: 01BA423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 01BA424D

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 2370c1be5bef78155c05964b52c5e782cd177164a2602fb5d63c45119a93559e
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: C2010872525209AFDF02DF94EE84BEF7BACEB08255F4080A1F901E2050D7B0DA548BB6

Uniqueness

Uniqueness Score: -1.00%

Function 01BA417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 01BA41AB
GetLastError.KERNEL32 ref: 01BA41B5
WaitForSingleObject.KERNEL32(?,?), ref: 01BA41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 01BA41D9

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: a66f7c0ff47d6c2dbdf5365186ea53f8370a3912ae96fcd19630af024545524c
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: FC014C7651110AAFDF01DF95EE85BEF3F6CEB18255F4044A1F901E2050D7B0EA508BB5

Uniqueness

Uniqueness Score: -1.00%

Function 01BAE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 01BAE066

Strings

A, xrefs: 01BAE07F
A, xrefs: 01BAE037, 01BAE03C
A, xrefs: 01BAE036

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 505886568bbe30f9f83443c29009d1bf0f795da9eb0fc77666a0515e8b0edcfb
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 08F09631204702DBCB35CF29D884A82BBE9FF0D321B8486ABE254D3060D374E4D8CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 01BAE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,01BA44E2,00000000,00000000,00000000), ref: 01BAE470
CloseHandle.KERNEL32(00000001,00000003), ref: 01BAE484

Part of subcall function 01BAE2FC: RegCreateKeyExA.ADVAPI32(80000001,01BAE50A,00000000,00000000,00000000,00020106,00000000,01BAE50A,00000000,000000E4), ref: 01BAE319
Part of subcall function 01BAE2FC: RegSetValueExA.ADVAPI32(01BAE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 01BAE38E
Part of subcall function 01BAE2FC: RegDeleteValueA.ADVAPI32(01BAE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 01BAE3BF
Part of subcall function 01BAE2FC: RegCloseKey.ADVAPI32(01BAE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,01BAE50A), ref: 01BAE3C8

Strings

PromptOnSecureDesktop, xrefs: 01BAE4F1, 01BAE4F6, 01BAE537, 01BAE561

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 1b44ce79708feb50d55b6ef8243038ac6131803d3536fcc7b3abf3b17687b38d
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 2041E4B2904205BAFF256A658C45FEF3F6CEB14720F8480A5FA09A4091E7B5C650DAB4

Uniqueness

Uniqueness Score: -1.00%

Function 01BA8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 01BA83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 01BA8477

Part of subcall function 01BA69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 01BA69E5
Part of subcall function 01BA69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 01BA6A26
Part of subcall function 01BA69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 01BA6A3A

Part of subcall function 01BAEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,01BA1DCF,?), ref: 01BAEEA8
Part of subcall function 01BAEE95: HeapFree.KERNEL32(00000000), ref: 01BAEEAF

Strings

PromptOnSecureDesktop, xrefs: 01BA83B2, 01BA83B7, 01BA8483

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: f1993923d1aa1e32b3168624599c6b09ef980c6e95260b28464a0facb15d031d
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 7C4183B2908109BFEF19EBA49D80DFF7B6DEB14241F8444EAE604D6410FBB05A948B60

Uniqueness

Uniqueness Score: -1.00%

Function 01BAE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,01BAE859,00000000,00020119,01BAE859,PromptOnSecureDesktop), ref: 01BAE64D
RegCloseKey.ADVAPI32(01BAE859,?,?,?,?,000000C8,000000E4), ref: 01BAE787

Strings

PromptOnSecureDesktop, xrefs: 01BAE637

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: ecf8252683ef69dcf0eede2d3d7e369c9df8db30978836e9e8a49ae9ca14bc18
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 134118B2D0011DBFDF16EFE8DC80DEEBB7DEB18204F5444A6EA00B6160E7719A558B60

Uniqueness

Uniqueness Score: -1.00%

Function 01BAAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 01BAAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 01BAB00D

Part of subcall function 01BAAF6F: gethostname.WS2_32(?,00000080), ref: 01BAAF83
Part of subcall function 01BAAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 01BAAFE6

Part of subcall function 01BA331C: gethostname.WS2_32(?,00000080), ref: 01BA333F
Part of subcall function 01BA331C: gethostbyname.WS2_32(?), ref: 01BA3349

Part of subcall function 01BAAA0A: inet_ntoa.WS2_32(00000000), ref: 01BAAA10

Strings

%OUTLOOK_BND_, xrefs: 01BAB076, 01BAB07B, 01BAB0BE, 01BAB0DD

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction ID: f67500593b6afbc170667991d070cc478a445b8f493409e5d5beed8195ed4146
Opcode Fuzzy Hash: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction Fuzzy Hash: 3D416FB294420DBBDF29EFA0DC45EEE3BACFF08300F54446AF92492151EB75E6548B54

Uniqueness

Uniqueness Score: -1.00%

Function 01BA9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 01BA9536
Sleep.KERNEL32(000001F4), ref: 01BA955D

Strings

, xrefs: 01BA94D9

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 4f8fba44abeb9325a867333fa181800754c2ae6294f51994a6547da229821ebb
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: AE41157180C3856EFB3E9A6CD88A7A63FA4DB02318F9801E6D1C297193DBB44980A711

Uniqueness

Uniqueness Score: -1.00%

Function 01BABC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 01BAB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 01BABA3A
InterlockedIncrement.KERNEL32(?), ref: 01BABA94
GetTickCount.KERNEL32 ref: 01BABB79
GetTickCount.KERNEL32 ref: 01BABB99
InterlockedIncrement.KERNEL32(?), ref: 01BABE15
closesocket.WS2_32(00000000), ref: 01BABEB4

Strings

%FROM_EMAIL, xrefs: 01BABC7D

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: afa0547b371741be9d5d3903b34201da053b6411a3563b1678aac9998f8c808a
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 7F318D71408248EFDF29DFA8DD84AED7BB8EB48700FA0459AFA2492161DB35D685CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 01BA709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 01BA70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 01BA70F4

Strings

|, xrefs: 01BA70E6

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: c5c1ab7675ed70dbd045831a7394acb45e84347f45df87013a7f5f9d0697f274
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: B4112A72908118EBDB15CBD5DC84ADEBBFEEB04311F5441B6E601E6090DB75AB888BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.1670084259.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670084259.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Function 01BA3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01BA2F88: GetModuleHandleA.KERNEL32(?), ref: 01BA2FA1
Part of subcall function 01BA2F88: LoadLibraryA.KERNEL32(?), ref: 01BA2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 01BA31DA
HeapFree.KERNEL32(00000000), ref: 01BA31E1

Memory Dump Source

Source File: 00000000.00000002.1671514496.0000000001BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ba0000_OgcktrbHkI.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: d3e3a4eba048e0db04bf9e4cad878aa97d9f5469a91e8decbb2cf3a060a5f8a5
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 2351A131908206AFCF1ADF68D8849F9B7B5FF05304F5445A9EC96C7221E772DA19CB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: pspizbvl.exePID: 3156, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	0%
Total number of Nodes:	1562
Total number of Limit Nodes:	14

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\OgcktrbHkI.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

D, xrefs: 00409F8E
", xrefs: 0040A078
", xrefs: 00409EDB
\, xrefs: 00409D0C
C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 0040A1D9
", xrefs: 0040A189
P, xrefs: 00409DAA
C:\Users\user\Desktop\OgcktrbHkI.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
kofydeki, xrefs: 0040A389, 0040A397
%X%08X, xrefs: 0040A0B0

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\OgcktrbHkI.exe$C:\Windows\SysWOW64\kofydeki\pspizbvl.exe$D$P$\$kofydeki
API String ID: 2089075347-1782248800
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0231003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0231024D

Strings

cess, xrefs: 0231018D
kernel32.dll, xrefs: 0231008F, 02310095

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 7e658349ad4e2d10a3515a5c930ecc06e71732694fcc51982e59041b39fbfa7e
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 06526A74A01229DFDB68CF58C984BACBBB5BF09304F1480D9E94DAB351DB30AA95CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Strings

Xw, xrefs: 00406E06

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID: Xw
API String ID: 1823874839-290828094
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Uniqueness

Uniqueness Score: -1.00%

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Uniqueness

Uniqueness Score: -1.00%

Function 01B49AD3 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 01B49AFB
Module32First.KERNEL32(00000000,00000224), ref: 01B49B1B

Memory Dump Source

Source File: 0000000B.00000002.1671238466.0000000001B45000.00000040.00000020.00020000.00000000.sdmp, Offset: 01B45000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1b45000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 361a133d80c5a9d458465358882b70accb6d04651527dab29cdb29cb02a30aa0
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 67F062352007116FEB243AB9A88DB6B76E8EF4D668F504568E686D10C0DB70E8455661

Uniqueness

Uniqueness Score: -1.00%

Function 02310E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02310223,?,?), ref: 02310E19
SetErrorMode.KERNELBASE(00000000,?,?,02310223,?,?), ref: 02310E1E

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d62b7a4beade2913b5db3dbd4b9804181903281294fc2242620614750d44505c
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BCD0123114512877DB002A95DC09BCD7B1CDF09B66F008011FB0DD9080C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Uniqueness

Uniqueness Score: -1.00%

Function 01B49792 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 01B497E3

Memory Dump Source

Source File: 0000000B.00000002.1671238466.0000000001B45000.00000040.00000020.00020000.00000000.sdmp, Offset: 01B45000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1b45000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a834c87a22ab912ad6b47cefe11e42823467d494260ddadcef3589fa481ae2d3
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 2F112D79A00208EFDB01DF98C985E99BBF5EF08751F05C094F9489B361D371EA50EB80

Uniqueness

Uniqueness Score: -1.00%

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 023165E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 023165F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02316610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02316631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02316652

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 3170f5670fd1400a43442dc388588fd049888845910d3d678356c0555984b8b6
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: EE117371600218BFDB259FA5DC46F9B3FACEB057A5F104024FA08E7250D7B1DD00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 02319EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02319E6D
lstrcpy.KERNEL32(?,00000000), ref: 02319FE1
lstrcat.KERNEL32(?,?), ref: 02319FF2
lstrcat.KERNEL32(?,0041070C), ref: 0231A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0231A054
DeleteFileA.KERNEL32(?), ref: 0231A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0231A0D6
lstrcpy.KERNEL32 ref: 0231A12F
lstrlen.KERNEL32(00000022), ref: 0231A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 02319F13

Part of subcall function 02317029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02317081

Part of subcall function 02316F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\kofydeki,02317043), ref: 02316F4E
Part of subcall function 02316F30: GetProcAddress.KERNEL32(00000000), ref: 02316F55
Part of subcall function 02316F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02316F7B
Part of subcall function 02316F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02316F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0231A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0231A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0231A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0231A21B
GetDriveTypeA.KERNEL32(?), ref: 0231A265
lstrcat.KERNEL32(?,00000000), ref: 0231A29F
lstrcat.KERNEL32(?,00410A34), ref: 0231A2C5
lstrcat.KERNEL32(?,00000022), ref: 0231A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0231A2F4
wsprintfA.USER32 ref: 0231A31D
lstrcat.KERNEL32(?,00000000), ref: 0231A345
lstrcat.KERNEL32(?,?), ref: 0231A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0231A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0231A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0231A1D1

Part of subcall function 02319966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0231999D
Part of subcall function 02319966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 023199BD
Part of subcall function 02319966: RegCloseKey.ADVAPI32(?), ref: 023199C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0231A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0231A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0231A41D

Strings

\, xrefs: 02319F73
P, xrefs: 0231A011
D, xrefs: 0231A1F5
", xrefs: 0231A2DF
", xrefs: 0231A3F0
", xrefs: 0231A142

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 82ac90d7a508060eb73ae37154a705a98113c54803ddfb3096c338452fa329c4
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: F6F14EB1D41259AFDF25DBA0CD48FEF7BBCAB08305F0484A6E609E2141E7758A85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlLengthSid, xrefs: 00401246
RtlFreeSid, xrefs: 00401116
NtFilterToken, xrefs: 0040122B
NtSetInformationThread, xrefs: 00401155
NtOpenProcessToken, xrefs: 004011D4
NtSetInformationToken, xrefs: 00401175
NtTerminateProcess, xrefs: 004010F6
RtlSetLastWin32Error, xrefs: 004010D6
NtClose, xrefs: 004011B4
ntdll.dll, xrefs: 0040100D
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtQueryInformationToken, xrefs: 00401262
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlInitUnicodeString, xrefs: 00401135
NtDuplicateToken, xrefs: 004011F3
RtlNtStatusToDosError, xrefs: 00401194

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Feb, xrefs: 0040B25D
Jan, xrefs: 0040B256
Jul, xrefs: 0040B280
May, xrefs: 0040B272
Fri, xrefs: 0040B248
Jun, xrefs: 0040B279
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Dec, xrefs: 0040B2A3
Sun, xrefs: 0040B225
Sat, xrefs: 0040B24F
Sep, xrefs: 0040B28E
Tue, xrefs: 0040B233
Oct, xrefs: 0040B295
Aug, xrefs: 0040B287
Mar, xrefs: 0040B264
Nov, xrefs: 0040B29C
Apr, xrefs: 0040B26B
Thu, xrefs: 0040B241
Wed, xrefs: 0040B23A
Mon, xrefs: 0040B22C

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe$D
API String ID: 2976863881-4275784296
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 02317CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02317D21
GetUserNameA.ADVAPI32(?,?), ref: 02317D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02317D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02317DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02317DC0
EqualSid.ADVAPI32(?,?), ref: 02317DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 02317DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02317DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02317E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02317E12
LocalFree.KERNEL32(00000000), ref: 02317E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02317E35

Strings

C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 02317F49, 02317F76, 02317F8A, 02317F8B
D, xrefs: 02317D73

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe$D
API String ID: 2976863881-4275784296
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: ad09d0e3abbfeb8399ef95bc62685064a48aa8ce30a4a89f31db09f7cd17d2c2
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: DEA15C71900219AFDF25CFA0DD88FEFBBB9FB08744F04816AE505E6150D7758A85CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

12:08:32, xrefs: 00406535
except_info, xrefs: 00406728
Jan 13 2018, xrefs: 0040653A
va=%08X%08X uef=%p, xrefs: 00406595
%d=%p, xrefs: 004066F9
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
plgs:, xrefs: 004066AA

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Too small respons, xrefs: 0040A9C9
quit, xrefs: 0040A86C
localcfg, xrefs: 0040AB0B
Too big smtp respons (%d bytes), xrefs: 0040A9B1
mail from:<%s>, xrefs: 0040A848
Incorrect respons, xrefs: 0040AB39
ehlo %s, xrefs: 0040A7F5
AUTH LOGIN, xrefs: 0040A80C
data, xrefs: 0040A85E
., xrefs: 0040A8CA
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
ESMTP, xrefs: 0040AA38
rcpt to:<%s>, xrefs: 0040A855
helo %s, xrefs: 0040A803

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 02317A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02317A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02317ACD
GetLengthSid.ADVAPI32(?), ref: 02317ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02317B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02317B1F
EqualSid.ADVAPI32(?,?), ref: 02317B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 02317B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02317B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02317B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02317B77
LocalFree.KERNEL32(00000000), ref: 02317B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02317B9A
GetAce.ADVAPI32(?,?,?), ref: 02317BCA
EqualSid.ADVAPI32(?,?), ref: 02317BF1
DeleteAce.ADVAPI32(?,?), ref: 02317C0A
EqualSid.ADVAPI32(?,?), ref: 02317C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 02317CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02317CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02317CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02317CE0
LocalFree.KERNEL32(00000000), ref: 02317CEE

Strings

D, xrefs: 02317AC3

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: bc31c73902cf4e2d493e5df7250bd3821d86c55abbc62122a6c5751c8fe9e6f4
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: B2814D71900219AFDB25CFA4DD84FEEFBB8AF08304F18806AE505E6150D7759681CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe$localcfg
API String ID: 237177642-3039148244
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

D, xrefs: 004015C6
PDu, xrefs: 0040139A
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388
@, xrefs: 00401380
useless, xrefs: 0040161E
, xrefs: 00401462
<, xrefs: 00401378
uac, xrefs: 00401628

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
IsWow64Process, xrefs: 00401DF2
work_srv, xrefs: 00401E5E
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
net_type, xrefs: 00401E87
start_srv, xrefs: 00401E6C
lid_file_upd, xrefs: 00401E25
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
born_date, xrefs: 00401EAD, 00401ECC
kernel32, xrefs: 00401DF7
loader_id, xrefs: 00401F4B, 00401F6B

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
localcfg, xrefs: 004019A3
Iphlpapi.dll, xrefs: 004019B7
123.45.67.89, xrefs: 004019A6
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 0231858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0231865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0231867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 023186A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 023186B1

Strings

", xrefs: 0231896C
C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 0231882F, 0231883C, 0231884C

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\kofydeki\pspizbvl.exe
API String ID: 237177642-1820161509
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: cff93fcabb00d2bcde662d5c60f93278ffa39ce72e008b1e48cda1135874903d
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 41C1A272900248BEFB25ABA4DD85EEF7BBDEF09304F144075F604E6050E7714A958F69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 023114E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02311601
lstrlenW.KERNEL32(-00000003), ref: 023117D8

Strings

D, xrefs: 0231182D
@, xrefs: 023115E7
, xrefs: 023116C9
<, xrefs: 023115DF

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 872cee8d794dbd93f35a37c63cadaac210a0bbb517128ff6a8210d84671d8feb
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 0EF16AB15083419FD724DF64C888BAABBF9FB89304F00892DF6DA97290D7B49944CB56

Uniqueness

Uniqueness Score: -1.00%

Function 02317666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 023176D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02317757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0231778F
___ascii_stricmp.LIBCMT ref: 023178B4
RegCloseKey.ADVAPI32(?), ref: 0231794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0231796D
RegCloseKey.ADVAPI32(?), ref: 0231797E
RegCloseKey.ADVAPI32(?), ref: 023179AC
RegCloseKey.ADVAPI32(?), ref: 02317A56

Part of subcall function 0231F40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,0231772A,?), ref: 0231F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 023179F6
RegCloseKey.ADVAPI32(?), ref: 02317A4D

Strings

", xrefs: 02317800

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 024d6bac869c7b67101c059a96f94f35e1f4a98929cb99493f1b8a0c9696cea4
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 22C18172900209AFDB299FA4DC45FEEBBB9EF49310F1840A5E504E6190EB71DA84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 004072D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 02312CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02312CED
socket.WS2_32(00000002,00000002,00000011), ref: 02312D07
htons.WS2_32(00000000), ref: 02312D42
select.WS2_32 ref: 02312D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 02312DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02312E62

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: cceedd1950b7870d7536d5fb0bbaaf984dcefb17d6b2ecd3d1cb8c0688410f7a
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: BD610371904329AFC3249F64DC08B6BBBF8FB88B45F004819FD8897151D7B4D880CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
127.0.0.1, xrefs: 0040ADEB

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74DF0F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,74DF0F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,74DF0F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_USER, xrefs: 0040B488
%TO_DOMAIN, xrefs: 0040B44B
%P5DATE, xrefs: 0040B4F2
%DATE, xrefs: 0040B4D2
%FROM_USER, xrefs: 0040B431
%M5DATE, xrefs: 0040B50F
%FROM_DOMAIN, xrefs: 0040B41E
%FROM_EMAIL, xrefs: 0040B3E9
%TO_EMAIL, xrefs: 0040B473
%s@%s, xrefs: 0040B461
%TO_HASH, xrefs: 0040B4B0

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 02313059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02313068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02313078
GetProcAddress.KERNEL32(00000000,00410408), ref: 02313095
RtlAllocateHeap.NTDLL(00000000), ref: 023130B6
htons.WS2_32(00000035), ref: 023130EF
inet_addr.WS2_32(?), ref: 023130FA
gethostbyname.WS2_32(?), ref: 0231310D
HeapFree.KERNEL32(00000000), ref: 0231314D

Strings

iphlpapi.dll, xrefs: 02313062, 02313067, 02313077

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 32fcad1a1a5737e413af3e0aa11185c7259ba8489030eb8631b4ea70571f5b8d
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: EC31C831A00306ABDF15ABB89C48BAE7BB8EF05764F1441B5F918E7290DB74D942CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0231958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 023195A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 023195D5
GetModuleFileNameA.KERNEL32(00000000), ref: 023195DC
wsprintfA.USER32 ref: 02319635
wsprintfA.USER32 ref: 02319673
wsprintfA.USER32 ref: 023196F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02319758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0231978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 023197D8

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 20bcb679ea5a24297ad5f16be0f6f9e7a8ddda233326bb837d36b85a9794c268
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: E3A17AB2900208AFEB29DFA0CC85FEA3BADEF04741F104026FA15E6151E7B5D584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Uniqueness

Uniqueness Score: -1.00%

Function 02316778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 023167C3
htonl.WS2_32(?), ref: 023167DF
htonl.WS2_32(?), ref: 023167EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 023168F1
ExitProcess.KERNEL32 ref: 023169BC

Strings

except_info, xrefs: 0231698F
localcfg, xrefs: 02316994

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: b8a6fcf18d72d034f745008deca9ecb6269a7c77ab660ea3aec65ca9a824f495
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 0E615D71A40208AFDB649FB4DC45FEA77F9FB08300F14806AFA6DD2161EB7599908F54

Uniqueness

Uniqueness Score: -1.00%

Function 0231F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0231CC84), ref: 0231F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0231F5CE
closesocket.WS2_32(00000000), ref: 0231F5DC

Strings

time_cfg, xrefs: 0231F58A

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 6c989e3a843b3cd77d3ba5f6be096fd8f50a2ab95f58b1992e99e58baa9fabcc
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: D9316B72900218ABDB10DFA5DC89DEFBBBCFF89310F10456AF915E3150E7709A818BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 02312F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02312FA1
LoadLibraryA.KERNEL32(?), ref: 02312FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02312FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02313000
RtlAllocateHeap.NTDLL(00000000), ref: 02313007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02313032

Strings

dnsapi.dll, xrefs: 02312F90

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 96aec9603b22aa9c52f08962aa3122a39e52f6797b3ef7ccd23e7a82f3a47a9f
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: FA217F71D01629BBCB269BA5DC48AEFBBBCEF08B50F004461F906E7540D7B49A8187E4

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 023199E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02319A18
GetThreadContext.KERNEL32(?,?), ref: 02319A52
TerminateProcess.KERNEL32(?,00000000), ref: 02319A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02319A98
SetThreadContext.KERNEL32(?,00010002), ref: 02319AB5
ResumeThread.KERNEL32(?), ref: 02319AC2

Strings

D, xrefs: 02319A10

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 199645ffdec109b0e3b94a60d7364e717577eb1efe1f6e2db66d4be9cdf882e6
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: CA213BB1E01219BBDB219BA1DC09FEFBBBCEF08750F404061BA19E5090E7758A54CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02311C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02311C18
LoadLibraryA.KERNEL32(004102C8), ref: 02311C26
GetProcessHeap.KERNEL32 ref: 02311C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02311C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02311CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 02311D02
FreeLibrary.KERNEL32(?), ref: 02311D0B

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 7c1efc27342a9b4124f18e1a51ac878b737bb41cf15716d454e645c8fefa5af3
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 53316F31D00219BFCF159FE4DC889FEBBB9EB49705B24447AE645A2110D7B54E80DB94

Uniqueness

Uniqueness Score: -1.00%

Function 02316CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02316CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02316D22
GetLastError.KERNEL32 ref: 02316DA7
CloseHandle.KERNEL32(?), ref: 02316DB5
GetLastError.KERNEL32 ref: 02316DD6
DeleteFileA.KERNEL32(?), ref: 02316DE7
GetLastError.KERNEL32 ref: 02316DFD

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 5d01f6deee1bf76ba2904616b02413f118f6473335b2dec248ae99e99a857d95
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 2A310F72901249BFCB15DFE4DD49ADEBFBEEB48300F14816AE611E3220D7708A958F61

Uniqueness

Uniqueness Score: -1.00%

Function 02316F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\kofydeki,02317043), ref: 02316F4E
GetProcAddress.KERNEL32(00000000), ref: 02316F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02316F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02316F92

Strings

\\.\pipe\kofydeki, xrefs: 02316F37
C:\Windows\SysWOW64\, xrefs: 02316F30, 02316F38, 02316F65, 02316F6C, 02316F7A, 02316F85, 02316F91, 02316FA9, 02316FC6, 02316FEC

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\kofydeki
API String ID: 1082366364-994406173
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: b5536a03160088a6e02ca8bfa9ced71dd6d00da9111003fadb0549f1fa69a047
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 8C2132217403403AF73A93319C89FFB2E4C8F52764F1C80A9F804E6481EBDA84D686AD

Uniqueness

Uniqueness Score: -1.00%

Function 0231AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0231AAE5

Strings

, xrefs: 0231ABB3
localcfg, xrefs: 0231AD72

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction ID: ed1eb3a7798155bb3ba0db64decc83e6cb3749cc8e8bb1df18c8c35800297301
Opcode Fuzzy Hash: 50699324d062f411f204296795e1435c215d76901ce01f8ee411c745418a2661
Instruction Fuzzy Hash: DA714872A05308AADF399B58DC95FEE376DAB0171BF244027F904E2090DF6289C4CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 0231E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0231DF6C: GetCurrentThreadId.KERNEL32 ref: 0231DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0231E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02316128), ref: 0231E950
lstrcmp.KERNEL32(?,00000008), ref: 0231E989

Strings

A, xrefs: 0231E9A0
A, xrefs: 0231E8C6, 0231E8CD, 0231E936, 0231E998
A, xrefs: 0231E960, 0231E965

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 1b4b8e41c3909781dc5b104eec43e50af492a51d23194fa90138ec25c254dc94
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: F5319C31A007159BDB798F24C884BA67BF8EB09725F00892AE99587559D37AE880CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 02316E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02316E19

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: b521294427fb2244cec21ef919f0ce7413a3205946e58c7e2db15339d996fc49
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: A421A272104115FFDB289BB0FD49EDF3FADDB48A65B108525F502D1091EB71DA00DA74

Uniqueness

Uniqueness Score: -1.00%

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 023192CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 023192E2
wsprintfA.USER32 ref: 02319350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02319375
lstrlen.KERNEL32(?,?,00000000), ref: 02319389
WriteFile.KERNEL32(00000000,?,00000000), ref: 02319394
CloseHandle.KERNEL32(00000000), ref: 0231939B

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: a604d268723307e7f23cd70504a1540a5c11c21ef3a5adc97b16d2edf1a6c694
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: A91184B17402147BE7386731EC0DFEF3A6EDBC8B11F018065BF09E5090EEB54A418A64

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,0040E538,?,74DF0F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 0231C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0231C6B4
InterlockedIncrement.KERNEL32(0231C74B), ref: 0231C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0231C747), ref: 0231C728
CloseHandle.KERNEL32(00000000,?,0231C747,00413588,02318A77), ref: 0231C733

Strings

localcfg, xrefs: 0231C544

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 0b886a2dcb72bd76124712c59fee5c2eb38783a10743e8a844f6a0f81d47711b
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: BF513EB1A41B418FD7388F69C594626BBE9FB48304B546D3FE18BC7A90D774E844CB11

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,74DF0F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe
API String ID: 124786226-872712706
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 023171C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 023171E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02317228
LocalFree.KERNEL32(?,?,?), ref: 02317286
wsprintfA.USER32 ref: 0231729D

Strings

|, xrefs: 0231721A

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: f9940bb84a16af4de135a1f94d4bae89cbd010a8284385b6887a8da90c8dd2e6
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 8D314972A00208BFCB15DFA8DC48BDA7BACEF04354F14C066F859DB201EB75D6498B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 0231B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0231B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0231B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0231B548
GetTimeZoneInformation.KERNEL32(?), ref: 0231B590
wsprintfA.USER32 ref: 0231B61E

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 20ef34d3d694c8eed09573c82f4ff0658f91735659d10d63758f8cd8210608e8
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 915102B1D0021DAACF18DFD5D8845EEFBBABF48304F10816AF505A6150E7B94AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 023162D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 02316303
LoadLibraryA.KERNEL32(?), ref: 0231632A
GetProcAddress.KERNEL32(00000000,?), ref: 023163B1
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 02316405

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 760d92e9daf39ffe07dc3a1e66fa2e9568191e3808850e0f0cfc6bb75b616ae5
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 71414C71A00205EBDB18CF99C886BA9B7BCEF04358F188569E865D72A1EB71E941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74DF0F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 023193AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 023193C6
GetModuleFileNameA.KERNEL32(00000000), ref: 023193CD
CharToOemA.USER32(?,?), ref: 023193DB
wsprintfA.USER32 ref: 02319410

Part of subcall function 023192CB: GetTempPathA.KERNEL32(00000400,?), ref: 023192E2
Part of subcall function 023192CB: wsprintfA.USER32 ref: 02319350
Part of subcall function 023192CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02319375
Part of subcall function 023192CB: lstrlen.KERNEL32(?,?,00000000), ref: 02319389
Part of subcall function 023192CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 02319394
Part of subcall function 023192CB: CloseHandle.KERNEL32(00000000), ref: 0231939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02319448

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 1b85353def23bf244e2469e1f6f9bf5d168ee67eecc0e7384ebb19f81c16d305
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: DE015EF6900118BBDB31A7619D89FDF3B7CDB95701F0040A2BB49E2080EAB596C58F75

Uniqueness

Uniqueness Score: -1.00%

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 023128EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 023128FA
gethostbyname.WS2_32(u6A), ref: 02312906

Strings

time_cfg, xrefs: 023128EB
u6A, xrefs: 023128EC, 023128F9, 02312905

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 8a10975a228c5ac22b469985d9509b9e5e02c3d3c4afb7f5083f2890923dbef8
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 43E017306046219FDB549B2CF848ADA7BE5EF4A230F058595F894D72A0C774DCC1AB94

Uniqueness

Uniqueness Score: -1.00%

Function 023169C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 023169E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 02316A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 02316A3A
CloseHandle.KERNEL32(000000FF), ref: 02316BD8

Part of subcall function 0231EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02311DCF,?), ref: 0231EEA8
Part of subcall function 0231EE95: HeapFree.KERNEL32(00000000), ref: 0231EEAF

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 6996ec927c0ccce7ddc80af1c44513b48da111a8f237b192ccd0bb95df287c89
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 5E71157190021DEFDB149FA5CC81AEEBBBDFB08318F10856AE515A6191D7709E92CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0231E2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0231E50A,00000000,00000000,00000000,00020106,00000000,0231E50A,00000000,000000E4), ref: 0231E319
RegSetValueExA.ADVAPI32(0231E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0231E38E
RegDeleteValueA.ADVAPI32(0231E50A,?,?,?,?,?,000000C8,004122F8), ref: 0231E3BF
RegCloseKey.ADVAPI32(0231E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0231E50A), ref: 0231E3C8

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 0c0e42b64f0a4f4e9b20cba5bb3108c2bc836451fb71b4fec581a22c013102a6
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: EE212C71A0021DABDF249FA5EC89EEE7F79EF08750F048461F905E6160E772CA54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0231417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 023141AB
GetLastError.KERNEL32 ref: 023141B5
WaitForSingleObject.KERNEL32(?,?), ref: 023141C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 023141D9

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 36087a2d0e49a3b5ad81e2265dc8d9adca3ebde9d8821292b9acb0c7d85206fa
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: C801E97651110AABDF02DF94ED84BEE7B6CEB18355F404061FA01F2050D7709A658BB5

Uniqueness

Uniqueness Score: -1.00%

Function 023141F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0231421F
GetLastError.KERNEL32 ref: 02314229
WaitForSingleObject.KERNEL32(?,?), ref: 0231423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0231424D

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 60599591a70d5581776e4706aa48a394cb57f197898fa254c71ba25d4bcd0242
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: DF01C872521109AFDF05DF90ED84BEF7BACEB08355F108461FA01E2050D770DA958BB6

Uniqueness

Uniqueness Score: -1.00%

Function 0231E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0231E066

Strings

A, xrefs: 0231E037, 0231E03C
A, xrefs: 0231E036
A, xrefs: 0231E07F

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 740bac450fbc1de6fed39bb85517740eaaaa1d23a203fa2e6ed2c24a3c02ce45
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 52F09072600702DBCB34CF26D884A82B7E9FF09325B448A2BE968C3060D375E4D8CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 02318330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 023183C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02318477

Part of subcall function 023169C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 023169E5
Part of subcall function 023169C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 02316A26
Part of subcall function 023169C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 02316A3A

Part of subcall function 0231EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02311DCF,?), ref: 0231EEA8
Part of subcall function 0231EE95: HeapFree.KERNEL32(00000000), ref: 0231EEAF

Strings

C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 0231848C, 023184A1

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe
API String ID: 359188348-872712706
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 41d699fdd0330754149400824db2863d9ab31cf4b69c515bd82244e2a995fe8b
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: B64160B2A01119BFEB28EBA09D81EFF777DEB04344F1444A6E904D6110FFB15A958B68

Uniqueness

Uniqueness Score: -1.00%

Function 0231AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0231AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0231B00D

Part of subcall function 0231AF6F: gethostname.WS2_32(?,00000080), ref: 0231AF83
Part of subcall function 0231AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0231AFE6

Part of subcall function 0231331C: gethostname.WS2_32(?,00000080), ref: 0231333F
Part of subcall function 0231331C: gethostbyname.WS2_32(?), ref: 02313349

Part of subcall function 0231AA0A: inet_ntoa.WS2_32(00000000), ref: 0231AA10

Strings

%OUTLOOK_BND_, xrefs: 0231B076, 0231B07B, 0231B0BE, 0231B0DD

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction ID: df24c1fe04f5c28378224dccc93939e64d0504ce84c232cddff33cc5f64dd18d
Opcode Fuzzy Hash: bb8041472755e196babefc9da9900d7748fbc848bd0525b5e1603bb455f94b3f
Instruction Fuzzy Hash: DC410DB290434CABDB29EFA0DC45EEE3BADFB08304F14442AF92992151EB75E6548F54

Uniqueness

Uniqueness Score: -1.00%

Function 02319452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02319536
Sleep.KERNEL32(000001F4), ref: 0231955D

Strings

, xrefs: 023194D9

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 6a0924702462506a50e2ae75fbb5a169163e4c4f26a989b3d666cdb86c9eb4d9
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 9E411671908384AFFB3E8B68DCAD7B63FE89B02314F1901A5D482A71A2DBB44981C711

Uniqueness

Uniqueness Score: -1.00%

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0231BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0231B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0231BA3A
InterlockedIncrement.KERNEL32(?), ref: 0231BA94
GetTickCount.KERNEL32 ref: 0231BB79
GetTickCount.KERNEL32 ref: 0231BB99
InterlockedIncrement.KERNEL32(?), ref: 0231BE15
closesocket.WS2_32(00000000), ref: 0231BEB4

Strings

%FROM_EMAIL, xrefs: 0231BC7D

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: febf6481257708ae7d4f4d8ae98b42196936bfb6b563b8f3c75a73b20a3918e4
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 27319F71504248DFDF29DFA4EC84BEDB7BAEB48705F20405AFA2482161DB71D685CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0231709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 023170BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 023170F4

Strings

|, xrefs: 023170E6

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 6ad58614475d668813bc8f1db1ce0b75987da9e6e072d3c9ee00da5709f3e903
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: DB11FA72904118EBDB15CBE4DC84ADEB7BDAB08715F2841B6E501E6194D7709B89CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75A8EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000B.00000002.1669986854.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Function 02313189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02312F88: GetModuleHandleA.KERNEL32(?), ref: 02312FA1
Part of subcall function 02312F88: LoadLibraryA.KERNEL32(?), ref: 02312FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 023131DA
HeapFree.KERNEL32(00000000), ref: 023131E1

Memory Dump Source

Source File: 0000000B.00000002.1671439613.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Offset: 02310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2310000_pspizbvl.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 465b6aeb7e2e64cccf4ab07b83d51eeb3a40dab821b2fee99c39a8314a24e8e3
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 19519E7191024AEFCB19AF64D884AFAB775FF05304F1445A9EC96C7210E732DA1ACB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 6912, Parent PID: 3156COMMON

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1806
Total number of Limit Nodes:	18

Executed Functions

Function 00CDC913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 00CDCA4E
closesocket.WS2_32(?), ref: 00CDCB63
GetTempPathA.KERNEL32(00000120,?), ref: 00CDCC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00CDCCB4
WriteFile.KERNEL32(00CDA4B3,?,-000000E8,?,00000000), ref: 00CDCCDC
CloseHandle.KERNEL32(00CDA4B3), ref: 00CDCCED
wsprintfA.USER32 ref: 00CDCD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 00CDCD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 00CDCD89
CloseHandle.KERNEL32(?), ref: 00CDCD98
CloseHandle.KERNEL32(?), ref: 00CDCD9D
DeleteFileA.KERNEL32(?), ref: 00CDCDC4
CloseHandle.KERNEL32(00CDA4B3), ref: 00CDCDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 00CDCFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 00CDCFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 00CDD033
lstrcatA.KERNEL32(?,04300108), ref: 00CDD10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 00CDD155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00CDD171
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000), ref: 00CDD195
CloseHandle.KERNEL32(00000000), ref: 00CDD19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 00CDD1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 00CDD231
lstrcatA.KERNEL32(?,04300108,?,?,?,?,?,?,?,00000100), ref: 00CDD27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 00CDD2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 00CDD2C7
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 00CDD2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 00CDD2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 00CDD326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 00CDD372
lstrcatA.KERNEL32(?,04300108,?,?,?,?,?,?,?,00000100), ref: 00CDD3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 00CDD3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 00CDD408
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 00CDD428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 00CDD42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 00CDD45B
CreateProcessA.KERNEL32(?,00CE0264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 00CDD4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 00CDD4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 00CDD4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 00CDD513
closesocket.WS2_32(?), ref: 00CDD56C
Sleep.KERNEL32(000003E8), ref: 00CDD577
ExitProcess.KERNEL32 ref: 00CDD583
wsprintfA.USER32 ref: 00CDD81F

Part of subcall function 00CDC65C: send.WS2_32(00000000,?,00000000), ref: 00CDC74B

closesocket.WS2_32(?), ref: 00CDDAD5

Strings

lid_file_upd, xrefs: 00CDCE6A
flags_upd, xrefs: 00CDCE4A
.dat, xrefs: 00CDD0D7, 00CDD138, 00CDD1AE, 00CDD1D4, 00CDD28E, 00CDD308, 00CDD3CF, 00CDD441
wtm_w, xrefs: 00CDC96C
localcfg, xrefs: 00CDCA89, 00CDCA93, 00CDCAC0, 00CDCAD2, 00CDCE4F, 00CDCE6F, 00CDD8D3, 00CDD8FC
wtm_c, xrefs: 00CDC956
\, xrefs: 00CDD3A7
\, xrefs: 00CDD39D
local_time, xrefs: 00CDCACD
.sys, xrefs: 00CDD0CC
C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 00CDCC10, 00CDCCF3, 00CDD975, 00CDD98E
except_info, xrefs: 00CDD8CD, 00CDD8D2, 00CDD8FB
work_srv, xrefs: 00CDD607, 00CDD60F, 00CDD62C
wtm_r, xrefs: 00CDC97F
4, xrefs: 00CDD9F7
srv_time, xrefs: 00CDCABB
time_cfg, xrefs: 00CDC95B, 00CDC962, 00CDC971, 00CDC984
@, xrefs: 00CDD754
drivers\, xrefs: 00CDD067

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\kofydeki\pspizbvl.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-2662302004
Opcode ID: 7622ae56569c010ca0c6040bb74006b86bb0a03f8102f82cecd2bce6a57eef13
Instruction ID: adde27182f9cb504876119c8e99b17e5991c7d4b6d77b3a7df3c6dc4b9964b40
Opcode Fuzzy Hash: 7622ae56569c010ca0c6040bb74006b86bb0a03f8102f82cecd2bce6a57eef13
Instruction Fuzzy Hash: 6DB28571900289ABEB21ABA4DCC9FEE7BBDEB04304F14406BF715AB291D7709A45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00CD9A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00CD9A7F
SetErrorMode.KERNELBASE(00000003), ref: 00CD9A83
SetUnhandledExceptionFilter.KERNEL32(00CD6511), ref: 00CD9A8A

Part of subcall function 00CDEC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 00CDEC5E
Part of subcall function 00CDEC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 00CDEC72
Part of subcall function 00CDEC54: GetTickCount.KERNEL32 ref: 00CDEC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00CD9AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00CD9ABA
GetCommandLineA.KERNEL32 ref: 00CD9AFD
lstrlenA.KERNEL32(?), ref: 00CD9B99
ExitProcess.KERNEL32 ref: 00CD9C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00CD9CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00CD9D7A
lstrcatA.KERNEL32(?,?), ref: 00CD9D8B
lstrcatA.KERNEL32(?,00CE070C), ref: 00CD9D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00CD9DED
DeleteFileA.KERNEL32(00000022), ref: 00CD9E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00CD9E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00CD9EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00CD9ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00CD9F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00CD9F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00CD9F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00CD9FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00CD9FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00CD9FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 00CDA038
lstrcatA.KERNEL32(00000022,00CE0A34), ref: 00CDA05E
lstrcatA.KERNEL32(00000022,00000022), ref: 00CDA072
lstrcatA.KERNEL32(00000022,00CE0A34), ref: 00CDA08D
wsprintfA.USER32 ref: 00CDA0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 00CDA0DE
lstrcatA.KERNEL32(00000022,?), ref: 00CDA0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 00CDA120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00CDA131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 00CDA174
GetModuleFileNameA.KERNEL32(00000000), ref: 00CDA17B
GetDriveTypeA.KERNEL32(00000022), ref: 00CDA1B6
GetCommandLineA.KERNEL32 ref: 00CDA1E5

Part of subcall function 00CD99D2: lstrcpyA.KERNEL32(?,?,00000100,00CE22F8,00000000,?,00CD9E9D,?,00000022,?,?,?,?,?,?,?), ref: 00CD99DF
Part of subcall function 00CD99D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00CD9E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00CD9A3C
Part of subcall function 00CD99D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00CD9E9D,?,00000022,?,?,?), ref: 00CD9A52

lstrlenA.KERNEL32(?), ref: 00CDA288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00CDA3B7
GetLastError.KERNEL32 ref: 00CDA3ED
Sleep.KERNELBASE(000003E8), ref: 00CDA400
DeleteFileA.KERNELBASE(00CE33D8), ref: 00CDA407
CreateThread.KERNELBASE(00000000,00000000,00CD405E,00000000,00000000,00000000), ref: 00CDA42C
WSAStartup.WS2_32(00001010,?), ref: 00CDA43A
CreateThread.KERNELBASE(00000000,00000000,00CD877E,00000000,00000000,00000000), ref: 00CDA469
Sleep.KERNELBASE(00000BB8), ref: 00CDA48A
GetTickCount.KERNEL32 ref: 00CDA49F
GetTickCount.KERNEL32 ref: 00CDA4B7
Sleep.KERNELBASE(00001A90), ref: 00CDA4C3

Strings

", xrefs: 00CDA078
", xrefs: 00CD9EDB
C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 00CDA1D9
D, xrefs: 00CD9F8E
P, xrefs: 00CD9DAA
\, xrefs: 00CD9D0C
%X%08X, xrefs: 00CDA0B0
kofydeki, xrefs: 00CDA389, 00CDA397
", xrefs: 00CDA189

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\kofydeki\pspizbvl.exe$D$P$\$kofydeki
API String ID: 2089075347-4179335424
Opcode ID: dfc13ab06b49269852bacab62363584b594a00186616ac9d7f4444e51f3b5250
Instruction ID: 27c6d3b0123974b6b7bf6d6adb43c5a4ddd32ef31cdee15da2a162d1b5b7a66d
Opcode Fuzzy Hash: dfc13ab06b49269852bacab62363584b594a00186616ac9d7f4444e51f3b5250
Instruction Fuzzy Hash: A85284B1D40259AFDB11EBA0CC89FEE77BCEB04300F1444A7F719A6251E7709B859B61

Uniqueness

Uniqueness Score: -1.00%

Function 00CD199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 00CD19B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,00CD1E9E), ref: 00CD19BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00CD19E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 00CD19ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 00CD19F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,00CD1E9E), ref: 00CD1A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00CD1E9E), ref: 00CD1A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00CD1E9E), ref: 00CD1A36
GetAdaptersInfo.IPHLPAPI(00000000,00CD1E9E,?,?,?,?,00000001,00CD1E9E), ref: 00CD1A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,00CD1E9E,?,?,?,?,00000001,00CD1E9E), ref: 00CD1A5A
GetAdaptersInfo.IPHLPAPI(00000000,00CD1E9E,?,?,?,?,00000001,00CD1E9E), ref: 00CD1A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00CD1E9E), ref: 00CD1A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00CD1E9E), ref: 00CD1AA4

Strings

GetBestInterface, xrefs: 00CD19EF
123.45.67.89, xrefs: 00CD19A6
GetAdaptersInfo, xrefs: 00CD19DC
GetIfEntry, xrefs: 00CD19E4
localcfg, xrefs: 00CD19A3
Iphlpapi.dll, xrefs: 00CD19B7

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 5557aa74cf2ce04f412ca05bed71cfc37324fb90e48ecac19345bcd74bbbe967
Instruction ID: a9e014de88f69e9fd22c1eb71ca7936196ad2d49f61b1d3885ceb5a4d46de9d7
Opcode Fuzzy Hash: 5557aa74cf2ce04f412ca05bed71cfc37324fb90e48ecac19345bcd74bbbe967
Instruction Fuzzy Hash: C7316171D01249BFCB119FE5DDC89BEBBB5EF44301B29057AEA15A6210D7704F80EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CD7A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00CD7ABA
GetUserNameA.ADVAPI32(?,?), ref: 00CD7ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,00CE070C,?,?,?), ref: 00CD7B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00CD7B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00CD7B59
EqualSid.ADVAPI32(?,00000022), ref: 00CD7B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00CD7B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00CD7B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00CD7B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 00CD7BAB
LocalFree.KERNEL32(00000000), ref: 00CD7BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00CD7FC9,?,00000000), ref: 00CD7BCE

Strings

C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 00CD7CE2, 00CD7D0F, 00CD7D23, 00CD7D24
D, xrefs: 00CD7B0C

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe$D
API String ID: 2976863881-4275784296
Opcode ID: 337c50b5f6c26b58aac8921f2afc1087dcd47f6d055162bdb5f80a082a47687d
Instruction ID: 21e03694c06affb653592179936035f2df1e57912791fc3e0e55a57713f0c252
Opcode Fuzzy Hash: 337c50b5f6c26b58aac8921f2afc1087dcd47f6d055162bdb5f80a082a47687d
Instruction Fuzzy Hash: 53A19E72904259AFDF118FA0DC88FEEBBBDFF44700F14416AE615E6250E7758A85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD7809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00CD782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00CD7866
GetLengthSid.ADVAPI32(?), ref: 00CD7878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00CD789A
GetSecurityDescriptorOwner.ADVAPI32(?,00CD7F63,?), ref: 00CD78B8
EqualSid.ADVAPI32(?,00CD7F63), ref: 00CD78D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 00CD78E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00CD78F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00CD7901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00CD7910
LocalFree.KERNEL32(00000000), ref: 00CD7917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CD7933
GetAce.ADVAPI32(?,00000000,?), ref: 00CD7963
EqualSid.ADVAPI32(?,00CD7F63), ref: 00CD798A
DeleteAce.ADVAPI32(?,00000000), ref: 00CD79A3
EqualSid.ADVAPI32(?,00CD7F63), ref: 00CD79C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00CD7A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00CD7A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00CD7A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00CD7A79
LocalFree.KERNEL32(00000000), ref: 00CD7A87

Strings

D, xrefs: 00CD785C

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 518e542d3189699679eb6b272a6225298fcf226e43d2926c13f03ee705686ea0
Instruction ID: 8d8e52c5134e8e350786ba50d896aff7a568be1108195389859931f49f31ea59
Opcode Fuzzy Hash: 518e542d3189699679eb6b272a6225298fcf226e43d2926c13f03ee705686ea0
Instruction Fuzzy Hash: 31814072D04159ABDB21CFA5CD84FEEBBB8EF08340F14426AE615E6250E7749B41DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD8328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00CD83F3
RegQueryValueExA.KERNELBASE(00CE0750,?,00000000,?,00CD8893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00CD8414
RegSetValueExA.KERNELBASE(00CE0750,?,00000000,00000004,00CD8893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00CD8441
RegCloseKey.ADVAPI32(00CE0750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00CD844A

Strings

C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 00CD85C8, 00CD85D5, 00CD85E5
localcfg, xrefs: 00CD8348

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe$localcfg
API String ID: 237177642-3039148244
Opcode ID: 0762c468e60e1eaaee3c28b9b6869ca0a6547e0064ca926acdb4847477bafe3c
Instruction ID: d4643da47842f228e21b4bc62f22a0a6a6a7b17fbab91dbba4ff6b5936110946
Opcode Fuzzy Hash: 0762c468e60e1eaaee3c28b9b6869ca0a6547e0064ca926acdb4847477bafe3c
Instruction Fuzzy Hash: 73C191B194024DBEEF11ABA4DC85FEE7BBCEB04300F244467F715A6251EA705F889B61

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 00CD1DC6
GetSystemInfo.KERNELBASE(?), ref: 00CD1DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00CD1E03
GetProcAddress.KERNEL32(00000000), ref: 00CD1E0A
GetCurrentProcess.KERNEL32(?), ref: 00CD1E1B
GetTickCount.KERNEL32 ref: 00CD1FC9

Part of subcall function 00CD1BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00CD1C15

Strings

IsWow64Process, xrefs: 00CD1DF2
lid_file_upd, xrefs: 00CD1E25
work_srv, xrefs: 00CD1E5E
flags_upd, xrefs: 00CD1E3E, 00CD1E43, 00CD1E7C
kernel32, xrefs: 00CD1DF7
localcfg, xrefs: 00CD1E2A, 00CD1E31, 00CD1E44, 00CD1E7D, 00CD1E8C, 00CD1EB2, 00CD1ED1, 00CD1EE7, 00CD1EFF, 00CD1F1C, 00CD1F34, 00CD1F50, 00CD1F70
born_date, xrefs: 00CD1EAD, 00CD1ECC
start_srv, xrefs: 00CD1E6C
net_type, xrefs: 00CD1E87
hi_id, xrefs: 00CD1F16, 00CD1F1B, 00CD1F33
loader_id, xrefs: 00CD1F4B, 00CD1F6B

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: cfdb4da0aa23e09cf105cf8526be2ce47b57f3f3bd0cef0f170a4711a82c2add
Instruction ID: dc25c3bb5e67827d60020bc01b0c706c83c6faf1a59fdc20500138f1f9dc0190
Opcode Fuzzy Hash: cfdb4da0aa23e09cf105cf8526be2ce47b57f3f3bd0cef0f170a4711a82c2add
Instruction Fuzzy Hash: 0251DAB15043847FE320AFB68C85F27BAECEB44704F04091EFA9A46753D7B4A944D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD73FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74DF0F10,00000000), ref: 00CD7472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00CD74F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74DF0F10,00000000), ref: 00CD7528
___ascii_stricmp.LIBCMT ref: 00CD764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00CD76E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00CD7706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00CD7717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74DF0F10,00000000), ref: 00CD7745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74DF0F10,00000000), ref: 00CD77EF

Part of subcall function 00CDF1A5: lstrlenA.KERNEL32(000000C8,000000E4,00CE22F8,000000C8,00CD7150,?), ref: 00CDF1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00CD778F
RegCloseKey.KERNELBASE(?), ref: 00CD77E6

Strings

", xrefs: 00CD7599

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: bee349a33ca13f29131b9198e85ee4d17807dbc46dad1a9273b5a9f9c1ed5277
Instruction ID: 26e326627b71dffd1b4f32863bd387573f835be1d86639798714ed6044da454d
Opcode Fuzzy Hash: bee349a33ca13f29131b9198e85ee4d17807dbc46dad1a9273b5a9f9c1ed5277
Instruction Fuzzy Hash: B9C1C371904209ABDB12ABA5DC45FEE7BB9EF44310F240597F614EA290FB70DA809B60

Uniqueness

Uniqueness Score: -1.00%

Function 00CD675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 00CD677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 00CD679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 00CD67B0
SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 00CD67BF
GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 00CD67D3
ReadFile.KERNELBASE(000000FF,?,00000040,00CD8244,00000000,?,74DF0F10,00000000), ref: 00CD6807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 00CD681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 00CD683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 00CD685C
ReadFile.KERNEL32(000000FF,?,00000028,00CD8244,00000000,?,74DF0F10,00000000), ref: 00CD688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74DF0F10,00000000), ref: 00CD6906
ReadFile.KERNEL32(000000FF,?,00000000,00CD8244,00000000,?,74DF0F10,00000000), ref: 00CD691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74DF0F10,00000000), ref: 00CD6971

Part of subcall function 00CDEC2E: GetProcessHeap.KERNEL32(00000000,00CDEA27,00000000,00CDEA27,00000000), ref: 00CDEC41
Part of subcall function 00CDEC2E: RtlFreeHeap.NTDLL(00000000), ref: 00CDEC48

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: 4556907f60d0a4c94daa468777de5f9f170128096cdaaeb6a013b6e0176f7b8b
Instruction ID: 5ce9231d181f5574eb9308480ae088e5322b378ff26db490e5ed19f8c61e2507
Opcode Fuzzy Hash: 4556907f60d0a4c94daa468777de5f9f170128096cdaaeb6a013b6e0176f7b8b
Instruction Fuzzy Hash: A4710BB1D0021DEFDF119FA5CC80AEEBBB9FB04314F10456AE625A6290E7709F92DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(00CDCA1D), ref: 00CDF34D
socket.WS2_32(00000002,00000001,00000000), ref: 00CDF367
closesocket.WS2_32(00000000), ref: 00CDF375

Strings

time_cfg, xrefs: 00CDF323

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 1cb8c8d52a28566d2572bbb3ad2c9720b94622e0f79a1c6f381cd50e6b784611
Instruction ID: 10fcc25ba9b092f9ee41330991f34251e80145b153ba12ce9190acf971302fb7
Opcode Fuzzy Hash: 1cb8c8d52a28566d2572bbb3ad2c9720b94622e0f79a1c6f381cd50e6b784611
Instruction Fuzzy Hash: F7316D72900158ABDB109FA5DC85AEF7BFCFF49314F10416AFA15D6251E7709A828BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00CD4070
ExitProcess.KERNEL32 ref: 00CD4121

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 63b697440aeed4251717c8954feab9d987cefab98dce7a952a6f29ff866acde1
Instruction ID: cd6b71c34da325717b90a6d71e56eee92181445fa43b8f47f6bbb7d64ede87e2
Opcode Fuzzy Hash: 63b697440aeed4251717c8954feab9d987cefab98dce7a952a6f29ff866acde1
Instruction Fuzzy Hash: 8E5183B1D40219BBEB24ABA18C86FFFBB7CEB15714F100056FB14A6291E7709B41D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00CD2F01,?,00CD20FF,00CE2000), ref: 00CD2D3A
LoadLibraryA.KERNEL32(?), ref: 00CD2D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00CD2D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 00CD2D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00CD2D99
HeapAlloc.KERNEL32(00000000), ref: 00CD2DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00CD2DCB

Strings

DnsQuery_A, xrefs: 00CD2D5B
dnsapi.dll, xrefs: 00CD2D29

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: 57d19596239a07bbd40d824d24bcfcc3ca4a0b5aaa44fb28fc550bd724f855cf
Instruction ID: 5b4d5ccaf0bca6bb0bf9f8cc5ede0acfe6a1772a8acea564e2decc3d8590b771
Opcode Fuzzy Hash: 57d19596239a07bbd40d824d24bcfcc3ca4a0b5aaa44fb28fc550bd724f855cf
Instruction Fuzzy Hash: 1E217471900625ABCB219F95DC84AAFBBB9EF18750F104056FA55E7210D7B0DA85CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD80C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00CD815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,00CDA45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00CD8187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,00CDA45F,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00CD81BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74DF0F10,00000000), ref: 00CD8210

Part of subcall function 00CD675C: SetFileAttributesA.KERNEL32(?,00000080,?,74DF0F10,00000000), ref: 00CD677E
Part of subcall function 00CD675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74DF0F10,00000000), ref: 00CD679A
Part of subcall function 00CD675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74DF0F10,00000000), ref: 00CD67B0
Part of subcall function 00CD675C: SetFileAttributesA.KERNEL32(?,00000002,?,74DF0F10,00000000), ref: 00CD67BF
Part of subcall function 00CD675C: GetFileSize.KERNEL32(000000FF,00000000,?,74DF0F10,00000000), ref: 00CD67D3
Part of subcall function 00CD675C: ReadFile.KERNELBASE(000000FF,?,00000040,00CD8244,00000000,?,74DF0F10,00000000), ref: 00CD6807
Part of subcall function 00CD675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 00CD681F
Part of subcall function 00CD675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74DF0F10,00000000), ref: 00CD683E
Part of subcall function 00CD675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74DF0F10,00000000), ref: 00CD685C

Part of subcall function 00CDEC2E: GetProcessHeap.KERNEL32(00000000,00CDEA27,00000000,00CDEA27,00000000), ref: 00CDEC41
Part of subcall function 00CDEC2E: RtlFreeHeap.NTDLL(00000000), ref: 00CDEC48

Strings

C:\Windows\SysWOW64\kofydeki\pspizbvl.exe, xrefs: 00CD8225, 00CD823A

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\kofydeki\pspizbvl.exe
API String ID: 124786226-872712706
Opcode ID: c841fb361d346efee3637bb4ac9615da9a56d4c28c11ac77d7c2697cc0dda6bb
Instruction ID: d800e4247118a9a4d86e447e9221f5d874d8a7c26061e2767efb2f51adb304da
Opcode Fuzzy Hash: c841fb361d346efee3637bb4ac9615da9a56d4c28c11ac77d7c2697cc0dda6bb
Instruction Fuzzy Hash: 7B4160B2901149BFEB10EBA0DDC1FBE77ACAB04304F1444ABF615A6211EA709F489B51

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00CD1AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00CD1AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00CD1B20

Strings

GetAdaptersAddresses, xrefs: 00CD1AE3
Iphlpapi.dll, xrefs: 00CD1ACC

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: e1615151d442e4a98042ff177fa72fccab77a56828a5616545d4c59f08cf2013
Instruction ID: 651864599225b59e25d07bd8a57f808fae83d11af3db7edba4bc59e2666082a6
Opcode Fuzzy Hash: e1615151d442e4a98042ff177fa72fccab77a56828a5616545d4c59f08cf2013
Instruction Fuzzy Hash: F211D6B1E01128BFCB119BA5DC858ADBBB9EB44B10B284057E615EB241E6705F81DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00CDE3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00CDE5F2,00000000,00020119,00CDE5F2,00CE22F8), ref: 00CDE3E6
RegQueryValueExA.ADVAPI32(00CDE5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 00CDE44E
RegQueryValueExA.ADVAPI32(00CDE5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 00CDE482
RegQueryValueExA.ADVAPI32(00CDE5F2,?,00000000,?,80000001,?), ref: 00CDE4CF
RegCloseKey.ADVAPI32(00CDE5F2,?,?,?,?,000000C8,000000E4), ref: 00CDE520

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: fbbc83bb5a25ab8186bf789f6edfa6a96f0993a5d41e2e69e6d95e1ad32f70fb
Instruction ID: b8e1d39b24eccc76fbe4bba0a277c5bd563970ff63bd728205cb8cb1580c6151
Opcode Fuzzy Hash: fbbc83bb5a25ab8186bf789f6edfa6a96f0993a5d41e2e69e6d95e1ad32f70fb
Instruction Fuzzy Hash: B441F7B2D00219BFDF11AFE4DC85EEEBBBDFB04344F144466FA11A6250E3319A559B60

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 00CDF2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 00CDF2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 00CDF2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00CDF2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00CDF2FD

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: c4b05f2b64282ca42a4d32eb8f49b5b57e1d42bf131a694eba7627224fb47a6d
Instruction ID: 2afd36ad1daf8c3b477471f95520477d2b992db04fbc0af4f3eef1fc35e7fcc8
Opcode Fuzzy Hash: c4b05f2b64282ca42a4d32eb8f49b5b57e1d42bf131a694eba7627224fb47a6d
Instruction Fuzzy Hash: DF11F8B2A40248BAEB11DF94CD85F9E7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CD1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00CD1AD4
Part of subcall function 00CD1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00CD1AE9
Part of subcall function 00CD1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00CD1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00CD1C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00CD1C51

Strings

localcfg, xrefs: 00CD1BE7
hi_id, xrefs: 00CD1BE5

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: e794f870f651e9c6221e3da73a79d66afb939d9c1a937ea03da77ee6ef3ecce8
Instruction ID: 2a239a9dc8089ee21abd61ad7540f9eee631c6fc32a86dbd95a0e24e8ff1e8db
Opcode Fuzzy Hash: e794f870f651e9c6221e3da73a79d66afb939d9c1a937ea03da77ee6ef3ecce8
Instruction Fuzzy Hash: 3C018076A50118BBEB50DEE9C8C59EFBABCAB84745F14047AEB12E2240D6709E4486A0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00CD1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00CD1AD4
Part of subcall function 00CD1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00CD1AE9
Part of subcall function 00CD1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00CD1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00CD1BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,00CD1EFD,00000000,00000000,00000000,00000000), ref: 00CD1BB8

Strings

localcfg, xrefs: 00CD1B7B

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: f8a735ce1ccca12f53f2cc156ede7d49dacaf8a951b1b881773dd91a23a8b2bc
Instruction ID: 03e5423533906c54bf443c50fe744bcf1da46bba610ce58b78a35a19d304eb26
Opcode Fuzzy Hash: f8a735ce1ccca12f53f2cc156ede7d49dacaf8a951b1b881773dd91a23a8b2bc
Instruction Fuzzy Hash: 15014BB6D00118BFEB009BE9CC81AEFFABDAB48650F250162AB11E7251D5705E0856E0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00CD2693
gethostbyname.WS2_32(00000001), ref: 00CD269F

Strings

time_cfg, xrefs: 00CD2684

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 49d702cb20a505e8d43c8675a574649ea775da9a5efdd8696aa4ddbfa145a8e0
Instruction ID: 329c6dac4becbac32d450bef0874b548c8441884c645a113dbc072e22e6f5918
Opcode Fuzzy Hash: 49d702cb20a505e8d43c8675a574649ea775da9a5efdd8696aa4ddbfa145a8e0
Instruction Fuzzy Hash: 08E0C2306042518FCB108F28F888BC977E5EF16330F114182F660CB2A0C770DDC29780

Uniqueness

Uniqueness Score: -1.00%

Function 00CDE52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CDDD05: GetTickCount.KERNEL32 ref: 00CDDD0F
Part of subcall function 00CDDD05: InterlockedExchange.KERNEL32(00CE36B4,00000001), ref: 00CDDD44
Part of subcall function 00CDDD05: GetCurrentThreadId.KERNEL32 ref: 00CDDD53

GetFileSize.KERNEL32(00000000,00000000,?,74DF0F10,?,00000000,?,00CDA445), ref: 00CDE558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,74DF0F10,?,00000000,?,00CDA445), ref: 00CDE583
CloseHandle.KERNEL32(00000000,?,74DF0F10,?,00000000,?,00CDA445), ref: 00CDE5B2

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 90f6510050accc204467659080187c50f93b428e3bd6781586d1435aae01abcc
Instruction ID: d84be42405f50ec2e220bd563e2c00867fedfdf2b5995333f76b0a7a745cc309
Opcode Fuzzy Hash: 90f6510050accc204467659080187c50f93b428e3bd6781586d1435aae01abcc
Instruction Fuzzy Hash: 8121E7B29402447AE6207A726C47F6F3A1CDB54754F10041ABF0AA93D3F961EA10A1F1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 00CD88A5

Part of subcall function 00CDF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,00CDE342,00000000,75A8EA50,80000001,00000000,00CDE513,?,00000000,00000000,?,000000E4), ref: 00CDF089
Part of subcall function 00CDF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,00CDE342,00000000,75A8EA50,80000001,00000000,00CDE513,?,00000000,00000000,?,000000E4,000000C8), ref: 00CDF093

Strings

rresolv, xrefs: 00CD87F6, 00CD885C
localcfg, xrefs: 00CD87CA, 00CD87CF, 00CD87FB, 00CD8835, 00CD8861

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 871ebe130d20f1f2a77043cbaa3a3d6008bea0ad08ec5a68d6f46832b9dc5aec
Instruction ID: 64b510cc9665c9df52bb62dc073b4dd51a512b0ce95c4c9adea77847cc256009
Opcode Fuzzy Hash: 871ebe130d20f1f2a77043cbaa3a3d6008bea0ad08ec5a68d6f46832b9dc5aec
Instruction Fuzzy Hash: 2C21A7325483556AF314BBA56CC7B6E36ACEB44710FA4041FF7189A3C3EEE19544A1A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD4000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,00CE22F8,00CD42B6,00000000,00000001,00CE22F8,00000000,?,00CD98FD), ref: 00CD4021
GetLastError.KERNEL32(?,00CD98FD,00000001,00000100,00CE22F8,00CDA3C7), ref: 00CD402C
Sleep.KERNEL32(000001F4,?,00CD98FD,00000001,00000100,00CE22F8,00CDA3C7), ref: 00CD4046

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 85b3e2bde55414381dcdeebb57b0c6c5a6b0f27e750a3bffbe15164896f055a9
Instruction ID: cc31a749c41c538b80114cb971cf16f5b2a5127335782f3f3bc40d60873d97bc
Opcode Fuzzy Hash: 85b3e2bde55414381dcdeebb57b0c6c5a6b0f27e750a3bffbe15164896f055a9
Instruction Fuzzy Hash: 3CF0EC312441016FD7394B34AC89B1E3361DB81730F354B26F3B5E61E0C77069C19B55

Uniqueness

Uniqueness Score: -1.00%

Function 00CDDB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00CDDC19,?,00000104), ref: 00CDDB7F
lstrcpyA.KERNEL32(?,00CE28F8), ref: 00CDDBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 00CDDBC2

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: d976afcc237430f55e107b951735e86cbcaccf800eddd8d09f11098e4e3270e2
Instruction ID: 7c4af71de4e8439429474cea0df297e3580f68d30b46c15e75e30d2b18c1d24a
Opcode Fuzzy Hash: d976afcc237430f55e107b951735e86cbcaccf800eddd8d09f11098e4e3270e2
Instruction Fuzzy Hash: B3F09070540249BBEF209F64DD89FD93B69AB10318F204194BB91A80D0D7F2D585CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00CDEC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00CDEC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 00CDEC72
GetTickCount.KERNEL32 ref: 00CDEC78

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: e5226592e93b3d4e55211ff2096d3f51fb15699a2900a8ad3e05d39034e72fc0
Instruction ID: 9c6ca390e070c1792c9715ef6f31bb500fef8208ad9fd428e551280d64ab7320
Opcode Fuzzy Hash: e5226592e93b3d4e55211ff2096d3f51fb15699a2900a8ad3e05d39034e72fc0
Instruction Fuzzy Hash: B0E09AF5810144BFE701EBB0DC8EF6F77BCFB08314F500654B911DA090DAB4AA448BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD30B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 00CD30D8
gethostbyname.WS2_32(?), ref: 00CD30E2

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 5eba99f7d1df9d1a06d7951846837efb6cd46ad0691bff5a069fa1bbc61082df
Instruction ID: 6e28b606d077367b9128c776fd29f170cf5fb5ba73e4684c251da70e7f6dc197
Opcode Fuzzy Hash: 5eba99f7d1df9d1a06d7951846837efb6cd46ad0691bff5a069fa1bbc61082df
Instruction Fuzzy Hash: 33E01B72901159ABCF10EBA8EC89F9B77ECFF05304F184561FA45E7255EA74F9048790

Uniqueness

Uniqueness Score: -1.00%

Function 00CDEBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,7FFF0001,80000001,?,00CDDB55,7FFF0001), ref: 00CDEC13
RtlReAllocateHeap.NTDLL(00000000,?,00CDDB55,7FFF0001), ref: 00CDEC1A

Part of subcall function 00CDEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,00CDEBFE,7FFF0001,?,00CDDB55,7FFF0001), ref: 00CDEBD3
Part of subcall function 00CDEBCC: RtlAllocateHeap.NTDLL(00000000,?,00CDDB55,7FFF0001), ref: 00CDEBDA

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 57e75a780ed8b3210eb671422ba2fff782ba089ad1511e36999d8b4e58d8ae6b
Instruction ID: 1888667a6b7e4f9d3f0d26cab74169660a7336a915b7d8b399a8d9318bfe402e
Opcode Fuzzy Hash: 57e75a780ed8b3210eb671422ba2fff782ba089ad1511e36999d8b4e58d8ae6b
Instruction Fuzzy Hash: 0AE01A32104218BBDF013BA4EC49BAD3B59EB44362F108017FA0D8D271CB729A90EAD8

Uniqueness

Uniqueness Score: -1.00%

Function 00CDEC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CDEBA0: GetProcessHeap.KERNEL32(00000000,00000000,00CDEC0A,00000000,80000001,?,00CDDB55,7FFF0001), ref: 00CDEBAD
Part of subcall function 00CDEBA0: HeapSize.KERNEL32(00000000,?,00CDDB55,7FFF0001), ref: 00CDEBB4

GetProcessHeap.KERNEL32(00000000,00CDEA27,00000000,00CDEA27,00000000), ref: 00CDEC41
RtlFreeHeap.NTDLL(00000000), ref: 00CDEC48

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: 4ddac468e379599b947a552967326ff080a7d2dc8e1a3122b5fa6b80d7f5ca43
Instruction ID: 819de881178a757f88354f5e4934e3dd3d8f43848ed1f840b2b330e02a0df781
Opcode Fuzzy Hash: 4ddac468e379599b947a552967326ff080a7d2dc8e1a3122b5fa6b80d7f5ca43
Instruction Fuzzy Hash: 05C01232406270ABC5513750BC4DF9F6B189F45711F19040EF5056E160C7A068804AE5

Uniqueness

Uniqueness Score: -1.00%

Function 00CDEBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,00CDEBFE,7FFF0001,?,00CDDB55,7FFF0001), ref: 00CDEBD3
RtlAllocateHeap.NTDLL(00000000,?,00CDDB55,7FFF0001), ref: 00CDEBDA

Part of subcall function 00CDEB74: GetProcessHeap.KERNEL32(00000000,00000000,00CDEC28,00000000,?,00CDDB55,7FFF0001), ref: 00CDEB81
Part of subcall function 00CDEB74: HeapSize.KERNEL32(00000000,?,00CDDB55,7FFF0001), ref: 00CDEB88

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ebc6843fad8d6f9be1a53113a4e81249a18936e092a5593f8f2e381112cf2678
Instruction ID: 946a174d4964642e60518cbc8957f743812ad5c8d877289f666a931ffeb63942
Opcode Fuzzy Hash: ebc6843fad8d6f9be1a53113a4e81249a18936e092a5593f8f2e381112cf2678
Instruction Fuzzy Hash: 6CC08C32208360BBC61137E4BC0CF9E3E98EF083A2F14000AF609CE270CB7048808BE6

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,00CDCA44), ref: 00CDF476

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 7ce263f62e1cbb5bcae88e3945b659b917c015f3d38ca7a9197c553a866fbbb0
Instruction ID: 8b87f05911e79d40228dc78b1c867183e7248b7f1dfa7b5e91c8f79c3a9194c2
Opcode Fuzzy Hash: 7ce263f62e1cbb5bcae88e3945b659b917c015f3d38ca7a9197c553a866fbbb0
Instruction Fuzzy Hash: F0F08C3220014ABB9B01AE9ADC84CAB3BAEFB893107040126FB15D7210D631E8628BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 00CD1992

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 7fe2bb7a3e5710432f6addd7aa7330ebf9dda4e04cc5423fbada7a57e257da5d
Instruction ID: df0866d236ec63cb09664d9e9f63acebc474eb5eed20a3d8a777f0aef5b70840
Opcode Fuzzy Hash: 7fe2bb7a3e5710432f6addd7aa7330ebf9dda4e04cc5423fbada7a57e257da5d
Instruction Fuzzy Hash: 85D022222082313A42002318BC0457FABCCDF04262710802BFE48C0210C730CC8283D1

Uniqueness

Uniqueness Score: -1.00%

Function 00CDDD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 00CDDDB5

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: bb628b5476d53b10703df2b01e1a7f5b3f7a8d127ebd4e41ae9405c8bdc2f8b2
Instruction ID: c201a55bbae0018cba0ff5955ffb7cd929e077c953035d04e681161e296ab6a6
Opcode Fuzzy Hash: bb628b5476d53b10703df2b01e1a7f5b3f7a8d127ebd4e41ae9405c8bdc2f8b2
Instruction Fuzzy Hash: 64F08231A00342CBCF20CE29A884756B3EAEB49325F14483FE366D2290DB30DD55CB71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00CD637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00CD9816,EntryPoint), ref: 00CD638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00CD9816,EntryPoint), ref: 00CD63A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 00CD63CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00CD63EB

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 14e94acc1e3245059de862e34d347eda2e7275b60175ba93a70df495384c216c
Instruction ID: a8644fccdaa5cdaac510d17267c5c30c99a8cad54ec55b28c206b356fd1d6242
Opcode Fuzzy Hash: 14e94acc1e3245059de862e34d347eda2e7275b60175ba93a70df495384c216c
Instruction Fuzzy Hash: F21173B2600259BFDB119F65DC49F9F3BA8EB047A5F114025FA19EB390D671DD00CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00CD1839,00CD9646), ref: 00CD1012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 00CD10C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 00CD10E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00CD1101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00CD1121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00CD1140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00CD1160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00CD1180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 00CD119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 00CD11BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 00CD11DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 00CD11FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 00CD121A

Strings

RtlNtStatusToDosError, xrefs: 00CD1194
NtQueryInformationToken, xrefs: 00CD1262
NtClose, xrefs: 00CD11B4
NtDuplicateToken, xrefs: 00CD11F3
NtOpenProcessToken, xrefs: 00CD11D4
ntdll.dll, xrefs: 00CD100D
NtTerminateProcess, xrefs: 00CD10F6
RtlSetLastWin32Error, xrefs: 00CD10D6
RtlFreeSid, xrefs: 00CD1116
RtlLengthSid, xrefs: 00CD1246
RtlInitUnicodeString, xrefs: 00CD1135
NtSetInformationToken, xrefs: 00CD1175
RtlExpandEnvironmentStrings_U, xrefs: 00CD10BC
NtSetInformationThread, xrefs: 00CD1155
NtFilterToken, xrefs: 00CD122B
RtlAllocateAndInitializeSid, xrefs: 00CD120F

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: ae2c08237d149f157cfc0b1e3a86617607c3880049a28e42c18a803bc3090619
Instruction ID: 0a2f0a3c5d8f0e5726902053f7d668a7dbf7c8a295a89587268d3fa6ae0705b1
Opcode Fuzzy Hash: ae2c08237d149f157cfc0b1e3a86617607c3880049a28e42c18a803bc3090619
Instruction Fuzzy Hash: CF515E72546AC1BAD7109B69ACC876A36A86748320F1D03679A30DB2F1D7F4EBC1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CDB211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 00CDB2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 00CDB2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 00CDB2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 00CDB2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 00CDB31A
GetTimeZoneInformation.KERNEL32(?), ref: 00CDB329
wsprintfA.USER32 ref: 00CDB3B7

Strings

Sun, xrefs: 00CDB225
Dec, xrefs: 00CDB2A3
Jul, xrefs: 00CDB280
Sat, xrefs: 00CDB24F
Tue, xrefs: 00CDB233
Nov, xrefs: 00CDB29C
Feb, xrefs: 00CDB25D
Mon, xrefs: 00CDB22C
May, xrefs: 00CDB272
Apr, xrefs: 00CDB26B
Jan, xrefs: 00CDB256
Thu, xrefs: 00CDB241
Oct, xrefs: 00CDB295
Sep, xrefs: 00CDB28E
Aug, xrefs: 00CDB287
Jun, xrefs: 00CDB279
Mar, xrefs: 00CDB264
Wed, xrefs: 00CDB23A
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 00CDB3AF
Fri, xrefs: 00CDB248

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 9b08eac1ad69ca733c2ef1cba2dc974abce9ae1560f3fe3efb9bea7a5a1e7971
Instruction ID: f48c264d208a0fc78ee5c9c93931de0c8f1d3a2f5fc33617b218c8e49c2db321
Opcode Fuzzy Hash: 9b08eac1ad69ca733c2ef1cba2dc974abce9ae1560f3fe3efb9bea7a5a1e7971
Instruction Fuzzy Hash: 10513DB1D0025DEACF14DFD6D8859EEBBB9FF48304F30412AE611AA250D7B44AC9DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CD6511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CD654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 00CD655C
htonl.WS2_32(?), ref: 00CD6578
htonl.WS2_32(?), ref: 00CD6587
wsprintfA.USER32 ref: 00CD659B
wsprintfA.USER32 ref: 00CD65DC
wsprintfA.USER32 ref: 00CD6671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 00CD668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00CD6696
wsprintfA.USER32 ref: 00CD66B0
wsprintfA.USER32 ref: 00CD66E7
wsprintfA.USER32 ref: 00CD66FF
wsprintfA.USER32 ref: 00CD671F
ExitProcess.KERNEL32 ref: 00CD6755

Strings

12:08:32, xrefs: 00CD6535
except_info, xrefs: 00CD6728
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 00CD65D6
%d=%p, xrefs: 00CD66F9
localcfg, xrefs: 00CD672D
va=%08X%08X uef=%p, xrefs: 00CD6595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00CD6547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 00CD666B
Jan 13 2018, xrefs: 00CD653A
plgs:, xrefs: 00CD66AA

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: d92f057b3b31abd3a65eda5cf9641761cc5b67c3565d4e89356dfdc94a6ac505
Instruction ID: 18f88075e0eff88f2a692547fb252a3f29f9183866cf95c2a4276c4cc8b5d199
Opcode Fuzzy Hash: d92f057b3b31abd3a65eda5cf9641761cc5b67c3565d4e89356dfdc94a6ac505
Instruction Fuzzy Hash: A2615F72940248AFDB609FB4DC45FEA77F9FF08300F24406AFA69D6261DA719980CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00CDA7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CDA7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 00CDA87E
send.WS2_32(00000000,?,00000000,00000000), ref: 00CDA893
wsprintfA.USER32 ref: 00CDA8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 00CDA8D2
wsprintfA.USER32 ref: 00CDA8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 00CDA97C
wsprintfA.USER32 ref: 00CDA9B9

Strings

., xrefs: 00CDA8CA
Incorrect respons, xrefs: 00CDAB39
Too small respons, xrefs: 00CDA9C9
AUTH LOGIN, xrefs: 00CDA80C
mail from:<%s>, xrefs: 00CDA848
Too big smtp respons (%d bytes), xrefs: 00CDA9B1
localcfg, xrefs: 00CDAB0B
ESMTP, xrefs: 00CDAA38
Error sending command (sent = %d/%d), xrefs: 00CDA8A7, 00CDA8DA
ehlo %s, xrefs: 00CDA7F5
data, xrefs: 00CDA85E
rcpt to:<%s>, xrefs: 00CDA855
helo %s, xrefs: 00CDA803
quit, xrefs: 00CDA86C

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 3febfa8e9dfcd2d55e799baacc22e771e7a8e619752347c423964bbe3f8c1741
Instruction ID: ce45c38744d5b3f86d2b4888d5a21d244dff474b773660349dd683d184a5a8ba
Opcode Fuzzy Hash: 3febfa8e9dfcd2d55e799baacc22e771e7a8e619752347c423964bbe3f8c1741
Instruction Fuzzy Hash: DCA12671904385BBDF209B54DC85FBE3769FB00304F240427FB05AA2D1DAB19E89AB97

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00CD139A
lstrlenW.KERNEL32(-00000003), ref: 00CD1571

Strings

PDu, xrefs: 00CD139A
@, xrefs: 00CD1380
useless, xrefs: 00CD161E
%systemroot%\system32\cmd.exe, xrefs: 00CD1316
uac, xrefs: 00CD1628
D, xrefs: 00CD15C6
<, xrefs: 00CD1378
, xrefs: 00CD1462
wusa.exe, xrefs: 00CD1388

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDu$uac$useless$wusa.exe
API String ID: 1628651668-179334549
Opcode ID: 724cc42b3f91bf63809c3fb8363bb14cfefd2ee7b3745f2f84587c36295e77a0
Instruction ID: aa072d1041c8f9e69cff2ad201402f7384d55926b21432634c7e731e30951898
Opcode Fuzzy Hash: 724cc42b3f91bf63809c3fb8363bb14cfefd2ee7b3745f2f84587c36295e77a0
Instruction Fuzzy Hash: 68F16EB5508381AFD320DF64C8C8B6AB7E5FB88304F18491EFA969B3A1D774D944CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74DEF380), ref: 00CD2A83
HeapAlloc.KERNEL32(00000000,?,74DEF380), ref: 00CD2A86
socket.WS2_32(00000002,00000002,00000011), ref: 00CD2AA0
htons.WS2_32(00000000), ref: 00CD2ADB
select.WS2_32 ref: 00CD2B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00CD2B4A
htons.WS2_32(?), ref: 00CD2B71
htons.WS2_32(?), ref: 00CD2B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00CD2BFB

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: dca5c3e40ebd066a7e577cdd7bb933fcf2f51f9964ead35448e4cfbce7080981
Instruction ID: d6b3c8408c48dea6944e6b461c604eb5b3883daf153e81e25f57f4adba4d1e20
Opcode Fuzzy Hash: dca5c3e40ebd066a7e577cdd7bb933fcf2f51f9964ead35448e4cfbce7080981
Instruction Fuzzy Hash: 5961E4719043459FD720AF65DC48B6FBBE8FBA8751F10080AFA999B350D7B0DD809BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,74DF0F10,?,74DF0F10,00000000), ref: 00CD70C2
RegEnumValueA.ADVAPI32(74DF0F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,74DF0F10,00000000), ref: 00CD719E
RegCloseKey.ADVAPI32(74DF0F10,?,74DF0F10,00000000), ref: 00CD71B2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00CD7208
RegCloseKey.ADVAPI32(74DF0F10), ref: 00CD7291
___ascii_stricmp.LIBCMT ref: 00CD72C2
RegCloseKey.ADVAPI32(74DF0F10), ref: 00CD72D0
RegCloseKey.ADVAPI32(74DF0F10), ref: 00CD7314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00CD738D
RegCloseKey.ADVAPI32(74DF0F10), ref: 00CD73D8

Part of subcall function 00CDF1A5: lstrlenA.KERNEL32(000000C8,000000E4,00CE22F8,000000C8,00CD7150,?), ref: 00CDF1AD

Strings

, xrefs: 00CD7194
", xrefs: 00CD7227

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: e202715904e92df85a3553fbc9d642b67f10768251f9508d04f50e8e648fffdc
Instruction ID: b1c89f9403a4c8543b12a34722f595803d94edc9a0fc420f12dd114cb3bb1638
Opcode Fuzzy Hash: e202715904e92df85a3553fbc9d642b67f10768251f9508d04f50e8e648fffdc
Instruction Fuzzy Hash: D9B17172908249AADF15EFA4DC45BEF77B8EF04300F200667F615E6290FB759A84DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CDAD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00CDAD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CDADA6

Part of subcall function 00CDAD08: gethostname.WS2_32(?,00000080), ref: 00CDAD1C
Part of subcall function 00CDAD08: lstrlenA.KERNEL32(00000000), ref: 00CDAD60
Part of subcall function 00CDAD08: lstrlenA.KERNEL32(00000000), ref: 00CDAD69
Part of subcall function 00CDAD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 00CDAD7F

Part of subcall function 00CD30B5: gethostname.WS2_32(?,00000080), ref: 00CD30D8
Part of subcall function 00CD30B5: gethostbyname.WS2_32(?), ref: 00CD30E2

wsprintfA.USER32 ref: 00CDAEA5

Part of subcall function 00CDA7A3: inet_ntoa.WS2_32(?), ref: 00CDA7A9

wsprintfA.USER32 ref: 00CDAE4F
wsprintfA.USER32 ref: 00CDAE5E

Part of subcall function 00CDEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 00CDEF92
Part of subcall function 00CDEF7C: lstrlenA.KERNEL32(?), ref: 00CDEF99
Part of subcall function 00CDEF7C: lstrlenA.KERNEL32(00000000), ref: 00CDEFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 00CDAE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 00CDAE49
%OUTLOOK_MID, xrefs: 00CDAEAE
%OUTLOOK_BND_, xrefs: 00CDAE0F, 00CDAE14, 00CDAE57, 00CDAE76
%s%d, xrefs: 00CDAE58
%OUTLOOK_HST, xrefs: 00CDAEC5
127.0.0.1, xrefs: 00CDADEB

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: b3846f7593954388651100ce2e74df3cb036e8d05727fe4f2693968d047ba608
Instruction ID: 9af1429e0c98b889f1f77c24ab20264308c0974e11f8d6f3b6efe2505919caa5
Opcode Fuzzy Hash: b3846f7593954388651100ce2e74df3cb036e8d05727fe4f2693968d047ba608
Instruction Fuzzy Hash: EC4141B290024CBBDF25FFA1CC46EEF3BADFB08300F240426BA1596251EA71D654DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74DF23A0,?,000DBBA0,?,00000000,00CD2F0F,?,00CD20FF,00CE2000), ref: 00CD2E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00CD2F0F,?,00CD20FF,00CE2000), ref: 00CD2E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00CD2E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00CD2F0F,?,00CD20FF,00CE2000), ref: 00CD2E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00CD2F0F,?,00CD20FF,00CE2000), ref: 00CD2E4F
htons.WS2_32(00000035), ref: 00CD2E88
inet_addr.WS2_32(?), ref: 00CD2E93
gethostbyname.WS2_32(?), ref: 00CD2EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00CD2F0F,?,00CD20FF,00CE2000), ref: 00CD2EE3
HeapFree.KERNEL32(00000000,?,00000000,00CD2F0F,?,00CD20FF,00CE2000), ref: 00CD2EE6

Strings

GetNetworkParams, xrefs: 00CD2E28
iphlpapi.dll, xrefs: 00CD2DFB, 00CD2E00, 00CD2E10

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: a8537e49f6134cbbc4a69cd45b7862b76f08653d8ea344de24a1a0b9712d20c5
Instruction ID: 456239582c6b9f890556428a9818206b5adfa0be8c19d3510d8a7600b4f2e7c2
Opcode Fuzzy Hash: a8537e49f6134cbbc4a69cd45b7862b76f08653d8ea344de24a1a0b9712d20c5
Instruction Fuzzy Hash: 9B31CA71900645ABDF119BB89C88B6F77B8EF24362F240116FA24EB7D0D770DE819B90

Uniqueness

Uniqueness Score: -1.00%

Function 00CD9326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00CD9DD7,?,00000022,?,?,00000000,00000001), ref: 00CD9340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00CD9DD7,?,00000022,?,?,00000000,00000001), ref: 00CD936E
GetModuleFileNameA.KERNEL32(00000000,?,00CD9DD7,?,00000022,?,?,00000000,00000001), ref: 00CD9375
wsprintfA.USER32 ref: 00CD93CE
wsprintfA.USER32 ref: 00CD940C
wsprintfA.USER32 ref: 00CD948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00CD94F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00CD9526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00CD9571

Strings

runas, xrefs: 00CD9674

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 22054fc6502cbd8d4850efaa61667cd70731e5a4a660a2cd228038eee8244dfe
Instruction ID: 6790bb1e6c6e17202074166e3bdf962e5f213896dd8d91a8a6c2163f7e96b7ad
Opcode Fuzzy Hash: 22054fc6502cbd8d4850efaa61667cd70731e5a4a660a2cd228038eee8244dfe
Instruction Fuzzy Hash: 5EA182B2940248AFEB25DFA1DC85FDE3BACEB04740F100027FA1596252E775DA85DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CDB3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CDB467

Part of subcall function 00CDEF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 00CDEF92
Part of subcall function 00CDEF7C: lstrlenA.KERNEL32(?), ref: 00CDEF99
Part of subcall function 00CDEF7C: lstrlenA.KERNEL32(00000000), ref: 00CDEFA0

Strings

%TO_USER, xrefs: 00CDB488
%TO_EMAIL, xrefs: 00CDB473
%TO_HASH, xrefs: 00CDB4B0
%FROM_EMAIL, xrefs: 00CDB3E9
%FROM_DOMAIN, xrefs: 00CDB41E
%P5DATE, xrefs: 00CDB4F2
%s@%s, xrefs: 00CDB461
%TO_DOMAIN, xrefs: 00CDB44B
%FROM_USER, xrefs: 00CDB431
%DATE, xrefs: 00CDB4D2
%M5DATE, xrefs: 00CDB50F

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f534e4cd351be335adb8efdad5e77f2d03bac7bd56fe115111bb6dcfd9772b59
Instruction ID: b274e7d40877e65ca2181b35b99d1b40fbc5f9ea9a206484ac61c6110e17d032
Opcode Fuzzy Hash: f534e4cd351be335adb8efdad5e77f2d03bac7bd56fe115111bb6dcfd9772b59
Instruction Fuzzy Hash: 3E416DB254011C7EDF01BBE5CCC2DBF7B6DEF49748B240126FA04A6242DB70AE55A7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00CD2078
GetTickCount.KERNEL32 ref: 00CD20D4
GetTickCount.KERNEL32 ref: 00CD20DB
GetTickCount.KERNEL32 ref: 00CD212B
GetTickCount.KERNEL32 ref: 00CD2132
GetTickCount.KERNEL32 ref: 00CD2142

Part of subcall function 00CDF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,00CDE342,00000000,75A8EA50,80000001,00000000,00CDE513,?,00000000,00000000,?,000000E4), ref: 00CDF089
Part of subcall function 00CDF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,00CDE342,00000000,75A8EA50,80000001,00000000,00CDE513,?,00000000,00000000,?,000000E4,000000C8), ref: 00CDF093

Part of subcall function 00CDE854: lstrcpyA.KERNEL32(00000001,?,?,00CDD8DF,00000001,localcfg,except_info,00100000,00CE0264), ref: 00CDE88B
Part of subcall function 00CDE854: lstrlenA.KERNEL32(00000001,?,00CDD8DF,00000001,localcfg,except_info,00100000,00CE0264), ref: 00CDE899

Part of subcall function 00CD1C5F: wsprintfA.USER32 ref: 00CD1CE1

Strings

rbl_bl, xrefs: 00CD2181
rbl_ip, xrefs: 00CD218F
localcfg, xrefs: 00CD2070, 00CD2160, 00CD2186, 00CD2194, 00CD21E4
net_type, xrefs: 00CD21DF

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: ae2cca885c797eebabb0d6b1e28503fa64604fb32643fcce1ed8397a692e920a
Instruction ID: 121655c3f813c99bc84c4915c0e416f56e9579f4329096659956476ae6c33f2a
Opcode Fuzzy Hash: ae2cca885c797eebabb0d6b1e28503fa64604fb32643fcce1ed8397a692e920a
Instruction Fuzzy Hash: A55106709043855EE739EF24ED86B1E7BE9AB50320F10042FE7519A2E1DBB4AA44E651

Uniqueness

Uniqueness Score: -1.00%

Function 00CDC2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00CDA4C7: GetTickCount.KERNEL32 ref: 00CDA4D1
Part of subcall function 00CDA4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 00CDA4FA

GetTickCount.KERNEL32 ref: 00CDC31F
GetTickCount.KERNEL32 ref: 00CDC32B
GetTickCount.KERNEL32 ref: 00CDC363
GetTickCount.KERNEL32 ref: 00CDC378
GetTickCount.KERNEL32 ref: 00CDC44D
InterlockedIncrement.KERNEL32(00CDC4E4), ref: 00CDC4AE
CreateThread.KERNEL32(00000000,00000000,00CDB535,00000000,?,00CDC4E0), ref: 00CDC4C1
CloseHandle.KERNEL32(00000000,?,00CDC4E0,00CE3588,00CD8810), ref: 00CDC4CC

Strings

localcfg, xrefs: 00CDC2DD

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: b694e618c59729e7ad58d38841d0c458904f10df3a79a85763829df01b4385f7
Instruction ID: 6e119db54acf47a3a724a0cb4d26440b183f70f4a6d435569042eb9fb9fdb500
Opcode Fuzzy Hash: b694e618c59729e7ad58d38841d0c458904f10df3a79a85763829df01b4385f7
Instruction Fuzzy Hash: BB513DB1500B428FD7249F6AC5D562ABBE9FB48300B50993EE29BC7BA0D774F944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00CDBE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 00CDBE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 00CDBE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 00CDBE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 00CDBF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 00CDBF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 00CDBF94

Strings

smtp_herr, xrefs: 00CDBE46, 00CDBF62
smtp_ban, xrefs: 00CDBE55, 00CDBF77
smtp_retr, xrefs: 00CDBE61, 00CDBF8C

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 84247a1987026a40d9ffe85052e2bd0c035cff011686a75b36b60900dc31b70e
Instruction ID: 8a675b56f2beea07e26b37bf962e5a4f3f996a8ae603ccd3f6d115a913ce1ada
Opcode Fuzzy Hash: 84247a1987026a40d9ffe85052e2bd0c035cff011686a75b36b60900dc31b70e
Instruction Fuzzy Hash: 1C51C075A0065AEFDB119BA5CC81BAEBBB9AF44344F114067EA41AB351D730EE40CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00CD6A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,74DE8A60,?,?,?,?,00CD9A60,?,?,00CD9E9D), ref: 00CD6A7D
GetDiskFreeSpaceA.KERNEL32(00CD9E9D,00CD9A60,?,?,?,00CE22F8,?,?,?,00CD9A60,?,?,00CD9E9D), ref: 00CD6ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00CD9A60,?,?,00CD9E9D), ref: 00CD6B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00CD9A60,?,?,00CD9E9D), ref: 00CD6B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00CD9A60,?,?,00CD9E9D), ref: 00CD6B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00CD9A60,?,?,00CD9E9D), ref: 00CD6B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00CD9A60,?,?,00CD9E9D), ref: 00CD6B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00CD9A60,?,?,00CD9E9D), ref: 00CD6B80
GetLastError.KERNEL32(?,?,?,00CD9A60,?,?,00CD9E9D,?,?,?,?,?,00CD9E9D,?,00000022,?), ref: 00CD6B96

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: e3346882926643b883b206e738793c5fbfe0ad1596002c481d7ccdb5038c4ac6
Instruction ID: a6711d981bc86f41d0f7d7a7e0d46382eb1f239986a0d71bdfd344b26baa9b8a
Opcode Fuzzy Hash: e3346882926643b883b206e738793c5fbfe0ad1596002c481d7ccdb5038c4ac6
Instruction Fuzzy Hash: 6531A2B2900289BFDB01AFA48C85BDEBB79EB44310F144067E361EB351D7709A45EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD6F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,00CDD7C3), ref: 00CD6F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,00CDD7C3), ref: 00CD6FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00CD6FE8
LocalFree.KERNEL32(00000120), ref: 00CD701F
wsprintfA.USER32 ref: 00CD7036

Strings

/%d, xrefs: 00CD7030
|, xrefs: 00CD6FB3

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 19ebde694f1d1130ffe1a391bfe16dd2e72ebc95e749858532e3250ae5c0747e
Instruction ID: 41c205f6fe83794a83e43b75cf02c412641d3ddce44de3552fca3638c9d36a1e
Opcode Fuzzy Hash: 19ebde694f1d1130ffe1a391bfe16dd2e72ebc95e749858532e3250ae5c0747e
Instruction Fuzzy Hash: 92311A72904208ABDB01DFA9D849BDE7BBCEF04314F148166F959DB241EA75EB08CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00CD6CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,00CE22F8,000000E4,00CD6DDC,000000C8), ref: 00CD6CE7
GetProcAddress.KERNEL32(00000000), ref: 00CD6CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00CD6D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00CD6D2B

Strings

kernel32, xrefs: 00CD6CE2
GetSystemWow64DirectoryA, xrefs: 00CD6CDD
C:\Windows\SysWOW64\, xrefs: 00CD6CC9, 00CD6CD1, 00CD6CFE, 00CD6D05, 00CD6D13, 00CD6D1E, 00CD6D2A, 00CD6D42, 00CD6D5F, 00CD6D85

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 2fe3cf870bed5989482c0d2019651b850efe986e2d4cd18304aa1954a70c424d
Instruction ID: a7329de586789c59789c23790ea7f2d2ec0f7e11a7d06d3edbc5c51c3accd65d
Opcode Fuzzy Hash: 2fe3cf870bed5989482c0d2019651b850efe986e2d4cd18304aa1954a70c424d
Instruction Fuzzy Hash: D62123517402D83AF72167326CC9F7B6E5E8B52701F1C005AFB04AF291CAD88986D2F6

Uniqueness

Uniqueness Score: -1.00%

Function 00CD977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00CD9947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,00CE22F8), ref: 00CD97B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,00CE22F8), ref: 00CD97EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00CE22F8), ref: 00CD97F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,00CE22F8), ref: 00CD9831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,00CE22F8), ref: 00CD984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00CE22F8), ref: 00CD985B

Strings

D, xrefs: 00CD97A9

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 1cdfe5f7b117f519cc35b3f261f5b9a6c2c364279948f331524d2d27c83a4b31
Instruction ID: cd55c3fc2eb4f5f50a2a1d452d889fb29b840e7a8eeb07474c3221be59bbde1f
Opcode Fuzzy Hash: 1cdfe5f7b117f519cc35b3f261f5b9a6c2c364279948f331524d2d27c83a4b31
Instruction Fuzzy Hash: 0E211B71901219BBDB119FA1DC89FEFBBBCEF09750F100062FA19E9150EB709A44DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CDE8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CDDD05: GetTickCount.KERNEL32 ref: 00CDDD0F
Part of subcall function 00CDDD05: InterlockedExchange.KERNEL32(00CE36B4,00000001), ref: 00CDDD44
Part of subcall function 00CDDD05: GetCurrentThreadId.KERNEL32 ref: 00CDDD53

Part of subcall function 00CDDD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 00CDDDB5

lstrcpynA.KERNEL32(?,00CD1E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,00CDEAAA,?,?), ref: 00CDE8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,00CDEAAA,?,?,00000001,?,00CD1E84,?), ref: 00CDE935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,00CDEAAA,?,?,00000001,?,00CD1E84,?,0000000A), ref: 00CDE93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,00CDEAAA,?,?,00000001,?,00CD1E84,?), ref: 00CDE94F

Strings

flags_upd, xrefs: 00CDE8A7
localcfg, xrefs: 00CDE8AB

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: a791567503e53ff6c7c70abc4bbbe95bf3fbf8cfdd9c4fdc32afbd87ebc83b7c
Instruction ID: 83ee29555c9682c880990d24661080986d65a575d2b0f9988148790d7ffb736e
Opcode Fuzzy Hash: a791567503e53ff6c7c70abc4bbbe95bf3fbf8cfdd9c4fdc32afbd87ebc83b7c
Instruction Fuzzy Hash: EC513D7290020AAFCF11EFA8C9859AEBBF9FF48304F14456AF515A7211D774EA149B60

Uniqueness

Uniqueness Score: -1.00%

Function 00CD6BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00CD6BB2

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 136c0b2da00dd1206fe3c8e9f11de98b1bd60a9e0ff21b879f7b8e68fc882643
Instruction ID: 7c3adbafe4aa7ca532dcd332fe921e147c1ab8516f01b370eeb353d9beae83ca
Opcode Fuzzy Hash: 136c0b2da00dd1206fe3c8e9f11de98b1bd60a9e0ff21b879f7b8e68fc882643
Instruction Fuzzy Hash: F8219072114105FFDB11ABB1ED89FAF3B6CDB84360B204417F642E5190EB71DA40E6B4

Uniqueness

Uniqueness Score: -1.00%

Function 00CD9064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,00CE22F8), ref: 00CD907B
wsprintfA.USER32 ref: 00CD90E9
CreateFileA.KERNEL32(00CE22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00CD910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00CD9122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 00CD912D
CloseHandle.KERNEL32(00000000), ref: 00CD9134

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 4cf97895b73ceb6d485da1f29d534cb42cbf5f4dc4a824142ca0fed61a9a29e1
Instruction ID: 70ed27b5ae3c7d277c8df21573f046d0e643cfdf1b05c4d3d71ca4811ee0630f
Opcode Fuzzy Hash: 4cf97895b73ceb6d485da1f29d534cb42cbf5f4dc4a824142ca0fed61a9a29e1
Instruction Fuzzy Hash: CF11B9B66401547BFB247732DC4EFAF367DDBC4B10F108066BB0AE9191EAB04E4197A0

Uniqueness

Uniqueness Score: -1.00%

Function 00CDDD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00CDDD0F
GetCurrentThreadId.KERNEL32 ref: 00CDDD20
GetTickCount.KERNEL32 ref: 00CDDD2E
Sleep.KERNEL32(00000000,?,74DF0F10,?,00000000,00CDE538,?,74DF0F10,?,00000000,?,00CDA445), ref: 00CDDD3B
InterlockedExchange.KERNEL32(00CE36B4,00000001), ref: 00CDDD44
GetCurrentThreadId.KERNEL32 ref: 00CDDD53

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: c3a5019f5ffe8a4a02a246ba45edcae207e4b9a7e96d7f2363f0b2619d4f4587
Instruction ID: 277ad8e6cef8bfb853be676967131d9280e9b6b9f48280052b7ad529d7b573ff
Opcode Fuzzy Hash: c3a5019f5ffe8a4a02a246ba45edcae207e4b9a7e96d7f2363f0b2619d4f4587
Instruction Fuzzy Hash: F2F089715041C4AFDB809B75ACC8B3D7B6AF744312F200017F60ACB361C76065858FB1

Uniqueness

Uniqueness Score: -1.00%

Function 00CDAD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 00CDAD1C
lstrlenA.KERNEL32(00000000), ref: 00CDAD60
lstrlenA.KERNEL32(00000000), ref: 00CDAD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 00CDAD7F

Strings

LocalHost, xrefs: 00CDAD79

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: c38e7d32a2808e818c70e1ff5a993641cc9ce653d4fa425c75352a376578b725
Instruction ID: 7ee9bf676aa496e34ba98dc36a1ab335c1a2ea2058583ecbc95a2c045e41d321
Opcode Fuzzy Hash: c38e7d32a2808e818c70e1ff5a993641cc9ce653d4fa425c75352a376578b725
Instruction Fuzzy Hash: 7B0168208441C95DDF315728C885BB83F77AB97706F20005BE6D0CB726EBA4898383A3

Uniqueness

Uniqueness Score: -1.00%

Function 00CD4280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,00CD98FD,00000001,00000100,00CE22F8,00CDA3C7), ref: 00CD4290
CloseHandle.KERNEL32(00CDA3C7), ref: 00CD43AB
CloseHandle.KERNEL32(00000001), ref: 00CD43AE

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 2ec2e53c3d4e7015c6e6341c87689e6ed3ed380cfa9ca461c21133be06f6e844
Instruction ID: c1923492b132588205fce2140a61531ec8dfeb3ab84b8c524a7b92cbf73da32b
Opcode Fuzzy Hash: 2ec2e53c3d4e7015c6e6341c87689e6ed3ed380cfa9ca461c21133be06f6e844
Instruction Fuzzy Hash: 0E418DB1C00249BBDF10ABA5CD86FAFBBB8EF40324F204556F714A6291D7749A41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD6069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,00CD64CF,00000000), ref: 00CD609C
LoadLibraryA.KERNEL32(?,?,00CD64CF,00000000), ref: 00CD60C3
GetProcAddress.KERNEL32(?,00000014), ref: 00CD614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 00CD619E

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: db1c3c620ddf802370bbf25632feec1ae8d619b15e6cef6cebf1ef2f324f7280
Instruction ID: 06f877c566fc587a7f4ed6b518bf98dabb49ede66d6877d95b765152f53fe3f7
Opcode Fuzzy Hash: db1c3c620ddf802370bbf25632feec1ae8d619b15e6cef6cebf1ef2f324f7280
Instruction Fuzzy Hash: 01415C71A00106EFDB14CF69C884BADB7B5EF14354F24816AEA25DB391D730EE41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40af98087a2132fca3339ef540c9bd2eb0974167aa7726450d9223603cd9122d
Instruction ID: bc8cdbe3424f51c1260122d1294334d10f976a596f2b17ff9b6b2bf3eb346065
Opcode Fuzzy Hash: 40af98087a2132fca3339ef540c9bd2eb0974167aa7726450d9223603cd9122d
Instruction Fuzzy Hash: A9318D71A00218ABCB219FA5CC81BBEB7F4EF58701F104457EA59EA251E274DA41AB64

Uniqueness

Uniqueness Score: -1.00%

Function 00CD26FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00CD272E
htons.WS2_32(00000001), ref: 00CD2752
htons.WS2_32(0000000F), ref: 00CD27D5
htons.WS2_32(00000001), ref: 00CD27E3
sendto.WS2_32(?,00CE2BF8,00000009,00000000,00000010,00000010), ref: 00CD2802

Part of subcall function 00CDEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,00CDEBFE,7FFF0001,?,00CDDB55,7FFF0001), ref: 00CDEBD3
Part of subcall function 00CDEBCC: RtlAllocateHeap.NTDLL(00000000,?,00CDDB55,7FFF0001), ref: 00CDEBDA

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 487463ca9473b34ca8c463a400084f1bd29f99ccdfbf5483c2d0b578e1634922
Instruction ID: 4d5a31b4e523c84c68e113a9f974289380996cf58f5a6fdbe227a645ae8f0076
Opcode Fuzzy Hash: 487463ca9473b34ca8c463a400084f1bd29f99ccdfbf5483c2d0b578e1634922
Instruction Fuzzy Hash: 0F3138342443CA9FE7308F74DCC1B697768EF29314B2A406EE966CF322D6729882D750

Uniqueness

Uniqueness Score: -1.00%

Function 00CD9145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,00CE22F8), ref: 00CD915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00CD9166
CharToOemA.USER32(?,?), ref: 00CD9174
wsprintfA.USER32 ref: 00CD91A9

Part of subcall function 00CD9064: GetTempPathA.KERNEL32(00000400,?,00000000,00CE22F8), ref: 00CD907B
Part of subcall function 00CD9064: wsprintfA.USER32 ref: 00CD90E9
Part of subcall function 00CD9064: CreateFileA.KERNEL32(00CE22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00CD910E
Part of subcall function 00CD9064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00CD9122
Part of subcall function 00CD9064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 00CD912D
Part of subcall function 00CD9064: CloseHandle.KERNEL32(00000000), ref: 00CD9134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00CD91E1

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: bd299e3aeb175e165902481629898d7461f3be6fe20d6aaa74e72d9b5a75314e
Instruction ID: b3fd38de8a2aeadfcbe5dd8999d96591126887ba751edf70b2db91f4f1c648cf
Opcode Fuzzy Hash: bd299e3aeb175e165902481629898d7461f3be6fe20d6aaa74e72d9b5a75314e
Instruction Fuzzy Hash: 520152F69001587BDB20A7619D89FDF777CDB95701F0000A2B749EA140E6B097C58FB0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00CD2491,?,?,?,00CDE844,-00000030,?,?,?,00000001), ref: 00CD2429
lstrlenA.KERNEL32(?,?,00CD2491,?,?,?,00CDE844,-00000030,?,?,?,00000001,00CD1E3D,00000001,localcfg,lid_file_upd), ref: 00CD243E
lstrcmpiA.KERNEL32(?,?), ref: 00CD2452
lstrlenA.KERNEL32(?,?,00CD2491,?,?,?,00CDE844,-00000030,?,?,?,00000001,00CD1E3D,00000001,localcfg,lid_file_upd), ref: 00CD2467

Strings

localcfg, xrefs: 00CD241F

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 373d9ad95c03919f5fa3c94e7592d6f1233293aaf65495ba64cae04e2613f368
Instruction ID: 68a695e9dcee42a1d9894339c95019190a5ab011582349ea20b9368535d0a6a9
Opcode Fuzzy Hash: 373d9ad95c03919f5fa3c94e7592d6f1233293aaf65495ba64cae04e2613f368
Instruction Fuzzy Hash: 68011A31600218AF8F11EF69CC819DE7BA9EF54364B11C426ED6997210E370EE418E90

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00CD1CE1
wsprintfA.USER32 ref: 00CD1D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00CD1CDB, 00CD1D65
localcfg, xrefs: 00CD1C70

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: cc6314347c42c3c1e004ebbcf50e15389a53ba6b6e097cd5ff2fb005ce481184
Instruction ID: cfea7e489dcdff66efb5517525993ac1ffec125e66a320360e22952ce0823063
Opcode Fuzzy Hash: cc6314347c42c3c1e004ebbcf50e15389a53ba6b6e097cd5ff2fb005ce481184
Instruction Fuzzy Hash: 4441AF72904298AFDB32DFB98C44BEE7BE99F49310F240056FE64D7252D634DA05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CDE654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CDDD05: GetTickCount.KERNEL32 ref: 00CDDD0F
Part of subcall function 00CDDD05: InterlockedExchange.KERNEL32(00CE36B4,00000001), ref: 00CDDD44
Part of subcall function 00CDDD05: GetCurrentThreadId.KERNEL32 ref: 00CDDD53

lstrcmpA.KERNEL32(74DF0F18,00000000,?,74DF0F10,00000000,?,00CD5EC1), ref: 00CDE693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74DF0F10,00000000,?,00CD5EC1), ref: 00CDE6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,74DF0F10,00000000,?,00CD5EC1), ref: 00CDE722

Strings

89ABCDEF, xrefs: 00CDE721

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 82c7dd011858fdbec955e9e67909e60239e47c0140dc1b19eebe09607357de2a
Instruction ID: 065b0089ef00f820b0c12c7c98ddc0c4fbfa697ea191d1aca62d2afef2df5778
Opcode Fuzzy Hash: 82c7dd011858fdbec955e9e67909e60239e47c0140dc1b19eebe09607357de2a
Instruction Fuzzy Hash: 2031BE31600759DBCF31AF65D884B6A77E8AB20320F10442FF6698F690E770EE81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CDE095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,00CDE2A3,00000000,00000000,00000000,00020106,00000000,00CDE2A3,00000000,000000E4), ref: 00CDE0B2
RegSetValueExA.ADVAPI32(00CDE2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,00CE22F8), ref: 00CDE127
RegDeleteValueA.ADVAPI32(00CDE2A3,?,?,?,?,?,000000C8,00CE22F8), ref: 00CDE158
RegCloseKey.ADVAPI32(00CDE2A3,?,?,?,?,000000C8,00CE22F8,?,?,?,?,?,?,?,?,00CDE2A3), ref: 00CDE161

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: beed7724f3f4861379d18e50420936f771ff417f9bda2c7f8f991f98c9340aa0
Instruction ID: ea5fb22f8702866a4d979ceae5c5dc46d5d55e69053d55010177ec7ab3a97c79
Opcode Fuzzy Hash: beed7724f3f4861379d18e50420936f771ff417f9bda2c7f8f991f98c9340aa0
Instruction Fuzzy Hash: B5219371A00219BBDF20AFA5DC89EDF7F79EF04750F104062FA14EA151E671CA54DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CD3F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,00CDA3C7,00000000,00000000,000007D0,00000001), ref: 00CD3FB8
GetLastError.KERNEL32 ref: 00CD3FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00CD3FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CD3FE6

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: cb6935212f6cb65979c9c713857affa5b2b412365e167a0768f31bead617b40b
Instruction ID: ef321abf6f9e0f2962b7d6c67bb83b1fe26a5096d2935bdf516962fc5b6a5908
Opcode Fuzzy Hash: cb6935212f6cb65979c9c713857affa5b2b412365e167a0768f31bead617b40b
Instruction Fuzzy Hash: E001D07291024AABDF11DF94DD85BEE7BBCEB04356F1040A2FA02E6150D7709B588BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CD3F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00CDA3C7,00000000,00000000,000007D0,00000001), ref: 00CD3F44
GetLastError.KERNEL32 ref: 00CD3F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00CD3F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CD3F72

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: a66969d9319558d20273080c3959a363d76f9dcafd82d64e2b918539d5d45027
Instruction ID: 995f6545ce91f75aeeb22bf652b70c990f9019981c8844e5be8e7db3d02321d9
Opcode Fuzzy Hash: a66969d9319558d20273080c3959a363d76f9dcafd82d64e2b918539d5d45027
Instruction Fuzzy Hash: B401D0B2911149ABDB01DF90ED88BEE7BBCEB04356F604066FA01E6150D7709B548BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CDA4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00CDA4D1
GetTickCount.KERNEL32 ref: 00CDA4E4
Sleep.KERNEL32(00000000,?,00CDC2E9,00CDC4E0,00000000,localcfg,?,00CDC4E0,00CE3588,00CD8810), ref: 00CDA4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 00CDA4FA

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 6c15ba3abe88473cbf3f5499a9ec8b95711be41a015976d31af7b0bba5907464
Instruction ID: 1e3203a8173346072eabce3b9e97e290d2d32d353f2ffdbdf773c06c61a553cc
Opcode Fuzzy Hash: 6c15ba3abe88473cbf3f5499a9ec8b95711be41a015976d31af7b0bba5907464
Instruction Fuzzy Hash: A2E0863320121557C60057A6ACC4F6E7798EB89761F254062FB05D7240D696AA8145F7

Uniqueness

Uniqueness Score: -1.00%

Function 00CD4E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00CD4E9E
GetTickCount.KERNEL32 ref: 00CD4EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00CD4EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00CD4EC3

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 6133b94f268e4c02c58b579c47b6a43fd98d5fa138ad3a4f73452e5994b346d8
Instruction ID: 00e8fb76c2e7220cdf3984091ad80fc2d56f0920ce5ab3c2bdb31d35487221f4
Opcode Fuzzy Hash: 6133b94f268e4c02c58b579c47b6a43fd98d5fa138ad3a4f73452e5994b346d8
Instruction Fuzzy Hash: 28E08C322012546BD61027BAACC4F6AA799AB96371F210533EB09D6280C6A6998245F1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD4BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00CD4BDD
GetTickCount.KERNEL32 ref: 00CD4BEC
Sleep.KERNEL32(00000000,?,?,?,0321B0E4,00CD50F2), ref: 00CD4BF9
InterlockedExchange.KERNEL32(0321B0D8,00000001), ref: 00CD4C02

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: dd8133f7e666e272a69a2f0a2448cc13ee99b9d67ac0d2183bf36598ab899359
Instruction ID: edffe6044721933bd9e9185fa3d9d47b79784ffc0d11dcd074216421e62b948b
Opcode Fuzzy Hash: dd8133f7e666e272a69a2f0a2448cc13ee99b9d67ac0d2183bf36598ab899359
Instruction Fuzzy Hash: 5BE0863224161467C61017A65CC0F6A7798DB95362F160073F708D6250C5A6D58145F1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD30FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00CD3103
GetTickCount.KERNEL32 ref: 00CD310F
Sleep.KERNEL32(00000000), ref: 00CD311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00CD3128

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: ee9cc7ba1dab39a533db14b34f051da7a2a9ed0d7c94f4e7e6893a4a327c2a02
Instruction ID: 9ac33c844ffdbae81835ed5e686366b144ce00beb3562008d2339196835b424c
Opcode Fuzzy Hash: ee9cc7ba1dab39a533db14b34f051da7a2a9ed0d7c94f4e7e6893a4a327c2a02
Instruction Fuzzy Hash: 75E027353002565FDB0017759DC5B4E6B69DFC4761F110033F301D6160C5D04D4149B3

Uniqueness

Uniqueness Score: -1.00%

Function 00CD8CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00CD8D02
GetTickCount.KERNEL32 ref: 00CD8DA1

Strings

localcfg, xrefs: 00CD8D19

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 76a5ff752dd5da7cb28337becc31f40454ae818be7c44208e20db185139dfee1
Instruction ID: d0700a11a3eff3880b527d9b6f291dee8278afda46f1b742110185228e612c32
Opcode Fuzzy Hash: 76a5ff752dd5da7cb28337becc31f40454ae818be7c44208e20db185139dfee1
Instruction Fuzzy Hash: 2F21C332610556AFCB109BA4CCC5B6EB7BAEB20710B29009BE511DB2E1CF24EA45C750

Uniqueness

Uniqueness Score: -1.00%

Function 00CDBFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00CDBFD0
wsprintfA.USER32 ref: 00CDC060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 00CDC057

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 507c9ed80a7f8fc86777c998b6e5994dba3c865798090a749493c1cab6be31f2
Instruction ID: ff3e9f7810cc96c597aa1dc362edfd09066a3a4e27e541a241e2bbb9b715e3f9
Opcode Fuzzy Hash: 507c9ed80a7f8fc86777c998b6e5994dba3c865798090a749493c1cab6be31f2
Instruction Fuzzy Hash: 10119772100140FFDB429BA9CD44E567FA6FF88318B34919CF6188E166D633D863EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CD38F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD30FA: GetTickCount.KERNEL32 ref: 00CD3103
Part of subcall function 00CD30FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00CD3128

GetCurrentThreadId.KERNEL32 ref: 00CD3929
GetCurrentThreadId.KERNEL32 ref: 00CD3939

Strings

%FROM_EMAIL, xrefs: 00CD3913

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: d549029d7e0c7d00538b13a4821566df5bf4561caa203965f8c6949475ff9da7
Instruction ID: cdf06a855ea15ea58e76f1de4ed00ee6390a2d130cfb0a5a27e4bf4d0f77933f
Opcode Fuzzy Hash: d549029d7e0c7d00538b13a4821566df5bf4561caa203965f8c6949475ff9da7
Instruction Fuzzy Hash: A8110471900294EBE720DF1AD485B5CF3F4FB04725F20855AEA559B391C7B0AA81DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CDAB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,00CDBD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 00CDABB9
InterlockedIncrement.KERNEL32(00CE3640), ref: 00CDABE1

Strings

%FROM_EMAIL, xrefs: 00CDAB8C

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 362925fed4da8a4a8d05d6db3f0d4df9d9374d37996bdb635e4ca62bf66863cf
Instruction ID: a9ed4b00f63879ef64f128a50a8aa6c007a2add56ad906b3d3d95fb9c6777c96
Opcode Fuzzy Hash: 362925fed4da8a4a8d05d6db3f0d4df9d9374d37996bdb635e4ca62bf66863cf
Instruction Fuzzy Hash: 75018C315082C4AFDB118F19D885F967BAABF55314F144496F6908B352C3B4EA85CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CD26B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 00CD26C3
inet_ntoa.WS2_32(?), ref: 00CD26E4

Strings

localcfg, xrefs: 00CD26CD, 00CD26D2, 00CD26DE

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: b0bf18425e9937d5a5f10188644277c3e004d173744a0aefa59d4f9ede0f613b
Instruction ID: a1063f15c88ba237471c1a8bcab598d6c94b2917f032b488712d3ab2512e7a27
Opcode Fuzzy Hash: b0bf18425e9937d5a5f10188644277c3e004d173744a0aefa59d4f9ede0f613b
Instruction Fuzzy Hash: BFF012321583096BEB046FA4EC49B9A379CDB05750F248426FB18DE190DBB1D9419798

Uniqueness

Uniqueness Score: -1.00%

Function 00CDEAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00CDEB54,_alldiv,00CDF0B7,80000001,00000000,00989680,00000000,?,?,?,00CDE342,00000000,75A8EA50,80000001,00000000), ref: 00CDEAF2
GetProcAddress.KERNEL32(76E90000,00000000), ref: 00CDEB07

Strings

ntdll.dll, xrefs: 00CDEAED

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 033121fcfdfa52b54231c97a62d8d96ce6cdf0ec762ddaab676320af6f5d344f
Instruction ID: 5fdb913b95b6ec6336fd776f80f7f8a8190ded6e232a4cda664b69b15ac0222f
Opcode Fuzzy Hash: 033121fcfdfa52b54231c97a62d8d96ce6cdf0ec762ddaab676320af6f5d344f
Instruction Fuzzy Hash: 21D0C9346103C2BB8F229F759E8FB0D76ACBB54702B50401AB516CE220E774E984DA08

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD2D21: GetModuleHandleA.KERNEL32(00000000,74DF23A0,?,00000000,00CD2F01,?,00CD20FF,00CE2000), ref: 00CD2D3A
Part of subcall function 00CD2D21: LoadLibraryA.KERNEL32(?), ref: 00CD2D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00CD2F73
HeapFree.KERNEL32(00000000), ref: 00CD2F7A

Memory Dump Source

Source File: 0000000D.00000002.2873883444.0000000000CD0000.00000040.00000400.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_cd0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 8adf3707b670226d3b5c8319e21853463f34f283c8e394c13b6966c2a7276deb
Instruction ID: 831eb4b3cb7915eb46c99deba321ceedbe46e5c1066d3ef661ee02da15fd1325
Opcode Fuzzy Hash: 8adf3707b670226d3b5c8319e21853463f34f283c8e394c13b6966c2a7276deb
Instruction Fuzzy Hash: BC518E7190025ADFDF019F64D8889FAB775FF15304F10456AEEA6DB320E7329A19CB90

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OgcktrbHkI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Temp\pspizbvl.exe

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

C:\Windows\SysWOW64\kofydeki\pspizbvl.exe (copy)

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Windows Analysis Report
OgcktrbHkI.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre